build-sandboxes.yml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Build Sandbox Images

on:
  push:
    branches: [main]
    paths:
      - "sandboxes/**"
  pull_request:
    branches: [main]
    paths:
      - "sandboxes/**"
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  IMAGE_PREFIX: ${{ github.repository }}
  ECR_REGISTRY: 524473328983.dkr.ecr.us-west-2.amazonaws.com
  ECR_IMAGE_PREFIX: nemoclaw-community

permissions:
  contents: read
  packages: write

jobs:
  # ---------------------------------------------------------------------------
  # Detect which sandbox images have changed
  # ---------------------------------------------------------------------------
  detect-changes:
    name: Detect changed sandboxes
    runs-on: ubuntu-latest
    outputs:
      base-changed: ${{ steps.changes.outputs.base_changed }}
      sandboxes: ${{ steps.changes.outputs.sandboxes }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Determine changed sandboxes
        id: changes
        run: |
          set -euo pipefail

          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            # Build everything on manual trigger
            BASE_CHANGED="true"
            SANDBOXES=$(find sandboxes -mindepth 1 -maxdepth 1 -type d -name '*.base' -prune -o -exec test -f {}/Dockerfile \; -print \
              | xargs -I{} basename {} \
              | grep -v '^base$' \
              | jq -R -s -c 'split("\n") | map(select(length > 0))')
          else
            if [ "${{ github.event_name }}" = "pull_request" ]; then
              BASE_SHA="${{ github.event.pull_request.base.sha }}"
            else
              BASE_SHA="${{ github.event.before }}"
            fi

            CHANGED=$(git diff --name-only "$BASE_SHA" "${{ github.sha }}" -- sandboxes/)

            # Check if base changed
            if echo "$CHANGED" | grep -q '^sandboxes/base/'; then
              BASE_CHANGED="true"
              # When base changes, rebuild all sandboxes that have a Dockerfile
              SANDBOXES=$(find sandboxes -mindepth 1 -maxdepth 1 -type d -exec test -f {}/Dockerfile \; -print \
                | xargs -I{} basename {} \
                | grep -v '^base$' \
                | jq -R -s -c 'split("\n") | map(select(length > 0))')
            else
              BASE_CHANGED="false"
              SANDBOXES=$(echo "$CHANGED" \
                | cut -d'/' -f2 \
                | sort -u \
                | while read -r name; do
                    if [ "$name" != "base" ] && [ -f "sandboxes/${name}/Dockerfile" ]; then echo "$name"; fi
                  done \
                | jq -R -s -c 'split("\n") | map(select(length > 0))')
            fi
          fi

          echo "base_changed=${BASE_CHANGED}" >> "$GITHUB_OUTPUT"
          echo "sandboxes=${SANDBOXES}" >> "$GITHUB_OUTPUT"
          echo "Base changed: ${BASE_CHANGED}"
          echo "Will build: ${SANDBOXES}"

  # ---------------------------------------------------------------------------
  # Build the base sandbox image (other sandboxes depend on this)
  # ---------------------------------------------------------------------------
  build-base:
    name: Build base
    needs: detect-changes
    if: needs.detect-changes.outputs.base-changed == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Lowercase image prefix
        id: repo
        run: echo "image_prefix=${IMAGE_PREFIX,,}" >> "$GITHUB_OUTPUT"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate image metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ steps.repo.outputs.image_prefix }}/sandboxes/base
          tags: |
            type=sha,prefix=
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: sandboxes/base
          platforms: linux/amd64,linux/arm64
          push: ${{ github.ref == 'refs/heads/main' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=base
          cache-to: type=gha,mode=max,scope=base

  # ---------------------------------------------------------------------------
  # Build dependent sandbox images (after base completes)
  # ---------------------------------------------------------------------------
  build:
    name: Build ${{ matrix.sandbox }}
    needs: [detect-changes, build-base]
    if: |
      always() &&
      needs.detect-changes.result == 'success' &&
      (needs.build-base.result == 'success' || needs.build-base.result == 'skipped') &&
      needs.detect-changes.outputs.sandboxes != '[]'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        sandbox: ${{ fromJson(needs.detect-changes.outputs.sandboxes) }}
    steps:
      - uses: actions/checkout@v4

      - name: Lowercase image prefix
        id: repo
        run: echo "image_prefix=${IMAGE_PREFIX,,}" >> "$GITHUB_OUTPUT"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      # On PRs, use a local registry so the base image built in this job is
      # accessible to the subsequent buildx build (docker-container driver
      # cannot see images loaded into the host daemon).
      - name: Start local registry (PR only)
        if: github.ref != 'refs/heads/main'
        run: docker run -d -p 5000:5000 --name registry registry:2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: ${{ github.ref != 'refs/heads/main' && 'network=host' || '' }}

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # On PRs the base image is not in GHCR. Build it locally, push to the
      # local registry, and override BASE_IMAGE to point there.
      - name: Build base image locally (PR only)
        if: github.ref != 'refs/heads/main'
        uses: docker/build-push-action@v6
        with:
          context: sandboxes/base
          push: true
          tags: localhost:5000/sandboxes/base:latest
          cache-from: type=gha,scope=base

      - name: Determine parent sandbox
        id: parent
        run: |
          set -euo pipefail
          DEFAULT_BASE=$(grep '^ARG BASE_IMAGE=' "sandboxes/${{ matrix.sandbox }}/Dockerfile" | head -1 | cut -d= -f2-)
          PARENT=$(echo "$DEFAULT_BASE" | sed -n 's|.*/sandboxes/\([^:]*\).*|\1|p')
          if [ -z "$PARENT" ]; then
            PARENT="base"
          fi
          echo "sandbox=$PARENT" >> "$GITHUB_OUTPUT"
          echo "Parent for ${{ matrix.sandbox }}: $PARENT"

      # When a sandbox depends on another sandbox (not base), build that
      # intermediate parent locally so it is available to the buildx build.
      - name: Build parent sandbox locally (PR only)
        if: github.ref != 'refs/heads/main' && steps.parent.outputs.sandbox != 'base'
        uses: docker/build-push-action@v6
        with:
          context: sandboxes/${{ steps.parent.outputs.sandbox }}
          push: true
          tags: localhost:5000/sandboxes/${{ steps.parent.outputs.sandbox }}:latest
          build-args: |
            BASE_IMAGE=localhost:5000/sandboxes/base:latest
          cache-from: type=gha,scope=${{ steps.parent.outputs.sandbox }}

      - name: Set BASE_IMAGE
        id: base
        run: |
          PARENT="${{ steps.parent.outputs.sandbox }}"
          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
            echo "image=${{ env.REGISTRY }}/${{ steps.repo.outputs.image_prefix }}/sandboxes/${PARENT}:latest" >> "$GITHUB_OUTPUT"
          else
            echo "image=localhost:5000/sandboxes/${PARENT}:latest" >> "$GITHUB_OUTPUT"
          fi

      - name: Generate image metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ steps.repo.outputs.image_prefix }}/sandboxes/${{ matrix.sandbox }}
          tags: |
            type=sha,prefix=
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: sandboxes/${{ matrix.sandbox }}
          platforms: ${{ github.ref == 'refs/heads/main' && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
          push: ${{ github.ref == 'refs/heads/main' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            BASE_IMAGE=${{ steps.base.outputs.image }}
          cache-from: type=gha,scope=${{ matrix.sandbox }}
          cache-to: type=gha,mode=max,scope=${{ matrix.sandbox }}

  # ---------------------------------------------------------------------------
  # Publish images to ECR (re-tag from GHCR, no rebuild required)
  # ---------------------------------------------------------------------------
  publish-ecr:
    name: Publish to ECR
    needs: [detect-changes, build-base, build]
    if: |
      always() &&
      github.ref == 'refs/heads/main' &&
      needs.detect-changes.result == 'success' &&
      (needs.build-base.result == 'success' || needs.build-base.result == 'skipped') &&
      (needs.build.result == 'success' || needs.build.result == 'skipped')
    runs-on: ubuntu-latest
    env:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      AWS_DEFAULT_REGION: us-west-2
    steps:
      - name: Lowercase image prefix
        id: repo
        run: |
          echo "image_prefix=${IMAGE_PREFIX,,}" >> "$GITHUB_OUTPUT"
          echo "short_sha=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log in to ECR
        run: aws ecr get-login-password --region us-west-2 | docker login --username AWS --password-stdin ${{ env.ECR_REGISTRY }}

      - name: Copy base image to ECR
        if: needs.detect-changes.outputs.base-changed == 'true'
        run: |
          set -euo pipefail
          GHCR_IMAGE="${{ env.REGISTRY }}/${{ steps.repo.outputs.image_prefix }}/sandboxes/base"
          ECR_IMAGE="${{ env.ECR_REGISTRY }}/${{ env.ECR_IMAGE_PREFIX }}/sandboxes/base"
          SHORT_SHA="${{ steps.repo.outputs.short_sha }}"

          echo "Copying ${GHCR_IMAGE}:${SHORT_SHA} -> ${ECR_IMAGE}:${SHORT_SHA}"
          docker buildx imagetools create \
            -t "${ECR_IMAGE}:${SHORT_SHA}" \
            "${GHCR_IMAGE}:${SHORT_SHA}"

          echo "Copying ${GHCR_IMAGE}:latest -> ${ECR_IMAGE}:latest"
          docker buildx imagetools create \
            -t "${ECR_IMAGE}:latest" \
            "${GHCR_IMAGE}:latest"

      - name: Copy sandbox images to ECR
        if: needs.detect-changes.outputs.sandboxes != '[]'
        run: |
          set -euo pipefail
          SANDBOXES='${{ needs.detect-changes.outputs.sandboxes }}'
          SHORT_SHA="${{ steps.repo.outputs.short_sha }}"

          for SANDBOX in $(echo "$SANDBOXES" | jq -r '.[]'); do
            GHCR_IMAGE="${{ env.REGISTRY }}/${{ steps.repo.outputs.image_prefix }}/sandboxes/${SANDBOX}"
            ECR_IMAGE="${{ env.ECR_REGISTRY }}/${{ env.ECR_IMAGE_PREFIX }}/sandboxes/${SANDBOX}"

            echo "Copying ${GHCR_IMAGE}:${SHORT_SHA} -> ${ECR_IMAGE}:${SHORT_SHA}"
            docker buildx imagetools create \
              -t "${ECR_IMAGE}:${SHORT_SHA}" \
              "${GHCR_IMAGE}:${SHORT_SHA}"

            echo "Copying ${GHCR_IMAGE}:latest -> ${ECR_IMAGE}:latest"
            docker buildx imagetools create \
              -t "${ECR_IMAGE}:latest" \
              "${GHCR_IMAGE}:latest"
          done