Skip to content

Commit 08ed462

Browse files
ananosananos
committed
ci: Add container image build workflow
Signed-off-by: Anastassios Nanos <ananos@nubificus.co.uk>
1 parent 500d3d0 commit 08ed462

2 files changed

Lines changed: 190 additions & 1 deletion

File tree

‎.github/workflows/build-containers.yml‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
name: Build agent containers
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
agent:
7+
default: 'node'
8+
required: true
9+
registry:
10+
default: 'harbor.nbfc.io'
11+
required: false
12+
13+
concurrency:
14+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
15+
cancel-in-progress: true
16+
17+
env:
18+
REGISTRY: ${{ github.event.inputs.registry || 'harbor.nbfc.io' }}
19+
# NOTE: We assume that a project named after the repo owner exists in the
20+
# registry. The image will be uploaded as <repo_name> under the <repo_owner>
21+
# project.
22+
REGISTRY_IMAGE: ${{ github.event.inputs.registry || 'harbor.nbfc.io' }}/mlsysops/${{ inputs.agent }}-agent
23+
RUNNER_ARCH_MAP: '[{"amd64":"x86_64", "arm64":"aarch64", "arm":"armv7l"}]'
24+
25+
jobs:
26+
build:
27+
name: Build Docker Image
28+
runs-on: ${{ format('{0}-{1}', 'base-dind-2204', matrix.arch) }}
29+
strategy:
30+
matrix:
31+
arch: ["arm64", "amd64"]
32+
outputs:
33+
digest-amd64: ${{ steps.set-outputs.outputs.digest-amd64 }}
34+
digest-arm64: ${{ steps.set-outputs.outputs.digest-arm64 }}
35+
36+
steps:
37+
- name: Checkout repo
38+
uses: actions/checkout@v4
39+
40+
- name: Login to registry ${{ env.REGISTRY }}
41+
uses: docker/login-action@v3
42+
with:
43+
registry: ${{ env.REGISTRY }}
44+
username: ${{ secrets.HARBOR_USER }}
45+
password: ${{ secrets.HARBOR_SECRET }}
46+
47+
- name: Set up Docker Buildx
48+
uses: docker/setup-buildx-action@v3
49+
50+
- name: Extract Docker metadata
51+
id: meta
52+
uses: docker/metadata-action@v5
53+
with:
54+
images: ${{ env.REGISTRY_IMAGE }}
55+
tags: |
56+
type=sha,prefix=${{ matrix.arch }}-
57+
type=ref,event=branch,prefix=${{ matrix.arch }}-
58+
59+
- name: Build and push ${{ matrix.arch }} image
60+
id: build-and-push
61+
uses: docker/build-push-action@v6
62+
with:
63+
context: ./agents/${{ inputs.agent }}
64+
tags: ${{ steps.meta.outputs.tags }}
65+
labels: ${{ steps.meta.outputs.labels }}
66+
platforms: linux/${{ matrix.arch }}
67+
push: true
68+
file: ./agents/${{ inputs.agent }}/Dockerfile
69+
provenance: false
70+
build-args: |
71+
ARCHTAG=${{ fromJson(env.RUNNER_ARCH_MAP)[0][matrix.arch] }}
72+
BRANCH=${{ github.event.ref_name || github.ref_name }}
73+
74+
- name: Set ${{ matrix.arch }} digest output
75+
id: set-outputs
76+
run: |
77+
# Workaround for https://github.com/actions/runner/issues/2499
78+
echo "digest-${{ matrix.arch }}=${{ steps.build-and-push.outputs.digest }}" \
79+
>> "$GITHUB_OUTPUT"
80+
shell: bash
81+
82+
create-manifest:
83+
name: Create Merged Docker Image Manifest
84+
needs: [build]
85+
runs-on: 'base-dind-2204-amd64'
86+
outputs:
87+
digest-merged: ${{ steps.inspect.outputs.digest-merged }}
88+
89+
steps:
90+
- name: Checkout repo
91+
uses: actions/checkout@v4
92+
93+
- name: Login to registry ${{ inputs.REGISTRY }}
94+
uses: docker/login-action@v3
95+
with:
96+
registry: ${{ env.REGISTRY }}
97+
username: ${{ secrets.HARBOR_USER }}
98+
password: ${{ secrets.HARBOR_SECRET }}
99+
100+
- name: Set up Docker Buildx
101+
uses: docker/setup-buildx-action@v3
102+
103+
- name: Extract Docker metadata
104+
id: meta
105+
uses: docker/metadata-action@v5
106+
with:
107+
images: ${{ env.REGISTRY_IMAGE }}
108+
tags: |
109+
type=sha
110+
type=ref,event=branch
111+
type=raw,value=latest
112+
113+
- name: Create and push manifest
114+
run: |
115+
docker buildx imagetools create \
116+
$(jq -cr '.tags | map("-t " + .) | join(" ")' <<< \
117+
"$DOCKER_METADATA_OUTPUT_JSON") \
118+
${{ env.REGISTRY_IMAGE }}@${{ needs.build.outputs.digest-amd64 }} \
119+
${{ env.REGISTRY_IMAGE }}@${{ needs.build.outputs.digest-arm64 }}
120+
shell: bash
121+
122+
- name: Inspect merged image
123+
id: inspect
124+
run: |
125+
docker buildx imagetools inspect \
126+
${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}
127+
digest=$(docker buildx imagetools inspect \
128+
${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }} \
129+
--format '{{json .Manifest}}' | jq -r '.digest')
130+
if [[ -z "${digest}" ]]; then
131+
echo "Could not get merged image digest"
132+
exit 1
133+
fi
134+
echo "digest-merged=${digest}" >> "$GITHUB_OUTPUT"
135+
shell: bash
136+
137+
sign:
138+
name: Sign Docker Images
139+
needs: [build, create-manifest]
140+
runs-on: 'base-dind-2204-amd64'
141+
permissions:
142+
contents: read
143+
id-token: write
144+
145+
steps:
146+
- name: Install Cosign
147+
uses: sigstore/cosign-installer@v3
148+
149+
- name: Verify Cosign installation
150+
run: cosign version
151+
152+
- name: Login to registry ${{ env.REGISTRY }}
153+
uses: docker/login-action@v3
154+
with:
155+
registry: ${{ env.REGISTRY }}
156+
username: ${{ secrets.HARBOR_USER }}
157+
password: ${{ secrets.HARBOR_SECRET }}
158+
159+
- name: Sign published Docker images
160+
env:
161+
DIGESTS: >-
162+
${{ needs.create-manifest.outputs.digest-merged }}
163+
${{ needs.build.outputs.digest-amd64 }}
164+
${{ needs.build.outputs.digest-arm64 }}
165+
run: |
166+
for digest in ${DIGESTS}; do
167+
cosign sign --yes ${{ env.REGISTRY_IMAGE }}@${digest} \
168+
-a "repo=${{ github.repository }}" \
169+
-a "workflow=${{ github.workflow }}" \
170+
-a "ref=${{ github.sha }}" \
171+
-a "author=Nubificus LTD"
172+
done
173+
shell: bash

‎.github/workflows/ci.yml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,29 @@ jobs:
2626

2727
build-agent-pkg:
2828
#needs: [validate-files-and-commits, lint]
29-
name: Build
29+
name: Build python pkg
3030
if: |
3131
contains(github.event.pull_request.labels.*.name, 'ok-to-test') &&
3232
!contains(github.event.pull_request.labels.*.name, 'skip-build')
3333
uses: ./.github/workflows/build-mlsysops-pkg.yml
3434
secrets: inherit
3535

36+
build-agent-containers:
37+
needs: [build-agent-pkg]
38+
name: Build containers
39+
if: |
40+
contains(github.event.pull_request.labels.*.name, 'ok-to-test') &&
41+
!contains(github.event.pull_request.labels.*.name, 'skip-build')
42+
strategy:
43+
matrix:
44+
agent: ["node", "cluster", "continuum"]
45+
uses: ./.github/workflows/build-containers.yml
46+
secrets: inherit
47+
with:
48+
agent: ${{ matrix.agent }}
49+
50+
51+
3652
# lint:
3753
# name: Lint code
3854
# if: |

0 commit comments

Comments
 (0)