pi
acb2096406
Two CI-only changes ported from pi-devbox (no runtime/image impact), adapted to opencode-devbox's split-base 2-variant pipeline. Rides the next release. C — eliminate the sh-vs-bash footgun class: - Add `defaults: run: shell: bash` workflow-wide to docker-publish-split.yml and validate.yml. Gitea's default step shell is sh/dash, so bash-only syntax in a step that omits `shell: bash` fails silently. All pre-existing steps are POSIX, so bash runs them unchanged (no behavioural change). - New .gitea/workflows/lint.yml (push/PR/dispatch): a Gitea-accurate shell guard (scripts/check-workflow-shell.sh) + pinned actionlint + shellcheck. The guard closes the actionlint blind spot: actionlint models GitHub (default shell bash) so it does NOT flag bash syntax in a shell-less step. Guard scans ALL .gitea/workflows/*.yml (hence the validate.yml default too). Ported from pi-devbox 26384fe/d1db595. B — promote-base-latest re-points base-latest by digest, not need_build: The gate keyed off need_build=='true', assuming need_build==false meant base-latest was current. A dry-run dispatch that pre-builds base-<hash> falsifies that, leaving base-latest one base behind. Gate now runs on every tag release / promote dispatch; the no-op optimization moved into the step as a crane digest compare (re-tags only when base-latest != released base-<hash>). Ported from pi-devbox b7197e8. Validated locally: all 3 workflows YAML-parse; shell guard passes real workflows and correctly fails a synthetic omit-shell+pipefail workflow; actionlint (pinned 1.7.7) passes with explicit .gitea/workflows/*.yml glob.
666 lines
30 KiB
YAML
666 lines
30 KiB
YAML
name: Publish Docker Image
|
||
|
||
# Two-phase split-base build pipeline. Replaces the original
|
||
# docker-publish.yml single-Dockerfile pipeline.
|
||
#
|
||
# Pipeline shape:
|
||
# 1. base-decide compute base hash from Dockerfile.base + rootfs/
|
||
# + entrypoints; probe Docker Hub for existing tag.
|
||
# 2. build-base only if probe missed; multi-arch push of base-<hash>.
|
||
# 3. smoke-* (×2) amd64-only build of each variant FROMing the base
|
||
# tag; runs scripts/smoke-test.sh.
|
||
# 4. build-variant-* multi-arch push of each variant tag (the user-
|
||
# (×2) facing release tags, unchanged in shape).
|
||
# 5. promote-base-latest re-tag base-<hash> → base-latest with `crane copy`
|
||
# (manifest copy, no rebuild).
|
||
# 6. update-description patch Docker Hub description (unchanged).
|
||
|
||
on:
|
||
push:
|
||
tags:
|
||
- 'v*'
|
||
workflow_dispatch:
|
||
inputs:
|
||
release_tag:
|
||
description: 'Release tag to publish (e.g. v1.14.50). Used only for workflow_dispatch runs — tag-triggered runs derive the tag from github.ref.'
|
||
required: false
|
||
default: ''
|
||
promote_latest:
|
||
description: 'Update latest/* aliases (default true for tag-push, set false for manual test runs)'
|
||
required: false
|
||
default: 'false'
|
||
|
||
concurrency:
|
||
group: ${{ github.workflow }}-${{ github.ref }}
|
||
cancel-in-progress: false
|
||
|
||
# Gitea Actions' default step shell is `sh -e {0}` (dash), which rejects
|
||
# bash-only syntax like `set -o pipefail`, `[[ ]]`, and arrays. Setting the
|
||
# default to bash workflow-wide eliminates the whole class of "forgot
|
||
# `shell: bash` on this step" bugs. (Ported from pi-devbox, where this class
|
||
# bit twice: ed49b8d resolve-versions, b7197e8/b33e9dc promote-base-latest,
|
||
# run 418.) All existing dash steps use only POSIX syntax, so bash (a
|
||
# superset) runs them unchanged. Enforced by lint.yml's shell guard.
|
||
defaults:
|
||
run:
|
||
shell: bash
|
||
|
||
env:
|
||
BUILDKIT_PROGRESS: plain
|
||
IMAGE: ${{ vars.DOCKERHUB_USERNAME }}/opencode-devbox
|
||
RELEASE_TAG: ${{ github.ref_type == 'tag' && github.ref_name || inputs.release_tag }}
|
||
PROMOTE_LATEST: ${{ github.ref_type == 'tag' && 'true' || inputs.promote_latest }}
|
||
|
||
# ───────────────────────────────────────────────────────────────────
|
||
# Reusable disk-reclaim snippet — strips catthehacker toolchains and
|
||
# stale docker state. Identical to the production workflow's pattern.
|
||
# ───────────────────────────────────────────────────────────────────
|
||
|
||
jobs:
|
||
# ── Phase 1: decide whether base needs rebuilding ──────────────────
|
||
base-decide:
|
||
needs: [resolve-versions]
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
outputs:
|
||
base_tag: ${{ steps.compute.outputs.base_tag }}
|
||
need_build: ${{ steps.probe.outputs.need_build }}
|
||
steps:
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Guard — base *_REF args must be folded into the base hash
|
||
run: bash scripts/check-base-hash.sh
|
||
|
||
- name: Compute base tag from Dockerfile.base + dependencies
|
||
id: compute
|
||
run: |
|
||
# Hash inputs that determine the base image's contents.
|
||
# Order is fixed via `find -print0 | sort -z` for reproducibility.
|
||
# Junk filters: __pycache__/*.pyc and macOS metadata (.DS_Store,
|
||
# ._AppleDouble) are gitignored locally but still picked up by
|
||
# `find rootfs -type f`, which would diverge the local hash from
|
||
# CI's clean checkout. Exclude them defensively here.
|
||
HASH=$(
|
||
{
|
||
cat Dockerfile.base
|
||
find rootfs -type f \
|
||
! -path '*/__pycache__/*' \
|
||
! -name '*.pyc' \
|
||
! -name '.DS_Store' \
|
||
! -name '._*' \
|
||
-print0 2>/dev/null | sort -z | xargs -0 cat 2>/dev/null
|
||
cat entrypoint.sh entrypoint-user.sh
|
||
# mempalace-toolkit is cloned in Dockerfile.base at a ref CI
|
||
# resolves to a SHA; fold it in so base_tag changes when the
|
||
# toolkit moves (otherwise a toolkit-only fix never lands).
|
||
echo "${{ needs.resolve-versions.outputs.mempalace_toolkit_ref }}"
|
||
} | sha256sum | cut -c1-12
|
||
)
|
||
BASE_TAG="base-${HASH}"
|
||
echo "base_tag=${BASE_TAG}" >> "$GITHUB_OUTPUT"
|
||
echo "Computed base tag: ${BASE_TAG}"
|
||
|
||
- name: Force IPv4 for Docker Hub
|
||
run: echo 'precedence ::ffff:0:0/96 100' >> /etc/gai.conf
|
||
|
||
- name: Probe Docker Hub for existing base tag
|
||
id: probe
|
||
run: |
|
||
set +e
|
||
docker manifest inspect "${IMAGE}:${{ steps.compute.outputs.base_tag }}" \
|
||
> /dev/null 2>&1
|
||
PROBE_RC=$?
|
||
set -e
|
||
if [ "${PROBE_RC}" = "0" ]; then
|
||
echo "need_build=false" >> "$GITHUB_OUTPUT"
|
||
echo "Base tag ${IMAGE}:${{ steps.compute.outputs.base_tag }} exists — skipping rebuild."
|
||
else
|
||
echo "need_build=true" >> "$GITHUB_OUTPUT"
|
||
echo "Base tag ${IMAGE}:${{ steps.compute.outputs.base_tag }} missing — will build."
|
||
fi
|
||
|
||
# ── Phase 1b: resolve floating npm versions (omos) to concrete
|
||
# versions so the variant build-args carry a different value when an
|
||
# upstream package bumps. Without this, when OMOS_VERSION defaults to
|
||
# 'latest', the docker/build-push-action build-arg string is byte-
|
||
# identical across builds, so the resulting layer-hash is identical,
|
||
# so the registry buildcache silently reuses the layer from whatever
|
||
# omos version was current when the cache was first populated. Same
|
||
# class of bug as pi-devbox v0.74.0..v0.75.5 (fixed in v0.75.5b
|
||
# 2026-05-23). Currently masked because OPENCODE_VERSION is hard-coded
|
||
# in Dockerfile.variant and bumps every release — invalidating the
|
||
# parent-chain cache key for the omos layer — but that masking would
|
||
# fail the moment we cut a vN.N.Nb opencode-version-unchanged release
|
||
# that only bumps omos. Fix is preventative.
|
||
resolve-versions:
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
outputs:
|
||
omos_version: ${{ steps.resolve.outputs.omos_version }}
|
||
mempalace_toolkit_ref: ${{ steps.resolve.outputs.mempalace_toolkit_ref }}
|
||
steps:
|
||
- name: Resolve omos version from npm registry
|
||
id: resolve
|
||
shell: bash
|
||
run: |
|
||
set -euo pipefail
|
||
# Fail loud rather than silently shipping a floating ref or a bad
|
||
# version. A transient network/API failure must ABORT the release,
|
||
# not bake an unpinned ref that defeats both cache-busting AND
|
||
# after-the-fact reproducibility. (Previously the gitea lookup fell
|
||
# back to `main` via `|| echo`, and the npm lookup had no guard.)
|
||
# NOTE: shell: bash is REQUIRED — `set -o pipefail` is illegal in
|
||
# the runner's default dash/sh and aborts the step immediately.
|
||
require_sha() { # $1=label $2=value
|
||
if ! printf '%s' "${2:-}" | grep -qiE '^[0-9a-f]{40}$'; then
|
||
echo "::error::Could not resolve $1 to a commit SHA (got '${2:-<empty>}'). Refusing to fall back to a floating ref — published images must stay reproducible. Check connectivity and GITEA_BUILD_TOKEN/GITHUB_TOKEN."
|
||
exit 1
|
||
fi
|
||
}
|
||
# Query the npm registry directly via curl+jq rather than `npm view`.
|
||
# catthehacker/ubuntu:act-latest ships Node/npm under /opt/acttoolcache/
|
||
# and adds it to PATH only via /etc/environment — which act_runner never
|
||
# sources (it reads the Docker image's ENV instructions, not /etc/environment).
|
||
# curl and jq are both guaranteed present in every job in this workflow.
|
||
OMOS_VERSION=$(curl -sf "https://registry.npmjs.org/oh-my-opencode-slim/latest" | jq -r '.version' 2>/dev/null || true)
|
||
if ! printf '%s' "${OMOS_VERSION:-}" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+'; then
|
||
echo "::error::Could not resolve oh-my-opencode-slim version from npm (got '${OMOS_VERSION:-<empty>}'). Refusing to build with an unresolved version."
|
||
exit 1
|
||
fi
|
||
echo "omos_version=${OMOS_VERSION}" >> "$GITHUB_OUTPUT"
|
||
echo "Resolved OMOS_VERSION=${OMOS_VERSION}"
|
||
# Resolve mempalace-toolkit main HEAD to a commit SHA. Unlike omos
|
||
# (an npm pkg baked into the VARIANT), mempalace-toolkit is cloned
|
||
# in Dockerfile.base, so this SHA is ALSO folded into the
|
||
# base-decide hash to force a base rebuild when the toolkit moves
|
||
# (without it, a toolkit-only fix silently fails to land unless
|
||
# Dockerfile.base itself changes). gitea allows unauthenticated
|
||
# public-repo commit listing; the token header is harmless if the
|
||
# env vars are unset (degrades to anon, still HTTP 200).
|
||
MEMPALACE_TOOLKIT_REF=$(curl -sf -H "Authorization: token ${GITEA_BUILD_TOKEN:-${GITHUB_TOKEN:-}}" \
|
||
"https://gitea.jordbo.se/api/v1/repos/joakimp/mempalace-toolkit/commits?limit=1&sha=main" \
|
||
| jq -r '.[0].sha // empty' 2>/dev/null || true)
|
||
require_sha MEMPALACE_TOOLKIT_REF "$MEMPALACE_TOOLKIT_REF"
|
||
echo "mempalace_toolkit_ref=${MEMPALACE_TOOLKIT_REF}" >> "$GITHUB_OUTPUT"
|
||
echo "Resolved MEMPALACE_TOOLKIT_REF=${MEMPALACE_TOOLKIT_REF}"
|
||
|
||
# ── Phase 2: build & push base (multi-arch), only when needed ──────
|
||
build-base:
|
||
needs: [base-decide, resolve-versions]
|
||
if: needs.base-decide.outputs.need_build == 'true'
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Force IPv4 for Docker Hub
|
||
run: echo 'precedence ::ffff:0:0/96 100' >> /etc/gai.conf
|
||
|
||
- name: Reclaim runner disk
|
||
run: |
|
||
set -x
|
||
df -h / || true
|
||
rm -rf \
|
||
/opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
|
||
/usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
|
||
/usr/local/lib/android /usr/local/share/powershell \
|
||
/usr/local/share/chromium /usr/local/share/boost \
|
||
/usr/lib/jvm 2>/dev/null || true
|
||
apt-get clean || true
|
||
rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* || true
|
||
docker system prune -af --volumes || true
|
||
docker builder prune -af || true
|
||
df -h / || true
|
||
|
||
- name: Set up QEMU
|
||
uses: docker/setup-qemu-action@v3
|
||
with:
|
||
platforms: arm64
|
||
|
||
- name: Set up Docker Buildx
|
||
uses: docker/setup-buildx-action@v4
|
||
with:
|
||
driver-opts: network=host
|
||
|
||
- name: Login to Docker Hub
|
||
uses: docker/login-action@v3
|
||
with:
|
||
username: ${{ vars.DOCKERHUB_USERNAME }}
|
||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||
|
||
- name: Build and push base (multi-arch) — with retry
|
||
shell: bash
|
||
env:
|
||
BASE_TAG_FULL: ${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
|
||
MEMPALACE_TOOLKIT_REF: ${{ needs.resolve-versions.outputs.mempalace_toolkit_ref }}
|
||
run: |
|
||
set -euo pipefail
|
||
# 3-attempt retry around `docker buildx build --push` for transient
|
||
# registry-1.docker.io blips. Does NOT mask deterministic failures:
|
||
# a true regression (e.g. cache-export 400 hit 2026-05-23..28) will
|
||
# fail all 3 attempts identically and the job still fails — by
|
||
# design.
|
||
# Registry cache disabled: buildkit's cache-export (mode=max) hits a
|
||
# reproducible HTTP 400 from registry-1.docker.io on the resumable-
|
||
# upload PUT (state-token format mismatch on Hub CDN, suspected to
|
||
# have started ~2026-05-23). Image push itself works fine. We pay
|
||
# the full base build on every Dockerfile.base change, but the base
|
||
# tag itself is content-addressed (base-<hash>) so unchanged bases
|
||
# short-circuit at the probe step and never re-build anyway. Re-
|
||
# enable when upstream resolves; tracked in CHANGELOG v1.15.12.
|
||
for attempt in 1 2 3; do
|
||
echo "==> Build+push attempt ${attempt}/3"
|
||
if docker buildx build \
|
||
--platform linux/amd64,linux/arm64 \
|
||
--file Dockerfile.base \
|
||
--build-arg MEMPALACE_TOOLKIT_REF="${MEMPALACE_TOOLKIT_REF}" \
|
||
--push \
|
||
--tag "${BASE_TAG_FULL}" \
|
||
.; then
|
||
echo "==> Attempt ${attempt} succeeded"
|
||
exit 0
|
||
fi
|
||
if [[ "${attempt}" -lt 3 ]]; then
|
||
backoff=$(( attempt * 15 ))
|
||
echo "==> Attempt ${attempt} failed, sleeping ${backoff}s before retry"
|
||
sleep "${backoff}"
|
||
fi
|
||
done
|
||
echo "==> All 3 build+push attempts failed"
|
||
exit 1
|
||
|
||
# ── Phase 3: amd64 smoke per variant (gates the multi-arch publish) ─
|
||
# Each smoke job builds amd64-only against the base tag and runs
|
||
# scripts/smoke-test.sh. base-decide.outputs.base_tag is always set;
|
||
# build-base may have been skipped (cache hit) but the tag exists either way.
|
||
|
||
smoke-base:
|
||
needs: [base-decide, build-base]
|
||
if: |
|
||
always() &&
|
||
needs.base-decide.result == 'success' &&
|
||
(needs.build-base.result == 'success' || needs.build-base.result == 'skipped')
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- name: Force IPv4 for Docker Hub
|
||
run: echo 'precedence ::ffff:0:0/96 100' >> /etc/gai.conf
|
||
- name: Reclaim runner disk
|
||
run: |
|
||
rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
|
||
/usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
|
||
/usr/local/lib/android /usr/local/share/powershell \
|
||
/usr/local/share/chromium /usr/local/share/boost \
|
||
/usr/lib/jvm 2>/dev/null || true
|
||
docker system prune -af --volumes || true
|
||
docker builder prune -af || true
|
||
- uses: docker/setup-buildx-action@v4
|
||
with: {driver-opts: network=host}
|
||
- uses: docker/login-action@v3
|
||
with:
|
||
username: ${{ vars.DOCKERHUB_USERNAME }}
|
||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||
- name: Build amd64 variant for smoke
|
||
uses: docker/build-push-action@v7
|
||
with:
|
||
context: .
|
||
file: Dockerfile.variant
|
||
platforms: linux/amd64
|
||
push: false
|
||
load: true
|
||
tags: opencode-devbox:smoke-base
|
||
build-args: |
|
||
BASE_IMAGE=${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
|
||
INSTALL_OPENCODE=true
|
||
INSTALL_OMOS=false
|
||
RELEASE_TAG=smoke
|
||
SOURCE_REVISION=${{ github.sha }}
|
||
- name: Smoke test (amd64)
|
||
run: bash scripts/smoke-test.sh opencode-devbox:smoke-base --variant base
|
||
|
||
smoke-omos:
|
||
needs: [base-decide, build-base, resolve-versions]
|
||
if: |
|
||
always() &&
|
||
needs.base-decide.result == 'success' &&
|
||
needs.resolve-versions.result == 'success' &&
|
||
(needs.build-base.result == 'success' || needs.build-base.result == 'skipped')
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- run: echo 'precedence ::ffff:0:0/96 100' >> /etc/gai.conf
|
||
- run: |
|
||
rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
|
||
/usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
|
||
/usr/local/lib/android /usr/local/share/powershell \
|
||
/usr/local/share/chromium /usr/local/share/boost \
|
||
/usr/lib/jvm 2>/dev/null || true
|
||
docker system prune -af --volumes || true
|
||
docker builder prune -af || true
|
||
- uses: docker/setup-buildx-action@v4
|
||
with: {driver-opts: network=host}
|
||
- uses: docker/login-action@v3
|
||
with:
|
||
username: ${{ vars.DOCKERHUB_USERNAME }}
|
||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||
- uses: docker/build-push-action@v7
|
||
with:
|
||
context: .
|
||
file: Dockerfile.variant
|
||
platforms: linux/amd64
|
||
push: false
|
||
load: true
|
||
tags: opencode-devbox:smoke-omos
|
||
build-args: |
|
||
BASE_IMAGE=${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
|
||
INSTALL_OPENCODE=true
|
||
INSTALL_OMOS=true
|
||
OMOS_VERSION=${{ needs.resolve-versions.outputs.omos_version }}
|
||
RELEASE_TAG=smoke
|
||
SOURCE_REVISION=${{ github.sha }}
|
||
- env:
|
||
EXPECTED_OMOS_VERSION: ${{ needs.resolve-versions.outputs.omos_version }}
|
||
run: bash scripts/smoke-test.sh opencode-devbox:smoke-omos --variant omos
|
||
|
||
# ── Phase 4: multi-arch publish per variant ────────────────────────
|
||
|
||
build-variant-base:
|
||
needs: [base-decide, smoke-base, resolve-versions]
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- run: echo 'precedence ::ffff:0:0/96 100' >> /etc/gai.conf
|
||
- run: |
|
||
rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
|
||
/usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
|
||
/usr/local/lib/android /usr/local/share/powershell \
|
||
/usr/local/share/chromium /usr/local/share/boost \
|
||
/usr/lib/jvm 2>/dev/null || true
|
||
docker system prune -af --volumes || true
|
||
docker builder prune -af || true
|
||
- uses: docker/setup-qemu-action@v3
|
||
with: {platforms: arm64}
|
||
- uses: docker/setup-buildx-action@v4
|
||
with: {driver-opts: network=host}
|
||
- uses: docker/login-action@v3
|
||
with:
|
||
username: ${{ vars.DOCKERHUB_USERNAME }}
|
||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||
- name: Compute version-specific tags
|
||
id: tags
|
||
run: |
|
||
VERSION="${{ env.RELEASE_TAG }}"
|
||
{ echo "tags<<EOF"
|
||
echo "${IMAGE}:${VERSION}"
|
||
if [ "${{ env.PROMOTE_LATEST }}" = "true" ]; then
|
||
echo "${IMAGE}:latest"
|
||
fi
|
||
echo "EOF"
|
||
} >> "$GITHUB_OUTPUT"
|
||
- name: Build and push variant (with retry)
|
||
shell: bash
|
||
env:
|
||
TAGS: ${{ steps.tags.outputs.tags }}
|
||
BASE_IMAGE_FULL: ${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
|
||
MEMPALACE_TOOLKIT_REF: ${{ needs.resolve-versions.outputs.mempalace_toolkit_ref }}
|
||
run: |
|
||
set -euo pipefail
|
||
BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
||
TAG_FLAGS=()
|
||
while IFS= read -r t; do [[ -n "$t" ]] && TAG_FLAGS+=( -t "$t" ); done <<< "${TAGS}"
|
||
# 3-attempt retry around `docker buildx build --push` (see build-base
|
||
# step for full rationale). Variant: base (opencode only).
|
||
for attempt in 1 2 3; do
|
||
echo "==> Build+push attempt ${attempt}/3"
|
||
if docker buildx build \
|
||
--platform linux/amd64,linux/arm64 \
|
||
--file Dockerfile.variant \
|
||
--push \
|
||
--build-arg "BASE_IMAGE=${BASE_IMAGE_FULL}" \
|
||
--build-arg "INSTALL_OPENCODE=true" \
|
||
--build-arg "INSTALL_OMOS=false" \
|
||
--build-arg "MEMPALACE_TOOLKIT_REF=${MEMPALACE_TOOLKIT_REF}" \
|
||
--build-arg "RELEASE_TAG=${RELEASE_TAG}" \
|
||
--build-arg "BUILD_DATE=${BUILD_DATE}" \
|
||
--build-arg "SOURCE_REVISION=${GITHUB_SHA:-}" \
|
||
"${TAG_FLAGS[@]}" \
|
||
.; then
|
||
echo "==> Attempt ${attempt} succeeded"
|
||
exit 0
|
||
fi
|
||
if [[ "${attempt}" -lt 3 ]]; then
|
||
backoff=$(( attempt * 15 ))
|
||
echo "==> Attempt ${attempt} failed, sleeping ${backoff}s before retry"
|
||
sleep "${backoff}"
|
||
fi
|
||
done
|
||
echo "==> All 3 build+push attempts failed"
|
||
exit 1
|
||
|
||
build-variant-omos:
|
||
needs: [base-decide, smoke-omos, resolve-versions]
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- run: echo 'precedence ::ffff:0:0/96 100' >> /etc/gai.conf
|
||
- run: |
|
||
rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
|
||
/usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
|
||
/usr/local/lib/android /usr/local/share/powershell \
|
||
/usr/local/share/chromium /usr/local/share/boost \
|
||
/usr/lib/jvm 2>/dev/null || true
|
||
docker system prune -af --volumes || true
|
||
docker builder prune -af || true
|
||
- uses: docker/setup-qemu-action@v3
|
||
with: {platforms: arm64}
|
||
- uses: docker/setup-buildx-action@v4
|
||
with: {driver-opts: network=host}
|
||
- uses: docker/login-action@v3
|
||
with:
|
||
username: ${{ vars.DOCKERHUB_USERNAME }}
|
||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||
- name: Compute version-specific tags
|
||
id: tags
|
||
run: |
|
||
VERSION="${{ env.RELEASE_TAG }}"
|
||
{ echo "tags<<EOF"
|
||
echo "${IMAGE}:${VERSION}-omos"
|
||
if [ "${{ env.PROMOTE_LATEST }}" = "true" ]; then
|
||
echo "${IMAGE}:latest-omos"
|
||
fi
|
||
echo "EOF"
|
||
} >> "$GITHUB_OUTPUT"
|
||
- name: Build and push variant (with retry)
|
||
shell: bash
|
||
env:
|
||
TAGS: ${{ steps.tags.outputs.tags }}
|
||
BASE_IMAGE_FULL: ${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
|
||
OMOS_VERSION: ${{ needs.resolve-versions.outputs.omos_version }}
|
||
MEMPALACE_TOOLKIT_REF: ${{ needs.resolve-versions.outputs.mempalace_toolkit_ref }}
|
||
run: |
|
||
set -euo pipefail
|
||
BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
||
TAG_FLAGS=()
|
||
while IFS= read -r t; do [[ -n "$t" ]] && TAG_FLAGS+=( -t "$t" ); done <<< "${TAGS}"
|
||
# 3-attempt retry (see build-base step for rationale). Variant: omos.
|
||
for attempt in 1 2 3; do
|
||
echo "==> Build+push attempt ${attempt}/3"
|
||
if docker buildx build \
|
||
--platform linux/amd64,linux/arm64 \
|
||
--file Dockerfile.variant \
|
||
--push \
|
||
--build-arg "BASE_IMAGE=${BASE_IMAGE_FULL}" \
|
||
--build-arg "INSTALL_OPENCODE=true" \
|
||
--build-arg "INSTALL_OMOS=true" \
|
||
--build-arg "OMOS_VERSION=${OMOS_VERSION}" \
|
||
--build-arg "MEMPALACE_TOOLKIT_REF=${MEMPALACE_TOOLKIT_REF}" \
|
||
--build-arg "RELEASE_TAG=${RELEASE_TAG}" \
|
||
--build-arg "BUILD_DATE=${BUILD_DATE}" \
|
||
--build-arg "SOURCE_REVISION=${GITHUB_SHA:-}" \
|
||
"${TAG_FLAGS[@]}" \
|
||
.; then
|
||
echo "==> Attempt ${attempt} succeeded"
|
||
exit 0
|
||
fi
|
||
if [[ "${attempt}" -lt 3 ]]; then
|
||
backoff=$(( attempt * 15 ))
|
||
echo "==> Attempt ${attempt} failed, sleeping ${backoff}s before retry"
|
||
sleep "${backoff}"
|
||
fi
|
||
done
|
||
echo "==> All 3 build+push attempts failed"
|
||
exit 1
|
||
|
||
# ── Phase 5: promote base-<hash> → base-latest (manifest copy only) ─
|
||
promote-base-latest:
|
||
needs:
|
||
- base-decide
|
||
- build-variant-base
|
||
- build-variant-omos
|
||
# Run on every tag release (and promote_latest=true dispatch). The gate
|
||
# deliberately does NOT key off need_build anymore: the no-op optimization
|
||
# for genuine cache-hit releases moved INTO the step as a crane digest
|
||
# compare (see below). Keying the gate on need_build was wrong because a
|
||
# prior dry-run dispatch (promote_latest=false) can pre-build+push
|
||
# base-<hash>, making need_build=false on the subsequent tag run even
|
||
# though base-latest is still stale — the old gate then skipped promotion
|
||
# and left base-latest pointing at the PREVIOUS base. (Ported from
|
||
# pi-devbox b7197e8, which hit exactly this on its v1.2.3 dry-run-first
|
||
# release, 2026-06-27.)
|
||
#
|
||
# `always()` wrapper + explicit base-variant success check protects
|
||
# against the gitea-Actions default of "skipped need => skip dependent":
|
||
# a partial-publish run (e.g., omos smoke fails) shouldn't
|
||
# prevent the base-latest alias from advancing on a real base rebuild.
|
||
if: |
|
||
always() &&
|
||
needs.build-variant-base.result == 'success' &&
|
||
(inputs.promote_latest == 'true' || github.ref_type == 'tag')
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
# Direct pinned install instead of imjasonh/setup-crane@v0.4. The
|
||
# action's bootstrap script calls api.github.com/.../releases/latest
|
||
# to discover the crane version, which periodically rate-limits and
|
||
# produces tag=null → download from .../download/null/... → 404 →
|
||
# 'gzip: unexpected end of file' → exit 2. Pinning removes the
|
||
# runtime dependency on GitHub API entirely. Bump CRANE_VERSION
|
||
# deliberately when you want updates.
|
||
- name: Install crane (pinned)
|
||
env:
|
||
CRANE_VERSION: v0.21.6
|
||
run: |
|
||
set -eux
|
||
curl -fsSL "https://github.com/google/go-containerregistry/releases/download/${CRANE_VERSION}/go-containerregistry_Linux_x86_64.tar.gz" \
|
||
| tar -xz -C /usr/local/bin crane
|
||
crane version
|
||
- name: Login (crane)
|
||
run: |
|
||
crane auth login docker.io \
|
||
-u ${{ vars.DOCKERHUB_USERNAME }} \
|
||
-p "${{ secrets.DOCKERHUB_TOKEN }}"
|
||
- name: Re-tag base-<hash> as base-latest (only if stale)
|
||
env:
|
||
BASE_HASH_REF: ${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
|
||
BASE_LATEST_REF: ${{ env.IMAGE }}:base-latest
|
||
run: |
|
||
set -euo pipefail
|
||
# Correctness invariant: after a release, base-latest must resolve to
|
||
# the SAME digest as the base-<hash> the just-built variants were
|
||
# FROM. Compare digests rather than trusting need_build — a prior
|
||
# dry-run dispatch can pre-build base-<hash>, so need_build=false on
|
||
# the tag run does NOT imply base-latest is already current. When the
|
||
# digests already match (genuine cache-hit release) this is a no-op,
|
||
# so we skip the crane copy entirely — preserving the original
|
||
# "don't do a tautological retag" intent and avoiding any cosmetic
|
||
# transient-failure exposure on releases that change nothing.
|
||
want=$(crane digest "${BASE_HASH_REF}")
|
||
have=$(crane digest "${BASE_LATEST_REF}" 2>/dev/null || echo "")
|
||
echo "base-<hash> digest: ${want}"
|
||
echo "base-latest digest: ${have:-<absent>}"
|
||
if [ "${want}" = "${have}" ]; then
|
||
echo "base-latest already current; nothing to promote."
|
||
else
|
||
echo "Promoting base-latest -> ${BASE_HASH_REF}"
|
||
crane copy "${BASE_HASH_REF}" "${BASE_LATEST_REF}"
|
||
fi
|
||
|
||
# ── Phase 6: update Hub description (only on real release runs) ────
|
||
update-description:
|
||
needs:
|
||
- build-variant-base
|
||
- build-variant-omos
|
||
# Run when at least the base variant published — don't let a single
|
||
# variant failure (e.g., omos smoke threshold) prevent Hub
|
||
# description refresh for the other variants that did publish.
|
||
# Without this `always()` wrapper, gitea Actions' default behavior
|
||
# of "skipped need => skip dependent" cascades from any failed/
|
||
# skipped build-variant-* into update-description, and the Hub
|
||
# description goes stale on partial-publish releases.
|
||
if: |
|
||
always() &&
|
||
needs.build-variant-base.result == 'success' &&
|
||
(github.ref_type == 'tag' || inputs.promote_latest == 'true')
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- name: Update Docker Hub description
|
||
run: |
|
||
# Substitute {{OPENCODE_VERSION}} placeholders in DOCKER_HUB.md so
|
||
# the Hub page always shows which opencode version is baked into
|
||
# :latest. The placeholder lives in DOCKER_HUB.md (committed); CI
|
||
# fills it at publish time from the pinned ARG in
|
||
# Dockerfile.variant — the same value that was baked into the
|
||
# image — so the page and the image never drift. (Mirrors the
|
||
# {{PI_VERSION}} pattern in pi-devbox's docker-publish.yml.)
|
||
OPENCODE_VERSION=$(sed -n 's/^ARG OPENCODE_VERSION=//p' Dockerfile.variant | head -1)
|
||
if [ -z "${OPENCODE_VERSION}" ]; then
|
||
echo "::error::Could not extract OPENCODE_VERSION from Dockerfile.variant"
|
||
exit 1
|
||
fi
|
||
cp DOCKER_HUB.md /tmp/hub-full.md
|
||
sed -i "s/{{OPENCODE_VERSION}}/${OPENCODE_VERSION}/g" /tmp/hub-full.md
|
||
if grep -q '{{OPENCODE_VERSION}}' /tmp/hub-full.md; then
|
||
echo "::error::DOCKER_HUB.md still contains unsubstituted {{OPENCODE_VERSION}} markers"
|
||
exit 1
|
||
fi
|
||
TOKEN=$(curl -s -X POST https://hub.docker.com/v2/auth/token \
|
||
-H "Content-Type: application/json" \
|
||
-d '{"identifier":"${{ vars.DOCKERHUB_USERNAME }}","secret":"${{ secrets.DOCKERHUB_TOKEN }}"}' \
|
||
| jq -r .access_token)
|
||
if [ "$TOKEN" = "null" ] || [ -z "$TOKEN" ]; then
|
||
echo "::error::Failed to authenticate with Docker Hub API"
|
||
exit 1
|
||
fi
|
||
HTTP_CODE=$(jq -n \
|
||
--rawfile full /tmp/hub-full.md \
|
||
--arg short "Portable AI dev environment for opencode. Debian-based with git, Node.js, AWS CLI, and SSH support." \
|
||
'{"full_description": $full, "description": $short}' | \
|
||
curl -s -o /tmp/hub-response.txt -w "%{http_code}" -X PATCH \
|
||
"https://hub.docker.com/v2/repositories/${{ vars.DOCKERHUB_USERNAME }}/opencode-devbox/" \
|
||
-H "Authorization: Bearer $TOKEN" \
|
||
-H "Content-Type: application/json" \
|
||
-d @-)
|
||
if [ "$HTTP_CODE" != "200" ]; then
|
||
echo "Response body:"
|
||
cat /tmp/hub-response.txt
|
||
echo "::error::Docker Hub description update failed with HTTP $HTTP_CODE"
|
||
exit 1
|
||
fi
|