docker.yml

name: Build and Push Docker Images

# Two-image split:
#   1. Public pixi-with-checkpoints image from Dockerfile -> public registry.
#   2. Private Astera overlay from Dockerfile.astera -> Harbor, based on the
#      exact public image SHA tag built in step 1.

on:
  push:
    branches: [main]
    tags:
      - 'v*.*.*'
  workflow_dispatch:

env:
  # Override these with repository variables if Diffuse Hub uses a different
  # public registry path.
  PUBLIC_REGISTRY: ${{ vars.SAMPLEWORKS_PUBLIC_REGISTRY || 'docker.io' }}
  PUBLIC_IMAGE_NAME: ${{ vars.SAMPLEWORKS_PUBLIC_IMAGE || 'diffuseproject/pixi-with-checkpoints' }}
  CHECKPOINTS_SOURCE_IMAGE: ${{ vars.SAMPLEWORKS_CHECKPOINTS_SOURCE_IMAGE || 'harbor.astera.sh/library/sampleworks-checkpoints@sha256:ff1dd2b42c3afd593e034cf81df1bf1862c27ae491f46cc10e105629f1102781' }}
  CHECKPOINTS_DOCKERHUB_IMAGE: ${{ vars.SAMPLEWORKS_CHECKPOINTS_DOCKERHUB_IMAGE || 'docker.io/diffuseproject/sampleworks-checkpoints:latest' }}
  CUDA_BASE_IMAGE: ${{ vars.SAMPLEWORKS_CUDA_BASE_IMAGE || 'nvidia/cuda:12.4.1-devel-ubuntu22.04@sha256:da6791294b0b04d7e65d87b7451d6f2390b4d36225ab0701ee7dfec5769829f5' }}

  ASTERA_REGISTRY: harbor.astera.sh
  ASTERA_IMAGE_NAME: library/pixi-with-checkpoints
  SKOPEO_IMAGE: quay.io/skopeo/stable@sha256:c7d3c512612f52805023cd38351081dad7e2729fc13d14b701e47c7c8bdd6615

  DOCKER_METADATA_SHORT_SHA_LENGTH: 7

jobs:
  sync_checkpoints:
    name: Sync checkpoints to Docker Hub
    runs-on: diffuse-sh-builder
    permissions:
      contents: read
    outputs:
      checkpoints_digest: ${{ steps.verify_checkpoints.outputs.checkpoints_digest }}

    steps:
      - name: Copy checkpoint image to Docker Hub
        env:
          HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }}
          HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        run: |
          if [ -z "${CHECKPOINTS_SOURCE_IMAGE}" ] || [ -z "${CHECKPOINTS_DOCKERHUB_IMAGE}" ]; then
            echo "Checkpoint source and Docker Hub destination image refs must be set."
            exit 1
          fi
          if [ "${CHECKPOINTS_SOURCE_IMAGE}" = "${CHECKPOINTS_SOURCE_IMAGE%@*}" ]; then
            echo "CHECKPOINTS_SOURCE_IMAGE must be digest-pinned."
            exit 1
          fi
          if [ -z "${HARBOR_USERNAME}" ] || [ -z "${HARBOR_PASSWORD}" ]; then
            echo "HARBOR_USERNAME and HARBOR_PASSWORD secrets are required to pull checkpoint image."
            exit 1
          fi
          if [ -z "${DOCKERHUB_USERNAME}" ] || [ -z "${DOCKERHUB_TOKEN}" ]; then
            echo "DOCKERHUB_USERNAME and DOCKERHUB_TOKEN secrets are required to push checkpoint image."
            exit 1
          fi

          docker run --rm \
            --entrypoint /bin/sh \
            -e CHECKPOINTS_SOURCE_IMAGE \
            -e CHECKPOINTS_DOCKERHUB_IMAGE \
            -e HARBOR_USERNAME \
            -e HARBOR_PASSWORD \
            -e DOCKERHUB_USERNAME \
            -e DOCKERHUB_TOKEN \
            "${SKOPEO_IMAGE}" \
            -ceu 'skopeo copy --preserve-digests \
              --src-creds "${HARBOR_USERNAME}:${HARBOR_PASSWORD}" \
              --dest-creds "${DOCKERHUB_USERNAME}:${DOCKERHUB_TOKEN}" \
              "docker://${CHECKPOINTS_SOURCE_IMAGE}" \
              "docker://${CHECKPOINTS_DOCKERHUB_IMAGE}"'

      - name: Verify Docker Hub checkpoint digest
        id: verify_checkpoints
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        run: |
          expected_digest="${CHECKPOINTS_SOURCE_IMAGE##*@}"
          actual_digest="$(docker run --rm \
            --entrypoint /bin/sh \
            -e CHECKPOINTS_DOCKERHUB_IMAGE \
            -e DOCKERHUB_USERNAME \
            -e DOCKERHUB_TOKEN \
            "${SKOPEO_IMAGE}" \
            -ceu 'skopeo inspect \
              --creds "${DOCKERHUB_USERNAME}:${DOCKERHUB_TOKEN}" \
              --format "{{.Digest}}" \
              "docker://${CHECKPOINTS_DOCKERHUB_IMAGE}"')"

          if [ "${actual_digest}" != "${expected_digest}" ]; then
            echo "Docker Hub checkpoint digest mismatch: expected ${expected_digest}, got ${actual_digest}"
            exit 1
          fi

          echo "checkpoints_digest=${actual_digest}" >> "$GITHUB_OUTPUT"

  public:
    name: Public pixi-with-checkpoints image
    runs-on: diffuse-sh-builder
    needs: sync_checkpoints
    permissions:
      contents: read
    outputs:
      image-digest: ${{ steps.public-build.outputs.digest }}

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4

      - name: Login to public registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
        with:
          registry: ${{ env.PUBLIC_REGISTRY }}
          username: ${{ secrets.SAMPLEWORKS_PUBLIC_REGISTRY_USERNAME || secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.SAMPLEWORKS_PUBLIC_REGISTRY_PASSWORD || secrets.DOCKERHUB_TOKEN }}

      - name: Docker metadata for public image
        id: public-meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
        with:
          images: ${{ env.PUBLIC_REGISTRY }}/${{ env.PUBLIC_IMAGE_NAME }}
          tags: |
            type=raw,value=latest,enable={{is_default_branch}}
            type=sha,prefix=sha-
            type=semver,pattern={{version}}
            type=semver,pattern=v{{version}}

      - name: Resolve mirrored checkpoint image input
        id: checkpoint-ref
        env:
          CHECKPOINTS_DIGEST: ${{ needs.sync_checkpoints.outputs.checkpoints_digest }}
        run: |
          if [ -z "${CHECKPOINTS_DIGEST}" ]; then
            echo "sync-checkpoints did not produce a checkpoint digest."
            exit 1
          fi
          if [ "${CHECKPOINTS_DIGEST}" = "${CHECKPOINTS_DIGEST#sha256:}" ]; then
            echo "sync-checkpoints produced a non-sha256 digest: ${CHECKPOINTS_DIGEST}"
            exit 1
          fi
          dockerhub_ref="${CHECKPOINTS_DOCKERHUB_IMAGE%@*}"
          dockerhub_ref="${dockerhub_ref%:*}"
          echo "image=${dockerhub_ref}@${CHECKPOINTS_DIGEST}" >> "$GITHUB_OUTPUT"

      - name: Build and push public image
        id: public-build
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
        with:
          context: .
          file: Dockerfile
          target: public
          platforms: linux/amd64
          push: true
          tags: ${{ steps.public-meta.outputs.tags }}
          labels: ${{ steps.public-meta.outputs.labels }}
          build-args: |
            BASE_IMAGE=${{ env.CUDA_BASE_IMAGE }}
            CHECKPOINTS_IMAGE=${{ steps.checkpoint-ref.outputs.image }}
          cache-from: type=registry,ref=${{ env.PUBLIC_REGISTRY }}/${{ env.PUBLIC_IMAGE_NAME }}:buildcache
          cache-to: type=registry,ref=${{ env.PUBLIC_REGISTRY }}/${{ env.PUBLIC_IMAGE_NAME }}:buildcache,mode=max,ignore-error=true
          provenance: false

      - name: Public image digest
        run: echo "Public image pushed with digest ${{ steps.public-build.outputs.digest }}"

  astera:
    name: Astera EXT image
    runs-on: diffuse-sh-builder
    needs: public
    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4

      - name: Login to Harbor
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
        with:
          registry: ${{ env.ASTERA_REGISTRY }}
          username: ${{ secrets.HARBOR_USERNAME }}
          password: ${{ secrets.HARBOR_PASSWORD }}

      - name: Login to public registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
        with:
          registry: ${{ env.PUBLIC_REGISTRY }}
          username: ${{ secrets.SAMPLEWORKS_PUBLIC_REGISTRY_USERNAME || secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.SAMPLEWORKS_PUBLIC_REGISTRY_PASSWORD || secrets.DOCKERHUB_TOKEN }}

      - name: Docker metadata for Astera image
        id: astera-meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
        with:
          images: ${{ env.ASTERA_REGISTRY }}/${{ env.ASTERA_IMAGE_NAME }}
          tags: |
            type=raw,value=latest,enable={{is_default_branch}}
            type=raw,value=sampleworks,enable={{is_default_branch}}
            type=sha,prefix=sha-
            type=semver,pattern={{version}}
            type=semver,pattern=v{{version}}

      - name: Validate public image digest
        env:
          PUBLIC_IMAGE_DIGEST: ${{ needs.public.outputs.image-digest }}
        run: |
          if [ -z "${PUBLIC_IMAGE_DIGEST}" ]; then
            echo "public job did not produce an image digest."
            exit 1
          fi
          if [ "${PUBLIC_IMAGE_DIGEST}" = "${PUBLIC_IMAGE_DIGEST#sha256:}" ]; then
            echo "public job produced a non-sha256 digest: ${PUBLIC_IMAGE_DIGEST}"
            exit 1
          fi

      - name: Build and push Astera image
        id: astera-build
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
        with:
          context: .
          file: Dockerfile.astera
          platforms: linux/amd64
          push: true
          tags: ${{ steps.astera-meta.outputs.tags }}
          labels: ${{ steps.astera-meta.outputs.labels }}
          build-args: |
            PIXI_WITH_CHECKPOINTS_IMAGE=${{ env.PUBLIC_REGISTRY }}/${{ env.PUBLIC_IMAGE_NAME }}@${{ needs.public.outputs.image-digest }}
          cache-from: type=registry,ref=${{ env.ASTERA_REGISTRY }}/${{ env.ASTERA_IMAGE_NAME }}:buildcache
          cache-to: type=registry,ref=${{ env.ASTERA_REGISTRY }}/${{ env.ASTERA_IMAGE_NAME }}:buildcache,mode=max,ignore-error=true
          provenance: false

      - name: Astera image digest
        run: echo "Astera image pushed with digest ${{ steps.astera-build.outputs.digest }}"