build_package_sources.yml

# ============================================================================ #
# Copyright (c) 2022 - 2026 NVIDIA Corporation & Affiliates.                   #
# All rights reserved.                                                         #
#                                                                              #
# This source code and the accompanying materials are made available under     #
# the terms of the Apache License 2.0 which accompanies this distribution.     #
# ============================================================================ #
#
# Workflow: diff apt and pip packages between a base and target image, then
# build a source image containing source code for all added packages.
#
# Inputs:
#   push_to_NGC: boolean, default false
#     Push the built source image to NGC, otherwise push to GHCR.
#   environment: string, no default
#     The environment to build the source image for.

on:
  push:
  workflow_dispatch:
    inputs:
      push_to_NGC:
        required: false
        type: boolean
        default: false
        description: 'Push the built source image to NGC, otherwise push to GHCR.'
      environment:
        required: false
        type: string

name: Build package sources

jobs:
  diff-packages:
    name: Diff apt/pip packages (CUDA ${{ matrix.cuda }})
    runs-on: ubuntu-latest
    outputs:
      base_image: ${{ steps.images.outputs.base_image }}
    strategy:
      fail-fast: false
      matrix:
        cuda: ['12.6', '13.0']
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Set image names
        id: images
        run: |
          echo "base_image=nvcr.io/nvidia/cuda:${{ matrix.cuda }}.0-runtime-ubuntu24.04" >> $GITHUB_OUTPUT
          cuda_major=$(echo "${{ matrix.cuda }}" | cut -d. -f1)
          echo "target_image=nvcr.io/nvidia/nightly/cuda-quantum:cu${cuda_major}-latest" >> $GITHUB_OUTPUT

      - name: Log in to container registries
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin 2>/dev/null || true
          echo "${{ secrets.DOCKERHUB_READONLY_TOKEN }}" | docker login -u ${{ secrets.DOCKERHUB_USERNAME }} --password-stdin 2>/dev/null || true

      - name: Pull images
        run: |
          docker pull "${{ steps.images.outputs.base_image }}"
          docker pull "${{ steps.images.outputs.target_image }}"

      - name: Diff package lists
        run: |
          chmod +x scripts/diff_image_packages.sh
          ./scripts/diff_image_packages.sh \
            "${{ steps.images.outputs.base_image }}" \
            "${{ steps.images.outputs.target_image }}" \
            package-source-diff

      - name: Upload package lists
        uses: actions/upload-artifact@v4
        with:
          name: package-source-diff-cu${{ matrix.cuda }}.zip
          path: package-source-diff/
          retention-days: 1

  build-source-image:
    name: Build source image (CUDA ${{ matrix.cuda }})
    needs: diff-packages
    runs-on: linux-amd64-cpu32
    strategy:
      fail-fast: false
      matrix:
        cuda: ['12.6', '13.0']
    permissions:
      contents: read
      packages: write

    environment:
      name: ${{ inputs.environment || 'default' }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          persist-credentials: false
          submodules: recursive

      - name: Download package lists
        uses: actions/download-artifact@v4
        with:
          name: package-source-diff-cu${{ matrix.cuda }}.zip

      - name: Restore package-source-diff directory layout
        run: |
          # Ensure package-source-diff/ exists with list files for Dockerfile COPY
          if [ ! -f package-source-diff/apt_packages.txt ]; then
            mkdir -p package-source-diff
            mv apt_packages.txt pip_packages.txt package-source-diff/ 2>/dev/null || true
          fi
          touch package-source-diff/apt_packages.txt package-source-diff/pip_packages.txt
          ls -la package-source-diff/

      - name: Generate tpls lock file
        run: |
          chmod +x scripts/generate_tpls_lock.sh
          ./scripts/generate_tpls_lock.sh tpls_commits.lock
          cat tpls_commits.lock
          wc -l tpls_commits.lock || true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build source image
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/build/package_sources.Dockerfile
          build-args: |
            base_image=${{ needs.diff-packages.outputs.base_image }}
          load: true
          tags: package-sources:latest
          outputs: type=docker,dest=/tmp/package-sources.tar
          push: false

      - name: Log in to GitHub CR
        if: github.event.inputs.push_to_NGC != 'true'
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Log in to NGC
        if: github.event.inputs.push_to_NGC == 'true'
        uses: docker/login-action@v3
        with:
          registry: nvcr.io
          username: '$oauthtoken'
          password: ${{ secrets.NGC_CREDENTIALS }}

      - name: Tag and push to GHCR or NGC
        id: push
        run: |
          docker load --input /tmp/package-sources.tar
          cuda_major=$(echo "${{ matrix.cuda }}" | cut -d. -f1)
          target_image="nvcr.io/nvidia/nightly/cuda-quantum:cu${cuda_major}-latest"
          tag_suffix="${target_image##*:}"
          if [ "${{ github.event.inputs.push_to_NGC }}" = "true" ]; then
            # Derive push destination from target_image: .../cuda-quantum:tag -> .../cuda-quantum-src:tag
            repo_part="${target_image%:*}"
            tag="${repo_part}-src:${tag_suffix}"
          else
            owner_lower=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
            tag="ghcr.io/${owner_lower}/cuda-quantum-src:${tag_suffix}"
          fi
          docker tag package-sources:latest "$tag"
          docker push "$tag"
          echo "image_tag=$tag" | tee -a $GITHUB_OUTPUT

      - name: Summary
        run: |
          base_image="${{ needs.diff-packages.outputs.base_image }}"
          cuda_major=$(echo "${{ matrix.cuda }}" | cut -d. -f1); target_image="nvcr.io/nvidia/nightly/cuda-quantum:cu${cuda_major}-latest"
          echo "## Package source diff (CUDA ${{ matrix.cuda }})" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "- **Base image:** \`${base_image}\`" >> $GITHUB_STEP_SUMMARY
          echo "- **Target image:** \`${target_image}\`" >> $GITHUB_STEP_SUMMARY
          echo "- **Apt packages added:** $(wc -l < package-source-diff/apt_packages.txt 2>/dev/null || echo 0)" >> $GITHUB_STEP_SUMMARY
          echo "- **Pip packages added:** $(wc -l < package-source-diff/pip_packages.txt 2>/dev/null || echo 0)" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Built image \`package-sources:latest\` (ubuntu:24.04 with sources under \`/sources/apt\`, \`/sources/pip\`, and \`/sources/tpls\`)." >> $GITHUB_STEP_SUMMARY
          if [ -n "${{ steps.push.outputs.image_tag }}" ]; then
            echo "- **Pushed:** \`${{ steps.push.outputs.image_tag }}\`" >> $GITHUB_STEP_SUMMARY
          fi