OpenShell/.github/workflows/publish.yml at c00ea7b41015a5febd71bdc8b41db9ea6be6033e · rossoctl/OpenShell · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
name: Publish Images

on:
  push:
    tags:
    - 'v*'
    branches:
    - main
    - mvp
    - mvp-v2
  workflow_dispatch:

# Deny all permissions at workflow level; each job declares only what it needs
permissions: {}

env:
  REGISTRY: ghcr.io

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    timeout-minutes: 90

    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6

      - uses: jdx/mise-action@v2

      - name: Add Rust targets
        run: |
          rustup target add x86_64-unknown-linux-gnu
          rustup target add aarch64-unknown-linux-gnu
          rustup target add x86_64-unknown-linux-musl
          rustup target add aarch64-unknown-linux-musl

      - name: Install cargo-zigbuild
        run: cargo install cargo-zigbuild

      - name: Cache Rust target and registry
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: publish-binaries

      - name: Cross-compile gateway for amd64 and arm64
        env:
          DOCKER_PLATFORM: linux/amd64,linux/arm64
        run: tasks/scripts/stage-prebuilt-binaries.sh gateway

      - name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a  # v4.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd  # v4.0.0

      - name: Log in to ghcr.io
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf  # v6.0.0
        continue-on-error: true
        with:
          images: ghcr.io/kagenti/openshell/gateway
          tags: |
            type=ref,event=tag
            type=sha,prefix={{branch}}-,enable=${{ github.ref_type != 'tag' }}
            type=raw,value=latest,enable=${{ (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/mvp' || github.ref == 'refs/heads/mvp-v2' }}

      - name: Wait before retry
        if: steps.meta.outcome == 'failure'
        run: |
          echo "Metadata extraction failed, retrying in 15s..."
          sleep 15

      - name: Retry Docker metadata
        id: meta_retry
        if: steps.meta.outcome == 'failure'
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf  # v6.0.0
        with:
          images: ghcr.io/kagenti/openshell/gateway
          tags: |
            type=ref,event=tag
            type=sha,prefix={{branch}}-,enable=${{ github.ref_type != 'tag' }}
            type=raw,value=latest,enable=${{ (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/mvp' || github.ref == 'refs/heads/mvp-v2' }}

      - name: Build and push gateway image
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f  # v7.1.0
        with:
          context: .
          file: deploy/docker/Dockerfile.gateway
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta_retry.outputs.tags || steps.meta.outputs.tags }}
          labels: ${{ steps.meta_retry.outputs.labels || steps.meta.outputs.labels }}
          cache-from: type=gha,scope=gateway
          cache-to: type=gha,scope=gateway,mode=max

  build-and-push-supervisor:
    runs-on: ubuntu-latest
    timeout-minutes: 90

    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6

      - uses: jdx/mise-action@v2

      - name: Add Rust targets
        run: |
          rustup target add x86_64-unknown-linux-gnu
          rustup target add aarch64-unknown-linux-gnu
          rustup target add x86_64-unknown-linux-musl
          rustup target add aarch64-unknown-linux-musl

      - name: Install cargo-zigbuild
        run: cargo install cargo-zigbuild

      - name: Cache Rust target and registry
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: publish-binaries

      - name: Cross-compile supervisor for amd64 and arm64
        env:
          DOCKER_PLATFORM: linux/amd64,linux/arm64
        run: tasks/scripts/stage-prebuilt-binaries.sh supervisor

      - name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a  # v4.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd  # v4.0.0

      - name: Log in to ghcr.io
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf  # v6.0.0
        continue-on-error: true
        with:
          images: ghcr.io/kagenti/openshell/supervisor
          tags: |
            type=ref,event=tag
            type=sha,prefix={{branch}}-,enable=${{ github.ref_type != 'tag' }}
            type=raw,value=latest,enable=${{ (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/mvp' || github.ref == 'refs/heads/mvp-v2' }}

      - name: Wait before retry
        if: steps.meta.outcome == 'failure'
        run: |
          echo "Metadata extraction failed, retrying in 15s..."
          sleep 15

      - name: Retry Docker metadata
        id: meta_retry
        if: steps.meta.outcome == 'failure'
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf  # v6.0.0
        with:
          images: ghcr.io/kagenti/openshell/supervisor
          tags: |
            type=ref,event=tag
            type=sha,prefix={{branch}}-,enable=${{ github.ref_type != 'tag' }}
            type=raw,value=latest,enable=${{ (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/mvp' || github.ref == 'refs/heads/mvp-v2' }}

      - name: Build and push supervisor image
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f  # v7.1.0
        with:
          context: .
          file: deploy/docker/Dockerfile.supervisor
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta_retry.outputs.tags || steps.meta.outputs.tags }}
          labels: ${{ steps.meta_retry.outputs.labels || steps.meta.outputs.labels }}
          cache-from: type=gha,scope=supervisor
          cache-to: type=gha,scope=supervisor,mode=max