wehub-resource-sync
c3749daf48
Tests / test-linux (3.13) (push) Failing after 0s
Tests / test-linux (3.11) (push) Failing after 1s
Tests / lint (push) Failing after 0s
Tests / test-linux (3.9) (push) Failing after 1s
Docker / build (push) Failing after 1s
Docker / build-gpu (push) Failing after 2s
Tests / test-windows (push) Has been cancelled
Tests / test-macos (push) Has been cancelled
96 lines
3.3 KiB
YAML
96 lines
3.3 KiB
YAML
name: Docker
|
|
|
|
on:
|
|
push:
|
|
# `main` is the release branch: pushes here publish the released image and
|
|
# update `latest`; `v*` tags publish versioned images. develop does not
|
|
# publish — it is validated via the pull_request trigger below.
|
|
branches: [main]
|
|
tags: ["v*"]
|
|
pull_request:
|
|
branches: [main, develop]
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
REGISTRY: ghcr.io
|
|
IMAGE_NAME: ${{ github.repository }}
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
# Needed for the emulated linux/arm64 build on real pushes.
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v4
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v4
|
|
|
|
# Only authenticate + push for in-repo events. Fork PRs lack the
|
|
# packages:write token, so they build (to validate the Dockerfile) but
|
|
# do not push.
|
|
- name: Log in to GHCR
|
|
if: github.event_name != 'pull_request'
|
|
uses: docker/login-action@v4
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Extract metadata
|
|
id: meta
|
|
uses: docker/metadata-action@v6
|
|
with:
|
|
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
|
# latest -> main (the latest release); semver tags -> released versions.
|
|
tags: |
|
|
type=ref,event=branch
|
|
type=ref,event=pr
|
|
type=semver,pattern={{version}}
|
|
type=semver,pattern={{major}}.{{minor}}
|
|
type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
|
|
|
|
- name: Build and push
|
|
uses: docker/build-push-action@v7
|
|
with:
|
|
context: .
|
|
file: ./Dockerfile
|
|
# Publish multi-arch (amd64 + arm64 for Apple Silicon / ARM hosts) on
|
|
# real pushes; keep PRs amd64-only so the emulated arm64 build does not
|
|
# slow the PR check.
|
|
platforms: ${{ github.event_name != 'pull_request' && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
|
|
push: ${{ github.event_name != 'pull_request' }}
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
cache-from: type=gha
|
|
# Fork PRs get a read-only Actions cache, so writing it just emits 403
|
|
# noise — only export cache on in-repo events.
|
|
cache-to: ${{ github.event_name != 'pull_request' && 'type=gha,mode=max' || '' }}
|
|
|
|
# Build-only validation for the CUDA image so it cannot silently rot (CUDA base
|
|
# tag drift, cross-stage interpreter/venv copy paths, the `gpu` extra). The
|
|
# runner has no GPU, so this only proves the image *compiles*; it is never
|
|
# published (users build it themselves, per the README).
|
|
build-gpu:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v4
|
|
|
|
- name: Build GPU image (validation only — not published)
|
|
uses: docker/build-push-action@v7
|
|
with:
|
|
context: .
|
|
file: ./Dockerfile.gpu
|
|
platforms: linux/amd64
|
|
push: false
|
|
cache-from: type=gha,scope=gpu
|
|
cache-to: ${{ github.event_name != 'pull_request' && 'type=gha,mode=max,scope=gpu' || '' }}
|