publish-examples.yml

name: Publish kernels and runtime bases to GHCR

on:
  workflow_dispatch:
  push:
    branches: [main]
    tags: ['v*']
    paths:
      - 'examples/**'
      - 'host/**'
      - 'runtimes/**'
      - '.github/workflows/publish-examples.yml'

# Only one publish run per ref at a time. cancel-in-progress ensures a
# newer commit supersedes an older publish cleanly; GHCR tags are
# idempotent so the latest push always wins.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  REGISTRY: ghcr.io
  IMAGE_BASE: ghcr.io/${{ github.repository }}

jobs:
  # Publish base runtime images (interpreted languages)
  publish-bases:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        runtime: [python, nodejs, powershell, shell]
    steps:
      - uses: actions/checkout@v4

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push base image
        run: |
          IMAGE=${{ env.IMAGE_BASE }}/${{ matrix.runtime }}-base:latest
          docker build --platform linux/amd64 \
            -f runtimes/${{ matrix.runtime }}.Dockerfile \
            -t $IMAGE runtimes/
          docker push $IMAGE
          # Also tag with the release version when triggered by a git tag
          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            VERSION_TAG=${{ env.IMAGE_BASE }}/${{ matrix.runtime }}-base:${{ github.ref_name }}
            docker tag $IMAGE $VERSION_TAG
            docker push $VERSION_TAG
          fi

  # Build and publish kernels for each example
  publish-kernels:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        example:
          - name: helloworld-c
            kernel: helloworld-hyperlight_hyperlight-x86_64
          - name: hostfs-posix-c
            kernel: hostfs-posix-c-hyperlight_hyperlight-x86_64
          - name: hostfs-posix-py
            kernel: hostfs-posix-py-hyperlight_hyperlight-x86_64
          - name: python-agent
            kernel: python-agent-hyperlight_hyperlight-x86_64
          - name: rust
            kernel: rust-hyperlight_hyperlight-x86_64
          - name: go
            kernel: go-hyperlight_hyperlight-x86_64
          - name: shell
            kernel: shell-hyperlight_hyperlight-x86_64
          - name: python
            kernel: python-hyperlight_hyperlight-x86_64
          - name: nodejs
            kernel: nodejs-hyperlight_hyperlight-x86_64
          - name: dotnet
            kernel: dotnet-hyperlight_hyperlight-x86_64
          - name: dotnet-nativeaot
            kernel: dotnet-nativeaot-hyperlight_hyperlight-x86_64
          - name: powershell
            kernel: powershell-hyperlight_hyperlight-x86_64
          - name: python-agent-driver
            kernel: python-agent-driver-hyperlight_hyperlight-x86_64
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.25.1'
          cache: false

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: host -> target

      - name: Cache kraft-hyperlight
        id: kraft-cache
        uses: actions/cache@v4
        with:
          path: /usr/local/bin/kraft-hyperlight
          key: kraft-hyperlight-linux-${{ hashFiles('.github/workflows/publish-examples.yml') }}

      - name: Install tools
        run: |
          # Install kraft-hyperlight (if not cached)
          if [ ! -f /usr/local/bin/kraft-hyperlight ]; then
            git clone --branch hyperlight-platform --depth 1 https://github.com/danbugs/kraftkit.git /tmp/kraftkit
            cd /tmp/kraftkit && go build -o /usr/local/bin/kraft-hyperlight ./cmd/kraft
          fi
          # Install hyperlight-unikraft
          cd ${{ github.workspace }}/host && cargo build --release
          sudo cp target/release/hyperlight-unikraft /usr/local/bin/

      - name: Build kernel
        working-directory: examples/${{ matrix.example.name }}
        run: |
          kraft-hyperlight --no-prompt build --plat hyperlight --arch x86_64 || true
          # Fallback: manual source clone + build
          if [ ! -f ".unikraft/build/${{ matrix.example.kernel }}" ]; then
            UK_SOURCE=$(awk '/^unikraft:/{f=1} f && /source:/{print $2; exit}' kraft.yaml)
            UK_BRANCH=$(awk '/^unikraft:/{f=1} f && /version:/{print $2; exit}' kraft.yaml)
            ELF_SOURCE=$(awk '/app-elfloader:/{f=1} f && /source:/{print $2; exit}' kraft.yaml)
            ELF_BRANCH=$(awk '/app-elfloader:/{f=1} f && /version:/{print $2; exit}' kraft.yaml)
            mkdir -p .unikraft/apps .unikraft/libs
            rm -rf .unikraft/unikraft .unikraft/apps/elfloader
            git clone --branch "$UK_BRANCH" --depth 1 "$UK_SOURCE" .unikraft/unikraft
            git clone --branch "$ELF_BRANCH" --depth 1 "$ELF_SOURCE" .unikraft/apps/elfloader
            git clone --branch staging --depth 1 https://github.com/unikraft/lib-libelf.git .unikraft/libs/libelf
            rm -rf .unikraft/build
            kraft-hyperlight --no-prompt build --plat hyperlight --arch x86_64
          fi

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish kernel image
        working-directory: examples
        run: |
          IMAGE=${{ env.IMAGE_BASE }}/${{ matrix.example.name }}-kernel:latest
          # Package just the kernel binary in a scratch image
          cat > /tmp/Dockerfile.kernel << DEOF
          FROM scratch
          COPY ${{ matrix.example.name }}/.unikraft/build/${{ matrix.example.kernel }} /kernel
          DEOF
          docker build -f /tmp/Dockerfile.kernel -t $IMAGE .
          docker push $IMAGE
          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            VERSION_TAG=${{ env.IMAGE_BASE }}/${{ matrix.example.name }}-kernel:${{ github.ref_name }}
            docker tag $IMAGE $VERSION_TAG
            docker push $VERSION_TAG
          fi

  # Publish a urunc-ready OCI image for helloworld-c (kernel + initrd + annotations)
  publish-urunc-hello:
    needs: [publish-kernels]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.25.1'
          cache: false

      - name: Cache kraft-hyperlight
        id: kraft-cache
        uses: actions/cache@v4
        with:
          path: /usr/local/bin/kraft-hyperlight
          key: kraft-hyperlight-linux-${{ hashFiles('.github/workflows/publish-examples.yml') }}

      - name: Install kraft-hyperlight
        if: steps.kraft-cache.outputs.cache-hit != 'true'
        run: |
          git clone --branch hyperlight-platform --depth 1 https://github.com/danbugs/kraftkit.git /tmp/kraftkit
          cd /tmp/kraftkit && go build -o /usr/local/bin/kraft-hyperlight ./cmd/kraft

      - name: Build kernel
        working-directory: examples/helloworld-c
        run: |
          kraft-hyperlight --no-prompt build --plat hyperlight --arch x86_64 || true
          if [ ! -f ".unikraft/build/helloworld-hyperlight_hyperlight-x86_64" ]; then
            UK_SOURCE=$(awk '/^unikraft:/{f=1} f && /source:/{print $2; exit}' kraft.yaml)
            UK_BRANCH=$(awk '/^unikraft:/{f=1} f && /version:/{print $2; exit}' kraft.yaml)
            ELF_SOURCE=$(awk '/app-elfloader:/{f=1} f && /source:/{print $2; exit}' kraft.yaml)
            ELF_BRANCH=$(awk '/app-elfloader:/{f=1} f && /version:/{print $2; exit}' kraft.yaml)
            mkdir -p .unikraft/apps .unikraft/libs
            rm -rf .unikraft/unikraft .unikraft/apps/elfloader
            git clone --branch "$UK_BRANCH" --depth 1 "$UK_SOURCE" .unikraft/unikraft
            git clone --branch "$ELF_BRANCH" --depth 1 "$ELF_SOURCE" .unikraft/apps/elfloader
            git clone --branch staging --depth 1 https://github.com/unikraft/lib-libelf.git .unikraft/libs/libelf
            rm -rf .unikraft/build
            kraft-hyperlight --no-prompt build --plat hyperlight --arch x86_64
          fi

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push urunc image
        working-directory: examples/helloworld-c
        run: |
          IMAGE=${{ env.IMAGE_BASE }}/hello-hyperlight-unikraft:latest
          docker build --platform linux/amd64 -f urunc.Dockerfile -t $IMAGE .
          docker push $IMAGE
          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            VERSION_TAG=${{ env.IMAGE_BASE }}/hello-hyperlight-unikraft:${{ github.ref_name }}
            docker tag $IMAGE $VERSION_TAG
            docker push $VERSION_TAG
          fi

  # Publish a runnable pyhl container image (pyhl + kernel + initrd).
  # Designed for the hyperlight-on-kubernetes device plugin — the pod
  # gets /dev/kvm and pyhl handles VM lifecycle internally.
  publish-pyhl:
    needs: [publish-pyhl-initrd, publish-kernels]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push pyhl image
        run: |
          IMAGE=${{ env.IMAGE_BASE }}/pyhl:latest
          docker build --platform linux/amd64 \
            -f host/pyhl.Dockerfile -t $IMAGE .
          docker push $IMAGE
          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            VERSION_TAG=${{ env.IMAGE_BASE }}/pyhl:${{ github.ref_name }}
            docker tag $IMAGE $VERSION_TAG
            docker push $VERSION_TAG
          fi

  # Publish the python-agent-driver rootfs CPIO as its own image so
  # `pyhl setup` can pull the initrd (and kernel, above) from GHCR
  # without having to build the driver image locally.
  publish-pyhl-initrd:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # python-agent-driver's Dockerfile builds hl_pydriver against
      # local-python-base-dev so the glibc/libpython ABIs match the
      # runtime image. Materialise both locally before `just rootfs`.
      - name: Build local-python-base and local-python-base-dev
        env:
          DOCKER_BUILDKIT: '0'
        run: |
          # Full image with dev headers (compiles hl_pydriver.c)
          docker build --target base -t local-python-base-dev:latest \
              -f runtimes/python.Dockerfile runtimes/
          # Slim runtime image (ends up inside the guest rootfs)
          docker build -t local-python-base:latest \
              -f runtimes/python.Dockerfile runtimes/

      - name: Install just
        uses: extractions/setup-just@v2

      - name: Build python-agent-driver rootfs (CPIO)
        working-directory: examples/python-agent-driver
        env:
          DOCKER_BUILDKIT: '0'
        run: |
          just rootfs

      - name: Publish initrd image
        working-directory: examples/python-agent-driver
        run: |
          IMAGE=${{ env.IMAGE_BASE }}/python-agent-driver-initrd:latest
          cat > /tmp/Dockerfile.initrd << DEOF
          FROM scratch
          COPY python-agent-driver-initrd.cpio /initrd.cpio
          DEOF
          docker build -f /tmp/Dockerfile.initrd -t $IMAGE .
          docker push $IMAGE
          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            VERSION_TAG=${{ env.IMAGE_BASE }}/python-agent-driver-initrd:${{ github.ref_name }}
            docker tag $IMAGE $VERSION_TAG
            docker push $VERSION_TAG
          fi