fix: enforce workspace memory limit during extraction (#6149) #1777
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This GitHub action is for publishing of the primary image for AnythingLLM | |
| # It will publish a linux/amd64 and linux/arm64 image at the same time | |
| # This file should ONLY BY USED FOR `master` BRANCH. | |
| # TODO: GitHub now has an ubuntu-24.04-arm64 runner, but we still need | |
| # to use QEMU to build the arm64 image because Chromium is not available for Linux arm64 | |
| # so builds will still fail, or fail much more often. Its inconsistent and frustrating. | |
| name: Publish AnythingLLM Primary Docker image (amd64/arm64) | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| on: | |
| push: | |
| branches: ['master'] # master branch only. Do not modify. | |
| paths-ignore: | |
| - '**.md' | |
| - '.gitmodules' | |
| - 'cloud-deployments/**/*' | |
| - 'images/**/*' | |
| - '.vscode/**/*' | |
| - '**/.env.example' | |
| - '.github/ISSUE_TEMPLATE/**/*' | |
| - '.devcontainer/**/*' | |
| - 'embed/**/*' # Embed is submodule | |
| - 'browser-extension/**/*' # Chrome extension is submodule | |
| - 'server/utils/agents/aibitat/example/**/*' # Do not push new image for local dev testing of new aibitat images. | |
| - 'extras/**/*' # Extra is just for news and other local content. | |
| - 'open-computer/**/*' | |
| jobs: | |
| push_multi_platform_to_registries: | |
| name: Push Docker multi-platform image to multiple registries | |
| runs-on: ubuntu-22.04-arm | |
| permissions: | |
| packages: write | |
| contents: read | |
| steps: | |
| - name: Check out the repo | |
| uses: actions/checkout@v4 | |
| - name: Check if DockerHub build needed | |
| shell: bash | |
| run: | | |
| # Check if the secret for USERNAME is set (don't even check for the password) | |
| if [[ -z "${{ secrets.DOCKER_USERNAME }}" ]]; then | |
| echo "DockerHub build not needed" | |
| echo "enabled=false" >> $GITHUB_OUTPUT | |
| else | |
| echo "DockerHub build needed" | |
| echo "enabled=true" >> $GITHUB_OUTPUT | |
| fi | |
| id: dockerhub | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| with: | |
| version: v0.22.0 | |
| - name: Log in to Docker Hub | |
| uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a | |
| # Only login to the Docker Hub if the repo is mintplex/anythingllm, to allow for forks to build on GHCR | |
| if: steps.dockerhub.outputs.enabled == 'true' | |
| with: | |
| username: ${{ secrets.DOCKER_USERNAME }} | |
| password: ${{ secrets.DOCKER_PASSWORD }} | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7 | |
| with: | |
| images: | | |
| ${{ steps.dockerhub.outputs.enabled == 'true' && 'mintplexlabs/anythingllm' || '' }} | |
| ghcr.io/${{ github.repository }} | |
| tags: | | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| type=ref,event=branch | |
| type=ref,event=tag | |
| type=ref,event=pr | |
| - name: Build and push multi-platform Docker image | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: ./docker/Dockerfile | |
| push: true | |
| sbom: true | |
| provenance: mode=max | |
| platforms: linux/amd64,linux/arm64 | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| # VEX attestations are currently broken with docker scout when attaching | |
| # multiple attestations to multi-platform images. The second attachment | |
| # fails with "mismatched fs layers and diff ids". | |
| # TODO: Re-enable when docker/scout-cli fixes this upstream. | |
| # See: https://docs.docker.com/scout/explore/exceptions/ | |
| # - name: Collect known and verified CVE exceptions | |
| # - name: Add VEX attestations |