joakimp
4c27e6fd8a
Validate / docs-check (push) Successful in 15s
Validate / validate-base (push) Successful in 12m13s
Validate / validate-omos (push) Failing after 15m48s
Validate / validate-with-pi (push) Successful in 13m43s
Validate / validate-omos-with-pi (push) Has been cancelled
Two-Dockerfile split-base build alongside the existing single-Dockerfile
pipeline. Goal: cut CI wall clock from ~165-180min to ~30-40min on
typical version-bump-only releases by reusing a base image across the
four variants.
Files added:
- Dockerfile.base variant-independent layers (apt, locales, AWS
CLI, Node.js, mempalace, gitea-mcp, user setup,
chromadb prewarm, ENVs, entrypoints).
- Dockerfile.variant FROMs ${BASE_IMAGE} and adds opencode / pi /
omos / Go installs gated by INSTALL_* args.
Each npm install -g uses NPM_CONFIG_PREFIX=/usr
per-RUN to keep baked binaries off the volume-
shadowed ~/.pi/npm-global path inherited from
base.
- .gitea/workflows/docker-publish-split.yml
workflow_dispatch-only pipeline:
base-decide -> build-base (conditional) ->
smoke-* (4 parallel) -> build-variant-*
(4 parallel) -> promote-base-latest ->
update-description. Hash-driven base reuse:
if base-<sha> already exists on Docker Hub,
the build is skipped entirely. Inputs:
release_tag (test tag suffix, default
v0.0.0-split-test) and promote_latest
(default false; gates latest-* aliases and
Hub description update).
Files unchanged:
- Dockerfile, docker-publish.yml, validate.yml all left in place so
the production tag-push pipeline keeps working untouched.
Migration plan (in CHANGELOG Unreleased):
1. workflow_dispatch test run with promote_latest=false; verify the
four variant images smoke-pass and have plausible sizes.
2. Compare manifest digests against the same-version output from the
production pipeline (independent test run on the same commit).
3. Once verified across 1-2 release cycles, swap docker-publish-split.yml
to on: push: tags: v* and retire docker-publish.yml.
AGENTS.md and CHANGELOG.md updated with file roles and the migration
plan. Production pipeline behavior is bit-for-bit unchanged on this
branch.
577 lines
22 KiB
YAML
577 lines
22 KiB
YAML
name: Publish Docker Image (split-base)
|
||
|
||
# Two-phase split-base build pipeline. Lives ALONGSIDE the original
|
||
# docker-publish.yml during the migration window. Triggers only on
|
||
# workflow_dispatch (manual) so it doesn't conflict with the production
|
||
# tag-trigger pipeline.
|
||
#
|
||
# Once we've validated 1-2 successful runs and verified output
|
||
# byte-for-byte against the original, this workflow takes over `on:
|
||
# push: tags: v*` and the original is retired.
|
||
#
|
||
# Pipeline shape:
|
||
# 1. base-decide compute base hash from Dockerfile.base + rootfs/
|
||
# + entrypoints; probe Docker Hub for existing tag.
|
||
# 2. build-base only if probe missed; multi-arch push of base-<hash>.
|
||
# 3. smoke-* (×4) amd64-only build of each variant FROMing the base
|
||
# tag; runs scripts/smoke-test.sh.
|
||
# 4. build-variant-* multi-arch push of each variant tag (the user-
|
||
# (×4) facing release tags, unchanged in shape).
|
||
# 5. promote-base-latest re-tag base-<hash> → base-latest with `crane copy`
|
||
# (manifest copy, no rebuild).
|
||
# 6. update-description patch Docker Hub description (unchanged).
|
||
|
||
on:
|
||
workflow_dispatch:
|
||
inputs:
|
||
release_tag:
|
||
description: 'Release tag to publish (e.g. v1.14.42-split). Pushed to Docker Hub as both the literal tag and `latest*`-aliases.'
|
||
required: true
|
||
default: 'v0.0.0-split-test'
|
||
promote_latest:
|
||
description: 'Update latest/latest-omos/latest-with-pi/latest-omos-with-pi aliases (set false for test runs)'
|
||
required: false
|
||
default: 'false'
|
||
|
||
concurrency:
|
||
group: ${{ github.workflow }}-${{ github.ref }}
|
||
cancel-in-progress: false
|
||
|
||
env:
|
||
BUILDKIT_PROGRESS: plain
|
||
IMAGE: ${{ vars.DOCKERHUB_USERNAME }}/opencode-devbox
|
||
|
||
# ───────────────────────────────────────────────────────────────────
|
||
# Reusable disk-reclaim snippet — strips catthehacker toolchains and
|
||
# stale docker state. Identical to the production workflow's pattern.
|
||
# ───────────────────────────────────────────────────────────────────
|
||
|
||
jobs:
|
||
# ── Phase 1: decide whether base needs rebuilding ──────────────────
|
||
base-decide:
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
outputs:
|
||
base_tag: ${{ steps.compute.outputs.base_tag }}
|
||
need_build: ${{ steps.probe.outputs.need_build }}
|
||
steps:
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Compute base tag from Dockerfile.base + dependencies
|
||
id: compute
|
||
run: |
|
||
# Hash inputs that determine the base image's contents.
|
||
# Order is fixed via `find -print0 | sort -z` for reproducibility.
|
||
HASH=$(
|
||
{
|
||
cat Dockerfile.base
|
||
find rootfs -type f -print0 2>/dev/null | sort -z | xargs -0 cat 2>/dev/null
|
||
cat entrypoint.sh entrypoint-user.sh
|
||
} | sha256sum | cut -c1-12
|
||
)
|
||
BASE_TAG="base-${HASH}"
|
||
echo "base_tag=${BASE_TAG}" >> "$GITHUB_OUTPUT"
|
||
echo "Computed base tag: ${BASE_TAG}"
|
||
|
||
- name: Force IPv4 for Docker Hub
|
||
run: echo 'precedence ::ffff:0:0/96 100' >> /etc/gai.conf
|
||
|
||
- name: Probe Docker Hub for existing base tag
|
||
id: probe
|
||
run: |
|
||
set +e
|
||
docker manifest inspect "${IMAGE}:${{ steps.compute.outputs.base_tag }}" \
|
||
> /dev/null 2>&1
|
||
PROBE_RC=$?
|
||
set -e
|
||
if [ "${PROBE_RC}" = "0" ]; then
|
||
echo "need_build=false" >> "$GITHUB_OUTPUT"
|
||
echo "Base tag ${IMAGE}:${{ steps.compute.outputs.base_tag }} exists — skipping rebuild."
|
||
else
|
||
echo "need_build=true" >> "$GITHUB_OUTPUT"
|
||
echo "Base tag ${IMAGE}:${{ steps.compute.outputs.base_tag }} missing — will build."
|
||
fi
|
||
|
||
# ── Phase 2: build & push base (multi-arch), only when needed ──────
|
||
build-base:
|
||
needs: [base-decide]
|
||
if: needs.base-decide.outputs.need_build == 'true'
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Force IPv4 for Docker Hub
|
||
run: echo 'precedence ::ffff:0:0/96 100' >> /etc/gai.conf
|
||
|
||
- name: Reclaim runner disk
|
||
run: |
|
||
set -x
|
||
df -h / || true
|
||
rm -rf \
|
||
/opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
|
||
/usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
|
||
/usr/local/lib/android /usr/local/share/powershell \
|
||
/usr/local/share/chromium /usr/local/share/boost \
|
||
/usr/lib/jvm 2>/dev/null || true
|
||
apt-get clean || true
|
||
rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* || true
|
||
docker system prune -af --volumes || true
|
||
docker builder prune -af || true
|
||
df -h / || true
|
||
|
||
- name: Set up QEMU
|
||
uses: docker/setup-qemu-action@v3
|
||
with:
|
||
platforms: arm64
|
||
|
||
- name: Set up Docker Buildx
|
||
uses: docker/setup-buildx-action@v4
|
||
with:
|
||
driver-opts: network=host
|
||
|
||
- name: Login to Docker Hub
|
||
uses: docker/login-action@v3
|
||
with:
|
||
username: ${{ vars.DOCKERHUB_USERNAME }}
|
||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||
|
||
- name: Build and push base (multi-arch)
|
||
uses: docker/build-push-action@v7
|
||
with:
|
||
context: .
|
||
file: Dockerfile.base
|
||
platforms: linux/amd64,linux/arm64
|
||
push: true
|
||
tags: ${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
|
||
# Registry cache for faster repeat base rebuilds (e.g. Node bump).
|
||
cache-from: type=registry,ref=${{ env.IMAGE }}:base-buildcache
|
||
cache-to: type=registry,ref=${{ env.IMAGE }}:base-buildcache,mode=max
|
||
|
||
# ── Phase 3: amd64 smoke per variant (gates the multi-arch publish) ─
|
||
# Each smoke job builds amd64-only against the base tag and runs
|
||
# scripts/smoke-test.sh. base-decide.outputs.base_tag is always set;
|
||
# build-base may have been skipped (cache hit) but the tag exists either way.
|
||
|
||
smoke-base:
|
||
needs: [base-decide, build-base]
|
||
if: |
|
||
always() &&
|
||
needs.base-decide.result == 'success' &&
|
||
(needs.build-base.result == 'success' || needs.build-base.result == 'skipped')
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- name: Force IPv4 for Docker Hub
|
||
run: echo 'precedence ::ffff:0:0/96 100' >> /etc/gai.conf
|
||
- name: Reclaim runner disk
|
||
run: |
|
||
rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
|
||
/usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
|
||
/usr/local/lib/android /usr/local/share/powershell \
|
||
/usr/local/share/chromium /usr/local/share/boost \
|
||
/usr/lib/jvm 2>/dev/null || true
|
||
docker system prune -af --volumes || true
|
||
docker builder prune -af || true
|
||
- uses: docker/setup-buildx-action@v4
|
||
with: {driver-opts: network=host}
|
||
- uses: docker/login-action@v3
|
||
with:
|
||
username: ${{ vars.DOCKERHUB_USERNAME }}
|
||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||
- name: Build amd64 variant for smoke
|
||
uses: docker/build-push-action@v7
|
||
with:
|
||
context: .
|
||
file: Dockerfile.variant
|
||
platforms: linux/amd64
|
||
push: false
|
||
load: true
|
||
tags: opencode-devbox:smoke-base
|
||
build-args: |
|
||
BASE_IMAGE=${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
|
||
INSTALL_OPENCODE=true
|
||
INSTALL_OMOS=false
|
||
INSTALL_PI=false
|
||
- name: Smoke test (amd64)
|
||
run: bash scripts/smoke-test.sh opencode-devbox:smoke-base --variant base
|
||
|
||
smoke-omos:
|
||
needs: [base-decide, build-base]
|
||
if: |
|
||
always() &&
|
||
needs.base-decide.result == 'success' &&
|
||
(needs.build-base.result == 'success' || needs.build-base.result == 'skipped')
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- run: echo 'precedence ::ffff:0:0/96 100' >> /etc/gai.conf
|
||
- run: |
|
||
rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
|
||
/usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
|
||
/usr/local/lib/android /usr/local/share/powershell \
|
||
/usr/local/share/chromium /usr/local/share/boost \
|
||
/usr/lib/jvm 2>/dev/null || true
|
||
docker system prune -af --volumes || true
|
||
docker builder prune -af || true
|
||
- uses: docker/setup-buildx-action@v4
|
||
with: {driver-opts: network=host}
|
||
- uses: docker/login-action@v3
|
||
with:
|
||
username: ${{ vars.DOCKERHUB_USERNAME }}
|
||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||
- uses: docker/build-push-action@v7
|
||
with:
|
||
context: .
|
||
file: Dockerfile.variant
|
||
platforms: linux/amd64
|
||
push: false
|
||
load: true
|
||
tags: opencode-devbox:smoke-omos
|
||
build-args: |
|
||
BASE_IMAGE=${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
|
||
INSTALL_OPENCODE=true
|
||
INSTALL_OMOS=true
|
||
INSTALL_PI=false
|
||
- run: bash scripts/smoke-test.sh opencode-devbox:smoke-omos --variant omos
|
||
|
||
smoke-with-pi:
|
||
needs: [base-decide, build-base]
|
||
if: |
|
||
always() &&
|
||
needs.base-decide.result == 'success' &&
|
||
(needs.build-base.result == 'success' || needs.build-base.result == 'skipped')
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- run: echo 'precedence ::ffff:0:0/96 100' >> /etc/gai.conf
|
||
- run: |
|
||
rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
|
||
/usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
|
||
/usr/local/lib/android /usr/local/share/powershell \
|
||
/usr/local/share/chromium /usr/local/share/boost \
|
||
/usr/lib/jvm 2>/dev/null || true
|
||
docker system prune -af --volumes || true
|
||
docker builder prune -af || true
|
||
- uses: docker/setup-buildx-action@v4
|
||
with: {driver-opts: network=host}
|
||
- uses: docker/login-action@v3
|
||
with:
|
||
username: ${{ vars.DOCKERHUB_USERNAME }}
|
||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||
- uses: docker/build-push-action@v7
|
||
with:
|
||
context: .
|
||
file: Dockerfile.variant
|
||
platforms: linux/amd64
|
||
push: false
|
||
load: true
|
||
tags: opencode-devbox:smoke-with-pi
|
||
build-args: |
|
||
BASE_IMAGE=${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
|
||
INSTALL_OPENCODE=true
|
||
INSTALL_OMOS=false
|
||
INSTALL_PI=true
|
||
- run: bash scripts/smoke-test.sh opencode-devbox:smoke-with-pi --variant with-pi
|
||
|
||
smoke-omos-with-pi:
|
||
needs: [base-decide, build-base]
|
||
if: |
|
||
always() &&
|
||
needs.base-decide.result == 'success' &&
|
||
(needs.build-base.result == 'success' || needs.build-base.result == 'skipped')
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- run: echo 'precedence ::ffff:0:0/96 100' >> /etc/gai.conf
|
||
- run: |
|
||
rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
|
||
/usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
|
||
/usr/local/lib/android /usr/local/share/powershell \
|
||
/usr/local/share/chromium /usr/local/share/boost \
|
||
/usr/lib/jvm 2>/dev/null || true
|
||
docker system prune -af --volumes || true
|
||
docker builder prune -af || true
|
||
- uses: docker/setup-buildx-action@v4
|
||
with: {driver-opts: network=host}
|
||
- uses: docker/login-action@v3
|
||
with:
|
||
username: ${{ vars.DOCKERHUB_USERNAME }}
|
||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||
- uses: docker/build-push-action@v7
|
||
with:
|
||
context: .
|
||
file: Dockerfile.variant
|
||
platforms: linux/amd64
|
||
push: false
|
||
load: true
|
||
tags: opencode-devbox:smoke-omos-with-pi
|
||
build-args: |
|
||
BASE_IMAGE=${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
|
||
INSTALL_OPENCODE=true
|
||
INSTALL_OMOS=true
|
||
INSTALL_PI=true
|
||
- run: bash scripts/smoke-test.sh opencode-devbox:smoke-omos-with-pi --variant omos-with-pi
|
||
|
||
# ── Phase 4: multi-arch publish per variant ────────────────────────
|
||
|
||
build-variant-base:
|
||
needs: [base-decide, smoke-base]
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- run: echo 'precedence ::ffff:0:0/96 100' >> /etc/gai.conf
|
||
- run: |
|
||
rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
|
||
/usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
|
||
/usr/local/lib/android /usr/local/share/powershell \
|
||
/usr/local/share/chromium /usr/local/share/boost \
|
||
/usr/lib/jvm 2>/dev/null || true
|
||
docker system prune -af --volumes || true
|
||
docker builder prune -af || true
|
||
- uses: docker/setup-qemu-action@v3
|
||
with: {platforms: arm64}
|
||
- uses: docker/setup-buildx-action@v4
|
||
with: {driver-opts: network=host}
|
||
- uses: docker/login-action@v3
|
||
with:
|
||
username: ${{ vars.DOCKERHUB_USERNAME }}
|
||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||
- name: Compute version-specific tags
|
||
id: tags
|
||
run: |
|
||
VERSION="${{ inputs.release_tag }}"
|
||
TAGS="${IMAGE}:${VERSION}"
|
||
if [ "${{ inputs.promote_latest }}" = "true" ]; then
|
||
TAGS="${TAGS}\n${IMAGE}:latest"
|
||
fi
|
||
echo -e "tags<<EOF\n${TAGS}\nEOF" >> "$GITHUB_OUTPUT"
|
||
- uses: docker/build-push-action@v7
|
||
with:
|
||
context: .
|
||
file: Dockerfile.variant
|
||
platforms: linux/amd64,linux/arm64
|
||
push: true
|
||
build-args: |
|
||
BASE_IMAGE=${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
|
||
INSTALL_OPENCODE=true
|
||
INSTALL_OMOS=false
|
||
INSTALL_PI=false
|
||
tags: ${{ steps.tags.outputs.tags }}
|
||
|
||
build-variant-omos:
|
||
needs: [base-decide, smoke-omos]
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- run: echo 'precedence ::ffff:0:0/96 100' >> /etc/gai.conf
|
||
- run: |
|
||
rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
|
||
/usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
|
||
/usr/local/lib/android /usr/local/share/powershell \
|
||
/usr/local/share/chromium /usr/local/share/boost \
|
||
/usr/lib/jvm 2>/dev/null || true
|
||
docker system prune -af --volumes || true
|
||
docker builder prune -af || true
|
||
- uses: docker/setup-qemu-action@v3
|
||
with: {platforms: arm64}
|
||
- uses: docker/setup-buildx-action@v4
|
||
with: {driver-opts: network=host}
|
||
- uses: docker/login-action@v3
|
||
with:
|
||
username: ${{ vars.DOCKERHUB_USERNAME }}
|
||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||
- name: Compute version-specific tags
|
||
id: tags
|
||
run: |
|
||
VERSION="${{ inputs.release_tag }}"
|
||
TAGS="${IMAGE}:${VERSION}-omos"
|
||
if [ "${{ inputs.promote_latest }}" = "true" ]; then
|
||
TAGS="${TAGS}\n${IMAGE}:latest-omos"
|
||
fi
|
||
echo -e "tags<<EOF\n${TAGS}\nEOF" >> "$GITHUB_OUTPUT"
|
||
- uses: docker/build-push-action@v7
|
||
with:
|
||
context: .
|
||
file: Dockerfile.variant
|
||
platforms: linux/amd64,linux/arm64
|
||
push: true
|
||
build-args: |
|
||
BASE_IMAGE=${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
|
||
INSTALL_OPENCODE=true
|
||
INSTALL_OMOS=true
|
||
INSTALL_PI=false
|
||
tags: ${{ steps.tags.outputs.tags }}
|
||
|
||
build-variant-with-pi:
|
||
needs: [base-decide, smoke-with-pi]
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- run: echo 'precedence ::ffff:0:0/96 100' >> /etc/gai.conf
|
||
- run: |
|
||
rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
|
||
/usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
|
||
/usr/local/lib/android /usr/local/share/powershell \
|
||
/usr/local/share/chromium /usr/local/share/boost \
|
||
/usr/lib/jvm 2>/dev/null || true
|
||
docker system prune -af --volumes || true
|
||
docker builder prune -af || true
|
||
- uses: docker/setup-qemu-action@v3
|
||
with: {platforms: arm64}
|
||
- uses: docker/setup-buildx-action@v4
|
||
with: {driver-opts: network=host}
|
||
- uses: docker/login-action@v3
|
||
with:
|
||
username: ${{ vars.DOCKERHUB_USERNAME }}
|
||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||
- name: Compute version-specific tags
|
||
id: tags
|
||
run: |
|
||
VERSION="${{ inputs.release_tag }}"
|
||
TAGS="${IMAGE}:${VERSION}-with-pi"
|
||
if [ "${{ inputs.promote_latest }}" = "true" ]; then
|
||
TAGS="${TAGS}\n${IMAGE}:latest-with-pi"
|
||
fi
|
||
echo -e "tags<<EOF\n${TAGS}\nEOF" >> "$GITHUB_OUTPUT"
|
||
- uses: docker/build-push-action@v7
|
||
with:
|
||
context: .
|
||
file: Dockerfile.variant
|
||
platforms: linux/amd64,linux/arm64
|
||
push: true
|
||
build-args: |
|
||
BASE_IMAGE=${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
|
||
INSTALL_OPENCODE=true
|
||
INSTALL_OMOS=false
|
||
INSTALL_PI=true
|
||
tags: ${{ steps.tags.outputs.tags }}
|
||
|
||
build-variant-omos-with-pi:
|
||
needs: [base-decide, smoke-omos-with-pi]
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- run: echo 'precedence ::ffff:0:0/96 100' >> /etc/gai.conf
|
||
- run: |
|
||
rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
|
||
/usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
|
||
/usr/local/lib/android /usr/local/share/powershell \
|
||
/usr/local/share/chromium /usr/local/share/boost \
|
||
/usr/lib/jvm 2>/dev/null || true
|
||
docker system prune -af --volumes || true
|
||
docker builder prune -af || true
|
||
- uses: docker/setup-qemu-action@v3
|
||
with: {platforms: arm64}
|
||
- uses: docker/setup-buildx-action@v4
|
||
with: {driver-opts: network=host}
|
||
- uses: docker/login-action@v3
|
||
with:
|
||
username: ${{ vars.DOCKERHUB_USERNAME }}
|
||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||
- name: Compute version-specific tags
|
||
id: tags
|
||
run: |
|
||
VERSION="${{ inputs.release_tag }}"
|
||
TAGS="${IMAGE}:${VERSION}-omos-with-pi"
|
||
if [ "${{ inputs.promote_latest }}" = "true" ]; then
|
||
TAGS="${TAGS}\n${IMAGE}:latest-omos-with-pi"
|
||
fi
|
||
echo -e "tags<<EOF\n${TAGS}\nEOF" >> "$GITHUB_OUTPUT"
|
||
- uses: docker/build-push-action@v7
|
||
with:
|
||
context: .
|
||
file: Dockerfile.variant
|
||
platforms: linux/amd64,linux/arm64
|
||
push: true
|
||
build-args: |
|
||
BASE_IMAGE=${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
|
||
INSTALL_OPENCODE=true
|
||
INSTALL_OMOS=true
|
||
INSTALL_PI=true
|
||
tags: ${{ steps.tags.outputs.tags }}
|
||
|
||
# ── Phase 5: promote base-<hash> → base-latest (manifest copy only) ─
|
||
promote-base-latest:
|
||
needs:
|
||
- base-decide
|
||
- build-variant-base
|
||
- build-variant-omos
|
||
- build-variant-with-pi
|
||
- build-variant-omos-with-pi
|
||
if: inputs.promote_latest == 'true'
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- uses: imjasonh/setup-crane@v0.4
|
||
- name: Login (crane)
|
||
run: |
|
||
crane auth login docker.io \
|
||
-u ${{ vars.DOCKERHUB_USERNAME }} \
|
||
-p "${{ secrets.DOCKERHUB_TOKEN }}"
|
||
- name: Re-tag base-<hash> as base-latest
|
||
run: |
|
||
crane copy \
|
||
${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }} \
|
||
${{ env.IMAGE }}:base-latest
|
||
|
||
# ── Phase 6: update Hub description (only on real release runs) ────
|
||
update-description:
|
||
needs:
|
||
- build-variant-base
|
||
- build-variant-omos
|
||
- build-variant-with-pi
|
||
- build-variant-omos-with-pi
|
||
if: inputs.promote_latest == 'true'
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- name: Update Docker Hub description
|
||
run: |
|
||
TOKEN=$(curl -s -X POST https://hub.docker.com/v2/auth/token \
|
||
-H "Content-Type: application/json" \
|
||
-d '{"identifier":"${{ vars.DOCKERHUB_USERNAME }}","secret":"${{ secrets.DOCKERHUB_TOKEN }}"}' \
|
||
| jq -r .access_token)
|
||
if [ "$TOKEN" = "null" ] || [ -z "$TOKEN" ]; then
|
||
echo "::error::Failed to authenticate with Docker Hub API"
|
||
exit 1
|
||
fi
|
||
HTTP_CODE=$(jq -n \
|
||
--rawfile full DOCKER_HUB.md \
|
||
--arg short "Portable AI dev environment for opencode. Debian-based with git, Node.js, AWS CLI, and SSH support." \
|
||
'{"full_description": $full, "description": $short}' | \
|
||
curl -s -o /tmp/hub-response.txt -w "%{http_code}" -X PATCH \
|
||
"https://hub.docker.com/v2/repositories/${{ vars.DOCKERHUB_USERNAME }}/opencode-devbox/" \
|
||
-H "Authorization: Bearer $TOKEN" \
|
||
-H "Content-Type: application/json" \
|
||
-d @-)
|
||
if [ "$HTTP_CODE" != "200" ]; then
|
||
echo "Response body:"
|
||
cat /tmp/hub-response.txt
|
||
echo "::error::Docker Hub description update failed with HTTP $HTTP_CODE"
|
||
exit 1
|
||
fi
|