build.yml

name: bluebuild
on:
  schedule:
    - cron:
        "00 06 * * *" # build at 06:00 UTC every day
        # (20 minutes after last ublue images start building)
  push:
    paths-ignore: # don't rebuild if only documentation has changed
      - "**.md"

  pull_request:
  workflow_dispatch: # allow manually triggering builds
concurrency:
  # only run one build at a time
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
  cancel-in-progress: true

jobs:
  # Job 1: Build the base image first
  build-base:
    name: Build Base Image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - name: Build Custom Image
        uses: blue-build/github-action@v1.9
        with:
          recipe: recipe.yml # <-- Only builds the base recipe
          cosign_private_key: ${{ secrets.SIGNING_SECRET }}
          registry_token: ${{ github.token }}
          pr_event_number: ${{ github.event.number }}
          maximize_build_space: true

  # Job 2: Build the NVIDIA image AFTER the base image is done
  build-nvidia:
    name: Build NVIDIA Image
    runs-on: ubuntu-latest
    needs: build-base # <-- This is the crucial line!
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - name: Build Custom Image
        uses: blue-build/github-action@v1.9
        with:
          recipe: recipe-nvidia.yml # <-- Only builds the NVIDIA recipe
          cosign_private_key: ${{ secrets.SIGNING_SECRET }}
          registry_token: ${{ github.token }}
          pr_event_number: ${{ github.event.number }}
          maximize_build_space: true