custom-image.yaml

name: Build Custom Docker Image

on:
  workflow_dispatch:
    inputs:
      image:
        description: 'Image to build'
        required: false
        default: 'nativelink'
        type: choice
        options:
          - nativelink
          - nativelink-worker-init
          - nativelink-worker-lre-cc
      skip_signing:
        description: 'Skip cosign signing'
        required: false
        default: true
        type: boolean

  issue_comment:
    types: [created]

permissions:
  contents: read

jobs:
  check-trigger:
    runs-on: ubuntu-24.04
    permissions:
      issues: write
      pull-requests: write
    outputs:
      should_build: ${{ steps.check.outputs.should_build }}
      pr_sha: ${{ steps.check.outputs.pr_sha }}
      image: ${{ steps.check.outputs.image }}
      multi-arch: ${{ steps.check.outputs.multi-arch }}
      components: ${{ steps.check.outputs.components }}
    steps:
      - name: Checkout
        uses: >- # v6.0.2
          actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
      - name: Check trigger
        id: check
        uses: >- #v8.0.0
          actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
        with:
          script: |
            const fs = require('fs');
            const matrix = JSON.parse(fs.readFileSync('.github/images-matrix.json', 'utf8'));
            const validImages = matrix['include'].map((o) => o['image']);

            // Never fail the job over a courtesy comment (e.g. a read-only
            // token); the build is what matters.
            const tryComment = async (body) => {
              try {
                await github.rest.issues.createComment({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  issue_number: context.payload.issue.number,
                  body,
                });
              } catch (e) {
                core.warning(`Could not post comment: ${e.message}`);
              }
            };

            let image;
            let prSha;

            if (context.eventName === 'workflow_dispatch') {
              image = '${{ inputs.image }}';
              prSha = context.sha;
            } else if (context.eventName === 'issue_comment') {
              const body = context.payload.comment.body.trim();
              const isPR = !!context.payload.issue.pull_request;
              // Match /build-image or /build-image <image-name>
              const match = body.match(/^\/build-image(?:\s+(\S+))?/i);
              if (!isPR || !match) {
                core.setOutput('should_build', 'false');
                return;
              }
              image = match[1];
              if (!image || !validImages.includes(image)) {
                const hint = image
                  ? `Unknown image: \`${image}\``
                  : 'Specify an image to build.';
                await tryComment(
                  `${hint}\n\nValid options: ${validImages.map((i) => `\`${i}\``).join(', ')}`
                );
                core.setOutput('should_build', 'false');
                return;
              }
              const { data: pr } = await github.rest.pulls.get({
                owner: context.repo.owner,
                repo: context.repo.repo,
                pull_number: context.payload.issue.number,
              });
              prSha = pr.head.sha;
              try {
                await github.rest.reactions.createForIssueComment({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  comment_id: context.payload.comment.id,
                  content: 'rocket',
                });
              } catch (e) {
                core.warning(`Could not add reaction: ${e.message}`);
              }
            } else {
              core.setOutput('should_build', 'false');
              return;
            }

            const option = matrix['include'].find((o) => o['image'] === image);
            core.setOutput('should_build', 'true');
            core.setOutput('pr_sha', prSha);
            core.setOutput('image', image);
            core.setOutput('multi-arch', option?.['multi-arch'] ?? false);
            core.setOutput('components', option?.['components'] ?? '');

  build-image:
    name: Build and Push Image
    needs: check-trigger
    if: needs.check-trigger.outputs.should_build == 'true'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      issues: write
      pull-requests: write
    timeout-minutes: 45
    steps:
      - name: Checkout
        uses: >- # v6.0.2
          actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          ref: ${{ needs.check-trigger.outputs.pr_sha }}

      - name: Prepare Worker
        uses: ./.github/actions/prepare-nix
        with:
          nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}

      - id: version
        uses: ./.github/actions/generate-version

      - name: Upload image
        uses: ./.github/actions/test-and-upload-image
        with:
          testing: false
          image: ${{ needs.check-trigger.outputs.image }}
          multi-arch: ${{ needs.check-trigger.outputs.multi-arch }}
          components: ${{ needs.check-trigger.outputs.components }}
          tag: ${{ steps.version.outputs.version-string }}
          GHCR_USERNAME: ${{ vars.GHCR_PUBLISH_USER }}
          GHCR_PASSWORD: ${{ secrets.GHCR_PUBLISH_TOKEN }}
          force-push: true

      - name: Output image info
        run: |
          echo "### Published Image" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo "ghcr.io/${{ github.repository_owner }}/${{ needs.check-trigger.outputs.image }}:${{ steps.version.outputs.version-string }}" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY

      - name: Comment on PR
        if: github.event_name == 'issue_comment'
        uses: >- #v8.0.0
          actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
        env:
          IMAGE_REF: ghcr.io/${{ github.repository_owner }}/${{ needs.check-trigger.outputs.image }}:${{ steps.version.outputs.version-string }}
        with:
          script: |
            try {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.payload.issue.number,
                body: `Image built and pushed!\n\n\`\`\`\n${process.env.IMAGE_REF}\n\`\`\``,
              });
            } catch (e) {
              core.warning(`Could not post comment: ${e.message}`);
            }

      - name: Teardown Worker
        uses: ./.github/actions/end-nix
        if: always()
        with:
          nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}