Added initial singularity / apptainer container image recipe, as well as a CI image building workflow

Author: jmfernandez

.github/workflows/container.yml

@@ -0,0 +1,106 @@
+name: Singularity Build (docker)
+on: 
+  workflow_dispatch:
+  push:
+    tags:
+      - 'v*'
+
+  # # Do the builds on all pull requests (to test them)
+  # pull_request:
+
+jobs:
+  #changes:
+  #  name: "Changed Singularity Recipes"
+  #  runs-on: ubuntu-latest
+  #  outputs:
+  #    changed_file: ${{ steps.files.outputs.added_modified }}
+  #  steps:
+  #    - id: files
+  #      uses: jitterbit/get-changed-files@d06c756e3609dd3dd5d302dde8d1339af3f790f2
+  #      with:
+  #        format: 'json'
+  gather-metadata:
+    runs-on: ubuntu-latest
+    outputs:
+      tags: ${{ steps.meta.outputs.tags }}
+      labels: ${{ steps.meta.outputs.labels }}
+    # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+      # 
+    steps:
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v6.0.0
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+  build-test-containers:
+    needs:
+      - gather-metadata
+    #  - changes
+    runs-on: ubuntu-latest
+    strategy:
+      # Keep going on other deployments if anything bloops
+      fail-fast: false
+      matrix:
+        # changed_file: ${{ fromJson(needs.changes.outputs.changed_file) }}
+        changed_file: [ 'installation/Singularity.def' ]
+        singularity_version:
+          - '4.3.1'
+
+    container:
+      image: quay.io/singularity/singularity:v${{ matrix.singularity_version }}
+      options: --privileged
+
+    name: Check ${{ matrix.changed_file }}
+    steps:
+
+      - name: Check out code for the container builds
+        uses: actions/checkout@v6
+
+      - name: Continue if Singularity Recipe
+        run: |
+          # Continue if we have a changed Singularity recipe
+          case "${{ matrix.changed_file }}" in
+            */Singularity*def)
+              echo "keepgoing=true" >> "$GITHUB_ENV"
+              ;;
+          esac
+
+      - name: Build Container
+        if: ${{ env.keepgoing == 'true' }}
+        env:
+          recipe: ${{ matrix.changed_file }}
+        run: |
+         ls 
+         if [ -f "$recipe" ]; then
+            sudo -E singularity build --build-arg treecript_checkout=${{ github.sha }} container.sif "$recipe"
+            tag="${recipe/Singularity\./}"
+            if [ "$tag" == "def" ]; then
+                tag=latest
+            fi
+            # Build the container and name by tag
+            echo "Tag is $tag."
+            echo "tag=$tag" >> "$GITHUB_ENV"
+         else
+           echo "$recipe is not found."
+           echo "Present working directory: $PWD"
+           ls
+         fi
+
+      - name: Login and Deploy Container
+        if: (github.event_name != 'pull_request')
+        env:
+          keepgoing: ${{ env.keepgoing }}
+        run: |         
+            if [[ "${keepgoing}" == "true" ]]; then
+                echo "${{ secrets.GITHUB_TOKEN }}" | singularity remote login -u "${{ secrets.GHCR_USERNAME }}" --password-stdin oras://ghcr.io
+                declare -a tags=( ${{ needs.gather-metadata.outputs.tags }} )
+                for tag in "${tags[@]}" ; do
+                  echo singularity push container.sif "oras://ghcr.io/${GITHUB_REPOSITORY}:${tag}"
+                done
+            fi

installation/Singularity.def

@@ -0,0 +1,59 @@
+Bootstrap: docker
+From: python:3.13-slim-trixie
+Stage: build
+
+%arguments
+# The default images of python are based on debian
+# These arguments help customizing what it is included in the generated image
+treecript_checkout=db83dbc42e988cb22bd3570e92348b70f64ed3e5
+
+%post
+set -ue
+
+cd /
+
+apt-get update
+apt-get install -y --no-install-recommends build-essential git
+
+# Install treecript, trusting the installers in the commit rather than the
+# one in the docker recipe
+git clone --filter=blob:none --no-checkout https://github.com/inab/treecript.git
+cd treecript
+git sparse-checkout init --cone
+PYVER=$(python -c 'import sys; import platform ; print("{}{}.{}".format("pypy" if platform.python_implementation() == "PyPy" else "", sys.version_info.major, sys.version_info.minor))')
+git sparse-checkout set installation/constraints-${PYVER}.txt
+git checkout "{{ treecript_checkout }}"
+grep -vF git+ installation/constraints-${PYVER}.txt > installation/constraints-${PYVER}.txt-relaxed
+pip install --no-cache-dir --upgrade pip wheel
+pip install --no-cache-dir "git+https://github.com/inab/treecript.git@{{ treecript_checkout }}" -c installation/constraints-"${PYVER}".txt-relaxed
+python -m compileall "$(python -c 'import sys; print(sys.prefix)')"
+
+Bootstrap: docker
+From: python:3.13-slim-trixie
+Stage: image
+
+%files from build
+/usr/local /usr
+
+%post
+set -ue
+
+# # Install docker-ce-cli 
+# # Cleanups
+# DPKG_ARCH=$(dpkg --print-architecture) && \
+# python -c 'import urllib.request ; urllib.request.urlretrieve("https://download.docker.com/linux/debian/gpg", "/etc/apt/keyrings/docker.asc")' && \
+# chmod a+r /etc/apt/keyrings/docker.asc && \
+# echo \
+# "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \
+# $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
+# tee /etc/apt/sources.list.d/docker.list > /dev/null && \
+# apt-get update && \
+# apt-get install -y --no-install-recommends docker-ce-cli
+
+%runscript
+cd /
+exec /bin/bash bash "$@"
+
+%startscript
+cd /
+exec /bin/bash bash "$@"