feat(blockchain): start aggregation early when 2/3 of subnet signatur… #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Docker Image | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| inputs: | |
| tags: | |
| description: "Docker image tags, comma-separated (e.g., latest,v0.1.0)" | |
| required: false | |
| default: "latest" | |
| permissions: | |
| contents: read | |
| packages: write | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: false | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| # On push to main, inputs.tags is empty, so fall back to "unstable" so it | |
| # tracks main. Manual dispatch still honors custom tags. | |
| TAGS_INPUT: ${{ inputs.tags || 'unstable' }} | |
| jobs: | |
| build-image: | |
| name: Build Docker image (${{ matrix.arch.name }}, ${{ matrix.variant.name }}) | |
| strategy: | |
| matrix: | |
| arch: | |
| - runner: ubuntu-latest | |
| name: amd64 | |
| - runner: ubuntu-22.04-arm | |
| name: arm64 | |
| # Each tag is published twice: once as the regular image and once as a | |
| # Shadow-simulator-compatible image (tag suffixed "-shadow"). The shadow | |
| # build args mirror the `shadow-docker-build` Makefile target. LOCKED= | |
| # builds the shadow variant unlocked (the quinn-udp [patch] is absent | |
| # from Cargo.lock; see Dockerfile), so -shadow images are not | |
| # reproducible and should not be treated as equivalent-security | |
| # artifacts to the regular tags. | |
| variant: | |
| - name: default | |
| suffix: "" | |
| build_args: "" | |
| - name: shadow | |
| suffix: "-shadow" | |
| build_args: | | |
| SHADOW=1 | |
| FEATURES=shadow-integration | |
| NO_DEFAULT_FEATURES=--no-default-features | |
| LOCKED= | |
| runs-on: ${{ matrix.arch.runner }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Prepare tags | |
| id: prep | |
| env: | |
| SUFFIX: ${{ matrix.variant.suffix }} | |
| ARCH: ${{ matrix.arch.name }} | |
| run: | | |
| TAGS="" | |
| IFS=',' read -ra TAG_ARRAY <<< "${TAGS_INPUT}" | |
| for t in "${TAG_ARRAY[@]}"; do | |
| TAGS="${TAGS}${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${t}${SUFFIX}-${ARCH}," | |
| done | |
| TAGS="${TAGS%,}" # Remove trailing comma | |
| echo "tags=${TAGS}" >> $GITHUB_OUTPUT | |
| - name: Build and push Docker image | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| build-args: | | |
| GIT_COMMIT=${{ github.sha }} | |
| GIT_BRANCH=${{ github.ref_name }} | |
| ${{ matrix.variant.build_args }} | |
| push: true | |
| tags: ${{ steps.prep.outputs.tags }} | |
| platforms: linux/${{ matrix.arch.name }} | |
| cache-from: type=gha,scope=${{ matrix.arch.name }}-${{ matrix.variant.name }} | |
| cache-to: type=gha,scope=${{ matrix.arch.name }}-${{ matrix.variant.name }},mode=max | |
| publish-manifest: | |
| name: Create and push multi-arch manifest | |
| runs-on: ubuntu-latest | |
| needs: build-image | |
| steps: | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Create multi-arch manifests | |
| env: | |
| SHORT_SHA: ${{ github.sha }} | |
| run: | | |
| IFS=',' read -ra TAG_ARRAY <<< "${TAGS_INPUT}" | |
| FIRST_TAG="${TAG_ARRAY[0]}" | |
| SHORT="${SHORT_SHA::7}" | |
| # Publish each tag twice: the regular image and its "-shadow" twin. | |
| # These suffixes must stay in sync with the `variant` matrix suffixes | |
| # in the build-image job above: a new variant must be added in both. | |
| for suffix in "" "-shadow"; do | |
| # First tag also gets an immutable sha-<sha> tag. | |
| docker buildx imagetools create \ | |
| -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${FIRST_TAG}${suffix} \ | |
| -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${SHORT}${suffix} \ | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${FIRST_TAG}${suffix}-amd64 \ | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${FIRST_TAG}${suffix}-arm64 | |
| # Remaining tags. | |
| for t in "${TAG_ARRAY[@]:1}"; do | |
| docker buildx imagetools create \ | |
| -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${t}${suffix} \ | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${t}${suffix}-amd64 \ | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${t}${suffix}-arm64 | |
| done | |
| done |