mirror of
https://github.com/nearai/ironclaw.git
synced 2026-09-03 08:06:01 +08:00
229 lines
8.6 KiB
YAML
229 lines
8.6 KiB
YAML
name: Docker Image
|
|
|
|
on:
|
|
# Called by release.yml or other workflows
|
|
workflow_call:
|
|
inputs:
|
|
tag:
|
|
description: "Image tag override (leave empty for auto-detect)"
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
# On-demand builds
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: "Image tag override (leave empty for auto-detect)"
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
# Staging build from the staging branch every hour
|
|
schedule:
|
|
- cron: '0 * * * *'
|
|
|
|
env:
|
|
IMAGE_NAME: nearaidev/ironclaw
|
|
WORKER_IMAGE_NAME: nearaidev/ironclaw-worker
|
|
|
|
jobs:
|
|
build:
|
|
name: Build & Push
|
|
runs-on: ubuntu-24.04
|
|
permissions:
|
|
contents: read
|
|
packages: read
|
|
actions: write
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
with:
|
|
ref: ${{ github.event_name == 'schedule' && 'staging' || '' }}
|
|
persist-credentials: false
|
|
|
|
- name: Resolve source git commit
|
|
id: source_sha
|
|
run: |
|
|
SOURCE_SHA="$(git rev-parse HEAD)"
|
|
echo "sha=${SOURCE_SHA}" >> "$GITHUB_OUTPUT"
|
|
echo "Source commit: ${SOURCE_SHA}"
|
|
|
|
- name: Extract version from Cargo.toml
|
|
id: version
|
|
run: |
|
|
VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')
|
|
echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
|
|
echo "Detected version: ${VERSION}"
|
|
|
|
- name: Determine tags
|
|
id: tags
|
|
env:
|
|
VERSION: ${{ steps.version.outputs.version }}
|
|
EVENT_NAME: ${{ github.event_name }}
|
|
INPUT_TAG: ${{ inputs.tag }}
|
|
SOURCE_SHA: ${{ steps.source_sha.outputs.sha }}
|
|
run: |
|
|
SHA="sha-${SOURCE_SHA::7}"
|
|
echo "sha_tag=${SHA}" >> "$GITHUB_OUTPUT"
|
|
|
|
if [[ "${EVENT_NAME}" == "workflow_call" ]]; then
|
|
# Release: :version + :latest + :sha-xxx
|
|
TAGS="${IMAGE_NAME}:${VERSION}"
|
|
TAGS="${TAGS},${IMAGE_NAME}:latest"
|
|
TAGS="${TAGS},${IMAGE_NAME}:${SHA}"
|
|
WORKER_TAGS="${WORKER_IMAGE_NAME}:${VERSION}"
|
|
WORKER_TAGS="${WORKER_TAGS},${WORKER_IMAGE_NAME}:latest"
|
|
WORKER_TAGS="${WORKER_TAGS},${WORKER_IMAGE_NAME}:${SHA}"
|
|
elif [[ "${EVENT_NAME}" == "schedule" ]]; then
|
|
# Daily staging: :staging + :sha-xxx
|
|
TAGS="${IMAGE_NAME}:staging"
|
|
TAGS="${TAGS},${IMAGE_NAME}:${SHA}"
|
|
WORKER_TAGS="${WORKER_IMAGE_NAME}:staging"
|
|
WORKER_TAGS="${WORKER_TAGS},${WORKER_IMAGE_NAME}:${SHA}"
|
|
else
|
|
# Manual dispatch: :sha-xxx only
|
|
TAGS="${IMAGE_NAME}:${SHA}"
|
|
WORKER_TAGS="${WORKER_IMAGE_NAME}:${SHA}"
|
|
fi
|
|
|
|
# Manual override adds an extra tag (e.g. "staging")
|
|
if [[ -n "${INPUT_TAG}" ]]; then
|
|
TAGS="${TAGS},${IMAGE_NAME}:${INPUT_TAG}"
|
|
WORKER_TAGS="${WORKER_TAGS},${WORKER_IMAGE_NAME}:${INPUT_TAG}"
|
|
fi
|
|
echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
|
|
echo "worker_tags=${WORKER_TAGS}" >> "$GITHUB_OUTPUT"
|
|
|
|
# Staging builds get pre-bundled WASM extensions
|
|
if [[ "${EVENT_NAME}" == "schedule" || "${INPUT_TAG}" == "staging" ]]; then
|
|
echo "target=runtime-staging" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "target=runtime" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Log in to Docker Hub
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
|
|
with:
|
|
username: ${{ vars.DOCKER_REGISTRY_USER }}
|
|
password: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
|
|
|
|
- name: Check if current staging commit is already built
|
|
id: check
|
|
if: steps.tags.outputs.target == 'runtime-staging'
|
|
env:
|
|
SOURCE_SHA: ${{ steps.source_sha.outputs.sha }}
|
|
run: |
|
|
CURRENT_BUILT_SHA=""
|
|
WORKER_BUILT_SHA=""
|
|
|
|
if docker pull "${IMAGE_NAME}:staging" > /dev/null 2>&1; then
|
|
CURRENT_BUILT_SHA=$(docker inspect --format='{{index .Config.Labels "ironclaw.git.sha"}}' "${IMAGE_NAME}:staging" 2>/dev/null || echo "")
|
|
fi
|
|
if docker pull "${WORKER_IMAGE_NAME}:staging" > /dev/null 2>&1; then
|
|
WORKER_BUILT_SHA=$(docker inspect --format='{{index .Config.Labels "ironclaw.git.sha"}}' "${WORKER_IMAGE_NAME}:staging" 2>/dev/null || echo "")
|
|
fi
|
|
|
|
echo "Current built commit (ironclaw): ${CURRENT_BUILT_SHA:-<none>}"
|
|
echo "Current built commit (ironclaw-worker): ${WORKER_BUILT_SHA:-<none>}"
|
|
echo "Current source commit: ${SOURCE_SHA}"
|
|
|
|
if [[ -n "${CURRENT_BUILT_SHA}" && "${CURRENT_BUILT_SHA}" == "${SOURCE_SHA}" && -n "${WORKER_BUILT_SHA}" && "${WORKER_BUILT_SHA}" == "${SOURCE_SHA}" ]]; then
|
|
echo "skip=true" >> "$GITHUB_OUTPUT"
|
|
echo "Current commit already built for both images — skipping."
|
|
else
|
|
echo "skip=false" >> "$GITHUB_OUTPUT"
|
|
echo "At least one image is missing or out of date — proceeding."
|
|
fi
|
|
|
|
- name: Set up Docker Buildx
|
|
if: steps.check.outputs.skip != 'true'
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
|
|
|
|
- name: Build and push (ironclaw)
|
|
if: steps.check.outputs.skip != 'true'
|
|
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
|
|
with:
|
|
context: .
|
|
push: true
|
|
tags: ${{ steps.tags.outputs.tags }}
|
|
target: ${{ steps.tags.outputs.target }}
|
|
labels: |
|
|
ironclaw.git.sha=${{ steps.source_sha.outputs.sha }}
|
|
platforms: linux/amd64
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|
|
|
|
- name: Build and push (ironclaw-worker)
|
|
if: steps.check.outputs.skip != 'true'
|
|
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
|
|
with:
|
|
context: .
|
|
file: Dockerfile.worker
|
|
push: true
|
|
tags: ${{ steps.tags.outputs.worker_tags }}
|
|
labels: |
|
|
ironclaw.git.sha=${{ steps.source_sha.outputs.sha }}
|
|
platforms: linux/amd64
|
|
cache-from: type=gha,scope=worker
|
|
cache-to: type=gha,mode=max,scope=worker
|
|
|
|
- name: Create releases-manager app token
|
|
id: app-token
|
|
if: steps.check.outputs.skip != 'true'
|
|
continue-on-error: true
|
|
uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
|
|
with:
|
|
app-id: ${{ secrets.GH_RELEASES_MANAGER_APP_ID }}
|
|
private-key: ${{ secrets.GH_RELEASES_MANAGER_APP_PRIVATE_KEY }}
|
|
owner: nearai
|
|
repositories: ironclaw-dind
|
|
|
|
- name: Trigger ironclaw-dind Build & Push
|
|
if: steps.app-token.outcome == 'success' && steps.check.outputs.skip != 'true'
|
|
continue-on-error: true
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
EVENT_NAME: ${{ github.event_name }}
|
|
INPUT_TAG: ${{ inputs.tag }}
|
|
VERSION: ${{ steps.version.outputs.version }}
|
|
run: |
|
|
if [[ "${EVENT_NAME}" == "workflow_call" && -n "${VERSION}" ]]; then
|
|
gh api repos/nearai/ironclaw-dind/dispatches \
|
|
--method POST \
|
|
-f event_type="ironclaw_image_published" \
|
|
-f client_payload[version]="${VERSION}"
|
|
elif [[ "${EVENT_NAME}" == "schedule" ]] || [[ "${INPUT_TAG}" == "staging" ]]; then
|
|
gh api repos/nearai/ironclaw-dind/dispatches \
|
|
--method POST \
|
|
-f event_type="ironclaw_image_published"
|
|
fi
|
|
|
|
- name: Summary
|
|
if: steps.check.outputs.skip != 'true'
|
|
run: |
|
|
{
|
|
echo "## Docker Images"
|
|
echo ""
|
|
echo "**ironclaw:**"
|
|
echo '```'
|
|
echo "${{ steps.tags.outputs.tags }}" | tr ',' '\n'
|
|
echo '```'
|
|
echo ""
|
|
echo "**ironclaw-worker:**"
|
|
echo '```'
|
|
echo "${{ steps.tags.outputs.worker_tags }}" | tr ',' '\n'
|
|
echo '```'
|
|
echo ""
|
|
echo "- version: \`${{ steps.version.outputs.version }}\`"
|
|
echo "- sha: \`${{ steps.source_sha.outputs.sha }}\`"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
- name: Summary (skipped)
|
|
if: steps.check.outputs.skip == 'true'
|
|
run: |
|
|
{
|
|
echo "## Docker Images — skipped"
|
|
echo ""
|
|
echo "Current commit already built for \`${IMAGE_NAME}:staging\`."
|
|
echo "- sha: \`${{ steps.source_sha.outputs.sha }}\`"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|