Merge pull request #4 from functionland/fix/ipfs-cluster-identity-dir… #58
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Publish Multi-Platform Docker Image | |
| # Multi-platform (arm64 + amd64) image build + push to Docker Hub. | |
| # Mirrors functionland/loyal-agent's CI setup; image renamed to blox-ai. | |
| # | |
| # Required secrets (set on the GitHub repo): | |
| # DOCKERHUB_USERNAME | |
| # DOCKERHUB_ORG_TOKEN | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ['v*'] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| inputs: | |
| extra_tag: | |
| description: | | |
| Additional Docker tag to publish from this ref (e.g. | |
| "rollback-2026-05-26"). Use to mint immutable rollback tags | |
| from a known-good commit. Leave blank for normal runs. | |
| required: false | |
| type: string | |
| default: "" | |
| env: | |
| IMAGE_NAME: functionland/blox-ai | |
| jobs: | |
| build-and-push-image: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up QEMU (for cross-platform arm64 build on amd64 runner) | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to Docker Hub | |
| if: ${{ github.event_name != 'pull_request' }} | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_ORG_TOKEN }} | |
| - name: Extract metadata for Docker image | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=ref,event=branch | |
| type=ref,event=pr | |
| type=semver,pattern={{version}} | |
| # :release tracks main as the production-default tag. | |
| # Compose default in the fula-ota plugin is | |
| # ${BLOX_AI_IMAGE_TAG:-release}, so without this devices on a | |
| # fresh install would hit a Docker Hub 404. Safety preconditions | |
| # (documented in plan-B-production-consolidation.md): | |
| # - main is branch-protected (PR + review + green CI required) | |
| # - immutable rollback-YYYYMMDD tag exists as fallback, | |
| # minted via workflow_dispatch + extra_tag input | |
| # - canary devices pin to an immutable sha256 digest (not | |
| # a moving tag) during the D4 observation window | |
| # Replace with semver-promote step when versioning lands. | |
| # (The previous :test raw-tag alias is dropped — :release is | |
| # now the single production tag and canaries pin by digest.) | |
| type=raw,value=release,enable=${{ github.ref == 'refs/heads/main' }} | |
| # workflow_dispatch extra tag — used to mint immutable rollback | |
| # tags from a chosen commit (publish-then-smoke per plan D0.3). | |
| type=raw,value=${{ github.event.inputs.extra_tag }},enable=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.extra_tag != '' }} | |
| - name: Build and push multi-platform Docker image | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| push: ${{ github.event_name != 'pull_request' }} | |
| platforms: linux/arm64,linux/amd64 | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max |