fromsource_ci.yml

# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception

name: Publish Beman From-Source Built Containers

on:
  push:
    branches:
      - main
    paths:
      - "Dockerfile.fromsource"
      - ".github/workflows/fromsource_ci.yml"
  pull_request:
    paths:
      - "Dockerfile.fromsource"
      - ".github/workflows/fromsource_ci.yml"
  workflow_dispatch:
  schedule:
    - cron: '0 6 * * 4'

env:
  REGISTRY: ghcr.io
  DEBUG_NAME: ${{ github.repository }}-staging
  DEPLOY_NAME_PREFIX: ${{ github.repository }}

permissions:
  packages: write

jobs:
  build-amd64:
    runs-on: ubuntu-latest
    env:
      BASE_IMAGE: gentoo/stage3:amd64-nomultilib-openrc
    strategy:
      fail-fast: false
      matrix:
        compilers:
          - kind: clang
            compiler-version: 24.0.0_pre20260929
            tags: [trunk]
          - kind: clang
            compiler-version: 23.1.3
            tags: [23.1.3, 23, latest]
          - kind: gcc
            compiler-version: 17.0.9999
            tags: [trunk]
          - kind: gcc
            compiler-version: 14.4.0
            tags: [14.4.0, 14]
    name: "${{ matrix.compilers.kind }}-${{ matrix.compilers.compiler-version }} (amd64)"
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Build and push (staging)
        if: github.ref != 'refs/heads/main'
        uses: docker/build-push-action@v6
        with:
          build-args: |
            BASE_IMAGE=${{ env.BASE_IMAGE }}
            compiler_kind=${{ matrix.compilers.kind }}
            compiler_version=${{ matrix.compilers.compiler-version }}
          file: Dockerfile.fromsource
          platforms: linux/amd64
          push: true
          tags: ${{ env.REGISTRY }}/${{ env.DEBUG_NAME }}:${{ matrix.compilers.kind }}-${{ matrix.compilers.compiler-version }}-${{ github.run_id }}-amd64
          # https://github.com/docker/build-push-action/issues/894
          provenance: false
      - name: Build and push by digest (deploy)
        if: github.ref == 'refs/heads/main'
        id: build
        uses: docker/build-push-action@v6
        with:
          build-args: |
            BASE_IMAGE=${{ env.BASE_IMAGE }}
            compiler_kind=${{ matrix.compilers.kind }}
            compiler_version=${{ matrix.compilers.compiler-version }}
          file: Dockerfile.fromsource
          platforms: linux/amd64
          outputs: type=image,name=${{ env.REGISTRY }}/${{ env.DEPLOY_NAME_PREFIX }}-${{ matrix.compilers.kind }},push-by-digest=true,name-canonical=true,push=true
          # https://github.com/docker/build-push-action/issues/894
          provenance: false
      - name: Export digest
        if: github.ref == 'refs/heads/main'
        run: echo "${{ steps.build.outputs.digest }}" > /tmp/digest.txt
      - name: Upload digest artifact
        if: github.ref == 'refs/heads/main'
        uses: actions/upload-artifact@v4
        with:
          name: digest-${{ matrix.compilers.kind }}-${{ matrix.compilers.compiler-version }}-amd64
          path: /tmp/digest.txt
          retention-days: 1

  build-arm64:
    runs-on: ubuntu-24.04-arm
    env:
      BASE_IMAGE: gentoo/stage3:arm64-openrc
    strategy:
      fail-fast: false
      matrix:
        compilers:
          - kind: clang
            compiler-version: 23.1.3
            tags: [23.1.3, 23, latest]
          - kind: gcc
            compiler-version: 17.0.9999
            tags: [trunk]
          - kind: gcc
            compiler-version: 14.4.0
            tags: [14.4.0, 14]
    name: "${{ matrix.compilers.kind }}-${{ matrix.compilers.compiler-version }} (arm64)"
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Build and push (staging)
        if: github.ref != 'refs/heads/main'
        uses: docker/build-push-action@v6
        with:
          build-args: |
            BASE_IMAGE=${{ env.BASE_IMAGE }}
            compiler_kind=${{ matrix.compilers.kind }}
            compiler_version=${{ matrix.compilers.compiler-version }}
          file: Dockerfile.fromsource
          platforms: linux/arm64
          push: true
          tags: ${{ env.REGISTRY }}/${{ env.DEBUG_NAME }}:${{ matrix.compilers.kind }}-${{ matrix.compilers.compiler-version }}-${{ github.run_id }}-arm64
          # https://github.com/docker/build-push-action/issues/894
          provenance: false
      - name: Build and push by digest (deploy)
        if: github.ref == 'refs/heads/main'
        id: build
        uses: docker/build-push-action@v6
        with:
          build-args: |
            BASE_IMAGE=${{ env.BASE_IMAGE }}
            compiler_kind=${{ matrix.compilers.kind }}
            compiler_version=${{ matrix.compilers.compiler-version }}
          file: Dockerfile.fromsource
          platforms: linux/arm64
          outputs: type=image,name=${{ env.REGISTRY }}/${{ env.DEPLOY_NAME_PREFIX }}-${{ matrix.compilers.kind }},push-by-digest=true,name-canonical=true,push=true
          # https://github.com/docker/build-push-action/issues/894
          provenance: false
      - name: Export digest
        if: github.ref == 'refs/heads/main'
        run: echo "${{ steps.build.outputs.digest }}" > /tmp/digest.txt
      - name: Upload digest artifact
        if: github.ref == 'refs/heads/main'
        uses: actions/upload-artifact@v4
        with:
          name: digest-${{ matrix.compilers.kind }}-${{ matrix.compilers.compiler-version }}-arm64
          path: /tmp/digest.txt
          retention-days: 1

  merge:
    needs: [build-amd64, build-arm64]
    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        compilers:
          - kind: clang
            compiler-version: 24.0.0_pre20260929
            tags: [trunk]
          - kind: clang
            compiler-version: 23.1.3
            tags: [23.1.3, 23, latest]
          - kind: gcc
            compiler-version: 17.0.9999
            tags: [trunk]
          - kind: gcc
            compiler-version: 14.4.0
            tags: [14.4.0, 14]
    name: "merge-${{ matrix.compilers.kind }}-${{ matrix.compilers.compiler-version }}"
    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Download amd64 digest
        continue-on-error: true
        uses: actions/download-artifact@v4
        with:
          name: digest-${{ matrix.compilers.kind }}-${{ matrix.compilers.compiler-version }}-amd64
          path: /tmp/digests/amd64
      - name: Download arm64 digest
        continue-on-error: true
        uses: actions/download-artifact@v4
        with:
          name: digest-${{ matrix.compilers.kind }}-${{ matrix.compilers.compiler-version }}-arm64
          path: /tmp/digests/arm64
      - name: Create and push multi-arch manifest
        run: |
          image_name="${{ env.REGISTRY }}/${{ env.DEPLOY_NAME_PREFIX }}-${{ matrix.compilers.kind }}"

          tag_args=""
          first_tag=""
          for tag in ${{ join(matrix.compilers.tags, ' ') }} ; do
            tag_args+=" -t ${image_name}:${tag}"
            [ -z "${first_tag}" ] && first_tag="${tag}"
          done

          # Use this run's image for each arch that built. For an arch whose
          # build failed or was skipped, carry forward its image from the
          # currently published tag so it isn't dropped from the index.
          built=""
          digests=""
          for arch in amd64 arm64 ; do
            if [ -f /tmp/digests/${arch}/digest.txt ]; then
              digests+=" ${image_name}@$(cat /tmp/digests/${arch}/digest.txt)"
              built+=" ${arch}"
            else
              old_digest=$(docker manifest inspect "${image_name}:${first_tag}" 2>/dev/null \
                | jq -r --arg arch "${arch}" '.manifests[]? | select(.platform.architecture == $arch) | .digest' || true)
              [ -n "${old_digest}" ] && digests+=" ${image_name}@${old_digest}"
            fi
          done

          # Nothing new to publish; leave the existing tags untouched.
          if [ -z "${built}" ]; then
            echo "No successful builds for this compiler, skipping."
            exit 0
          fi

          docker buildx imagetools create \
            ${tag_args} \
            ${digests}