Merge pull request #216 from NERSC/ci-build-merge

swelborn · web-flow · commit 3ca8b4f4b721 · 2025-08-29T12:12:50.000-04:00
test merging manifests
diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml
@@ -1,5 +1,6 @@
 name: Docker Bake Build and Push
-
+# This is mostly taken from
+# here: https://docs.docker.com/build/ci/github-actions/multi-platform/#with-bake
 on:
   push:
     branches: [ main ]
@@ -11,7 +12,46 @@ env:
   REGISTRY: ghcr.io/nersc/interactem
 
 jobs:
-  bake-platform:
+  prepare:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      tag: ${{ steps.meta.outputs.tag }}
+      services: ${{ steps.services.outputs.services }}
+      all-images: ${{ steps.services.outputs.all-images }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Extract metadata
+        id: meta
+        run: |
+          TAG=$(git rev-parse --short=6 HEAD)
+          echo "tag=${TAG}" >> $GITHUB_OUTPUT
+          echo "Generated tag: ${TAG}"
+
+      - name: Define services
+        id: services
+        run: |
+          # Extract services from the prod group in docker-bake.hcl
+          SERVICES=$(docker buildx bake prod --print | jq -cr '[.group.prod.targets[]]')
+          echo "Services found: ${SERVICES}"
+          echo "services=${SERVICES}" >> $GITHUB_OUTPUT
+          
+          # Create combined list including base image for merge-manifests
+          ALL_IMAGES=$(echo ${SERVICES} | jq -c '. + ["interactem"]')
+          echo "All images (including base): ${ALL_IMAGES}"
+          echo "all-images=${ALL_IMAGES}" >> $GITHUB_OUTPUT
+        working-directory: ./docker
+
+  build-base:
+    needs: prepare
     strategy:
       matrix:
         include:
@@ -41,41 +81,46 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GHCR_PAT }}
 
-      - name: Extract metadata
-        id: meta
-        run: |
-          # Generate tag from git commit hash (short)
-          TAG=$(git rev-parse --short=6 HEAD)
-          echo "tag=${TAG}" >> $GITHUB_OUTPUT
-          echo "Generated tag: ${TAG}"
-
-      - name: Build ${{ matrix.platform }} base image
+      - name: Build and push base image by digest
+        id: bake
         uses: docker/bake-action@v6
         with:
           source: .
           files: ./docker/docker-bake.hcl
           targets: base
           set: |
             *.platform=${{ matrix.docker-platform }}
+            ${{ github.event_name != 'pull_request' && '*.output=type=image,push-by-digest=true,name-canonical=true,push=true' || '' }}
+            *.tags=${{ env.REGISTRY }}/interactem
         env:
-          TAG: ${{ steps.meta.outputs.tag }}
+          TAG: ${{ needs.prepare.outputs.tag }}
           CACHE_PLATFORM: ${{ matrix.platform }}
 
-      - name: Build ${{ matrix.platform }} images
-        uses: docker/bake-action@v6
+      - name: Export digest
+        if: github.event_name != 'pull_request'
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ fromJSON(steps.bake.outputs.metadata).base['containerimage.digest'] }}"
+          touch "/tmp/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        if: github.event_name != 'pull_request'
+        uses: actions/upload-artifact@v4
         with:
-          source: .
-          files: ./docker/docker-bake.hcl
-          targets: prod
-          set: |
-            *.platform=${{ matrix.docker-platform }}
-        env:
-          TAG: ${{ steps.meta.outputs.tag }}
-          CACHE_PLATFORM: ${{ matrix.platform }}
+          name: interactem-digest-${{ matrix.platform }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
 
-  bake-push:
-    needs: bake-platform
-    runs-on: ubuntu-24.04-arm
+  build-services:
+    needs: [prepare, build-base]
+    strategy:
+      matrix:
+        platform:
+          - { name: amd64, runner: ubuntu-24.04, docker: linux/amd64 }
+          - { name: arm64, runner: ubuntu-24.04-arm, docker: linux/arm64 }
+        service: ${{ fromJson(needs.prepare.outputs.services) }}
+    runs-on: ${{ matrix.platform.runner }}
     permissions:
       contents: read
       packages: write
@@ -95,22 +140,74 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GHCR_PAT }}
 
-      - name: Extract metadata
-        id: meta
-        run: |
-          # Generate tag from git commit hash (short)
-          TAG=$(git rev-parse --short=6 HEAD)
-          echo "tag=${TAG}" >> $GITHUB_OUTPUT
-          echo "Generated tag: ${TAG}"
-
-      - name: Build and push multiplatform images
+      - name: Build and push ${{ matrix.service }} by digest
+        id: bake
         uses: docker/bake-action@v6
         with:
           source: .
           files: ./docker/docker-bake.hcl
-          push: ${{ github.event_name != 'pull_request' }}
-          targets: prod
+          targets: ${{ matrix.service }}
           set: |
-            *.cache-to=
+            *.platform=${{ matrix.platform.docker }}
+            ${{ github.event_name != 'pull_request' && '*.output=type=image,push-by-digest=true,name-canonical=true,push=true' || '' }}
+            *.tags=${{ env.REGISTRY }}/${{ matrix.service }}
         env:
-          TAG: ${{ steps.meta.outputs.tag }}
+          TAG: ${{ needs.prepare.outputs.tag }}
+          CACHE_PLATFORM: ${{ matrix.platform.name }}
+
+      - name: Export digest
+        if: github.event_name != 'pull_request'
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ fromJSON(steps.bake.outputs.metadata)[matrix.service]['containerimage.digest'] }}"
+          touch "/tmp/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        if: github.event_name != 'pull_request'
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.service }}-digest-${{ matrix.platform.name }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge-manifests:
+    if: github.event_name != 'pull_request'
+    needs: [prepare, build-base, build-services]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      matrix:
+        service: ${{ fromJson(needs.prepare.outputs.all-images) }}
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GHCR_PAT }}
+
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          path: /tmp/digests
+          pattern: ${{ matrix.service }}-digest-*
+          merge-multiple: true
+
+      - name: Create manifest list and push
+        working-directory: /tmp/digests
+        run: |
+          # Create manifest
+          docker buildx imagetools create \
+            -t ${{ env.REGISTRY }}/${{ matrix.service }}:${{ needs.prepare.outputs.tag }} \
+            -t ${{ env.REGISTRY }}/${{ matrix.service }}:latest \
+            $(printf '${{ env.REGISTRY }}/${{ matrix.service }}@sha256:%s ' *)
+
+      - name: Inspect image
+        run: |
+          docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ matrix.service }}:${{ needs.prepare.outputs.tag }}
diff --git a/docker-compose.yml b/docker-compose.yml
@@ -6,6 +6,8 @@ x-backend-base:
       args:
         INSTALL_DEV: ${INSTALL_DEV-false}
       dockerfile: ../docker/Dockerfile.fastapi
+      additional_contexts:
+        - interactem-base=docker-image://ghcr.io/nersc/interactem/interactem
     env_file:
       - .env
     environment:
@@ -141,6 +143,8 @@ services:
 
     build:
       context: backend/
+      additional_contexts:
+        - interactem-base=docker-image://ghcr.io/nersc/interactem/interactem
       dockerfile: ../docker/Dockerfile.orchestrator
 
 
@@ -180,6 +184,8 @@ services:
       - "${HOME}/.superfacility/key.pem:/key.pem"
     build: 
       context: backend/
+      additional_contexts:
+        - interactem-base=docker-image://ghcr.io/nersc/interactem/interactem
       dockerfile: ../docker/Dockerfile.launcher
 
   metrics:
@@ -202,6 +208,8 @@ services:
 
     build:
       context: backend/
+      additional_contexts:
+        - interactem-base=docker-image://ghcr.io/nersc/interactem/interactem
       dockerfile: ../docker/Dockerfile.metrics
 
   prometheus:
diff --git a/docker/docker-bake.hcl b/docker/docker-bake.hcl
@@ -56,6 +56,12 @@ target "platform" {
   platforms = ["linux/amd64", "linux/arm64"]
 }
 
+target "contexts" {
+  contexts = {
+    interactem-base = "target:base"
+  }
+}
+
 variable "CACHE_PLATFORM" {
   default = "amd64"
 }
@@ -72,13 +78,10 @@ target "base" {
 
 // Service definitions
 target "operator" {
-  inherits = ["platform"]
+  inherits = ["platform", "contexts"]
   context = "backend/"
   dockerfile = "../docker/Dockerfile.operator"
   tags = generate_tags("operator")
-  contexts = {
-    interactem-base = "target:base"
-  }
   cache-from = generate_cache_from("operator")
   cache-to = generate_cache_to("operator")
 }
@@ -93,37 +96,28 @@ target "callout" {
 }
 
 target "fastapi" {
-  inherits = ["platform"]
+  inherits = ["platform", "contexts"]
   context = "backend/"
   dockerfile = "../docker/Dockerfile.fastapi"
   tags = generate_tags("fastapi")
-  contexts = {
-    interactem-base = "target:base"
-  }
   cache-from = generate_cache_from("fastapi")
   cache-to = generate_cache_to("fastapi")
 }
 
 target "launcher" {
-  inherits = ["platform"]
+  inherits = ["platform", "contexts"]
   context = "backend/"
   dockerfile = "../docker/Dockerfile.launcher"
   tags = generate_tags("launcher")
-  contexts = {
-    interactem-base = "target:base"
-  }
   cache-from = generate_cache_from("launcher")
   cache-to = generate_cache_to("launcher")
 }
 
 target "orchestrator" {
-  inherits = ["platform"]
+  inherits = ["platform", "contexts"]
   context = "backend/"
   dockerfile = "../docker/Dockerfile.orchestrator"
   tags = generate_tags("orchestrator")
-  contexts = {
-    interactem-base = "target:base"
-  }
   cache-from = generate_cache_from("orchestrator")
   cache-to = generate_cache_to("orchestrator")
 }
@@ -138,13 +132,10 @@ target "frontend" {
 }
 
 target "metrics" {
-  inherits = ["platform"]
+  inherits = ["platform", "contexts"]
   context = "backend/"
   dockerfile = "../docker/Dockerfile.metrics"
   tags = generate_tags("metrics")
-  contexts = {
-    interactem-base = "target:base"
-  }
   cache-from = generate_cache_from("metrics")
   cache-to = generate_cache_to("metrics")
 }
diff --git a/operators/docker-bake.hcl b/operators/docker-bake.hcl
@@ -54,6 +54,9 @@ target "base" {
 target "operator" {
   inherits = [ "common" ]
   context = "backend/"
+  contexts = {
+    interactem-base = "target:base"
+  }
   dockerfile = "../docker/Dockerfile.operator"
   tags = ["${REGISTRY}/operator:${TAG}"]
 }
