build.yml

name: Build

on:
  push:
    branches:
      - main
  pull_request:

env:
  DEFAULT_BASE_IMAGE: ubuntu:noble

jobs:
  version:
    name: Check if version changed
    runs-on: ubuntu-latest
    outputs:
      push: ${{ steps.push.outputs.push }}
      version-changed: ${{ steps.version-metadata.outputs.changed }}
      new-version: ${{ steps.version-metadata.outputs.newVersion }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: Quantco/ui-actions/version-metadata@cd71d2a0e30b25569f6d723e57acca83347e58fc # v1.0.18
        id: version-metadata
        with:
          file: Dockerfile
          token: ${{ secrets.GITHUB_TOKEN }}
          version-extraction-override: 'regex:ARG PIXI_VERSION=(.*)'
      - name: Determine if pushing images
        id: push
        run: echo push=${{ steps.version-metadata.outputs.changed == 'true' && github.event_name == 'push' && github.ref_name == 'main' }} >> $GITHUB_OUTPUT

  build:
    needs: version
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        base-image:
         - debian:bookworm-slim # 12
         - debian:bookworm # 12
         - debian:bullseye-slim # 11
         - debian:bullseye # 11
         - ubuntu:plucky # 25.04
         - ubuntu:noble # 24.04
         - ubuntu:mantic # 23.10
         - ubuntu:jammy # 22.04
         - ubuntu:focal # 20.04
         - nvidia/cuda:12.6.3-base-ubuntu24.04
         - nvidia/cuda:12.6.3-base-ubuntu22.04
         - nvidia/cuda:12.6.3-base-ubuntu20.04
    steps:
    - name: Checkout source
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Set image variables
      id: image-variables
      env:
        IMAGE: ${{ matrix.base-image }}
      run: |
        import os

        base_image = "${{ matrix.base-image }}"
        if base_image.startswith("nvidia/cuda"):
            code_names = {
                "22.04": "jammy",
                "20.04": "focal",
                "23.10": "mantic",
                "24.04": "noble",
                "25.05": "plucky"
            }
            ubuntu_version_number = base_image.split("-ubuntu")[-1]
            base_tag = base_image.split(":")[-1]
            cuda_version = base_tag.split("-")[0]
            tag = f"{code_names[ubuntu_version_number]}-cuda-{cuda_version}"
            platforms = "linux/amd64,linux/arm64"
        else:
            tag = base_image.split(":")[-1]
            platforms = "linux/amd64,linux/arm64"
        is_default = "true" if base_image == "${{ env.DEFAULT_BASE_IMAGE }}" else "false"

        GITHUB_OUTPUT = os.environ["GITHUB_OUTPUT"]
        with open(GITHUB_OUTPUT, "a") as f:
            f.write(f"tag={tag}\n")
            f.write(f"platforms={platforms}\n")
            f.write(f"is-default={is_default}\n")
      shell: python
    - name: Get docker metadata
      id: metadata
      uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
      with:
        images: |-
          ghcr.io/prefix-dev/pixi
        flavor: latest=false
        # latest
        # base-image
        # major.minor.patch
        # major.minor.patch-base-image
        tags: |
            type=raw,value=latest,priority=1000,enable=${{ steps.image-variables.outputs.is-default }}
            type=raw,value=${{ steps.image-variables.outputs.tag }},priority=900
            type=semver,pattern={{version}},enable=${{ steps.image-variables.outputs.is-default }},value=${{ needs.version.outputs.new-version }},priority=800
            type=semver,pattern={{version}}-${{ steps.image-variables.outputs.tag }},value=${{ needs.version.outputs.new-version }},priority=500
    - name: Setup docker buildx
      uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
    - name: Login to GHCR
      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Build Docker images
      id: build
      uses: docker/build-push-action@b32b51a8eda65d6793cd0494a773d4f6bcef32dc # v6.11.0
      with:
        # provenance: false is needed to avoid unkown/unknown os/arch on ghcr
        # see: https://github.com/docker/build-push-action/issues/820
        provenance: false
        platforms: ${{ steps.image-variables.outputs.platforms }}
        push: ${{ needs.version.outputs.push == 'true' }}
        build-args: |-
          BASE_IMAGE=${{ matrix.base-image }}
        tags: ${{ steps.metadata.outputs.tags }}
        labels: ${{ steps.metadata.outputs.labels }}
    - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
      with:
        name: ${{ steps.image-variables.outputs.tag }}
        path: ${{ steps.metadata.outputs.bake-file }}
    - name: Run tests
      # buildx does not support outputting the image so we need to pull it and run tests
      if: needs.version.outputs.push == 'true'
      run: |
        docker images
        # Test the pixi binary is available
        docker run --rm ghcr.io/prefix-dev/pixi:${{ needs.version.outputs.new-version }}-${{ steps.image-variables.outputs.tag }} pixi --version
        # Test end-to-end pixi workflow
        docker run --rm ghcr.io/prefix-dev/pixi:${{ needs.version.outputs.new-version }}-${{ steps.image-variables.outputs.tag }} sh -c "mkdir /app && cd /app && pixi init && pixi add python && pixi run python --version"
        # Test pixi global binaries are in PATH
        docker run --rm ghcr.io/prefix-dev/pixi:${{ needs.version.outputs.new-version }}-${{ steps.image-variables.outputs.tag }} sh -c "pixi global install rsync && rsync --version"
    - name: Image digest
      run: echo ${{ steps.build.outputs.digest }}

  release:
    needs: [version, build]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    if: needs.version.outputs.push == 'true'
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Push ${{ needs.version.outputs.new-version }} tag
        run: |
          git tag ${{ needs.version.outputs.new-version }}
          git push origin ${{ needs.version.outputs.new-version }}
      - name: Create release
        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
        with:
          generate_release_notes: true
          tag_name: ${{ needs.version.outputs.new-version }}