Improve image publishing

elezar · elezar · commit 51195272ffa1 · 2025-07-03T13:27:58.000+02:00
Signed-off-by: Evan Lezar &lt;elezar@nvidia.com&gt;
diff --git a/.common-ci.yml b/.common-ci.yml
@@ -61,7 +61,6 @@ stages:
   variables:
     SAMPLE: vectorAdd
     LOWER_CASE_SAMPLE: vectoradd
-    PUSH_SAMPLE_ONLY_TAG: "false"
 
 .sample-nbody:
   variables:
@@ -73,39 +72,35 @@ stages:
   variables:
     SAMPLE: deviceQuery
     LOWER_CASE_SAMPLE: devicequery
-    PUSH_SAMPLE_ONLY_TAG: "true"
 
 .sample-simple-multi-gpu:
   variables:
     SAMPLE: simpleMultiGPU
     LOWER_CASE_SAMPLE: simplemultigpu
-    PUSH_SAMPLE_ONLY_TAG: "true"
 
 # Define the sample targets
 .sample-vulkan:
   variables:
     SAMPLE: vulkan
     LOWER_CASE_SAMPLE: vulkan
-    PUSH_SAMPLE_ONLY_TAG: "true"
 
 .sample-nvbandwidth:
   variables:
     SAMPLE: nvbandwidth
     LOWER_CASE_SAMPLE: nvbandwidth
-    PUSH_SAMPLE_ONLY_TAG: "true"
 
 # Make buildx available as a docker CLI plugin
 .buildx-setup:
   before_script:
-    -  export BUILDX_VERSION=v0.6.3
-    -  apk add --no-cache curl
-    -  mkdir -p ~/.docker/cli-plugins
-    -  curl -sSLo ~/.docker/cli-plugins/docker-buildx "https://github.com/docker/buildx/releases/download/${BUILDX_VERSION}/buildx-${BUILDX_VERSION}.linux-amd64"
-    -  chmod a+x ~/.docker/cli-plugins/docker-buildx
+    - export BUILDX_VERSION=v0.6.3
+    - apk add --no-cache curl
+    - mkdir -p ~/.docker/cli-plugins
+    - curl -sSLo ~/.docker/cli-plugins/docker-buildx "https://github.com/docker/buildx/releases/download/${BUILDX_VERSION}/buildx-${BUILDX_VERSION}.linux-amd64"
+    - chmod a+x ~/.docker/cli-plugins/docker-buildx
 
-    -  docker buildx create --use --platform=linux/amd64,linux/arm64
+    - docker buildx create --use --platform=linux/amd64,linux/arm64
 
-    -  '[[ -n "${SKIP_QEMU_SETUP}" ]] || docker run --rm --privileged multiarch/qemu-user-static --reset -p yes'
+    - '[[ -n "${SKIP_QEMU_SETUP}" ]] || docker run --rm --privileged multiarch/qemu-user-static --reset -p yes'
 
 # Download the regctl binary for use in the release steps
 .regctl-setup:
@@ -121,8 +116,7 @@ stages:
 # This is extended with the version to be deployed (e.g. the SHA or TAG) and the
 # target os.
 .release:
-  stage:
-    release
+  stage: release
   variables:
     # Define the source image for the release
     IMAGE_NAME: "${CI_REGISTRY_IMAGE}/cuda-samples"
diff --git a/.nvidia-ci.yml b/.nvidia-ci.yml
@@ -13,7 +13,7 @@
 # limitations under the License.
 
 include:
-  - local: '.common-ci.yml'
+  - local: ".common-ci.yml"
 
 default:
   tags:
@@ -47,7 +47,6 @@ variables:
     OUT_REGISTRY: "${CI_REGISTRY}"
     OUT_IMAGE_NAME: ${CI_REGISTRY_IMAGE}/cuda-samples
     OUT_VERSION: ${LOWER_CASE_SAMPLE}-${CI_COMMIT_SHORT_SHA}
-    PUSH_MULTIPLE_TAGS: "false"
   # We delay the job start to allow the public pipeline to generate the required images.
   when: delayed
   start_in: 30 minutes
@@ -64,7 +63,8 @@ variables:
       regctl manifest get ${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST} --list > /dev/null && echo "${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST}" || ( echo "${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST} does not exist" && sleep infinity )
   script:
     - regctl registry login "${OUT_REGISTRY}" -u "${OUT_REGISTRY_USER}" -p "${OUT_REGISTRY_TOKEN}"
-    - make -f deployments/container/Makefile IMAGE=${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST} OUT_IMAGE=${OUT_IMAGE_NAME}:${OUT_VERSION}-${DIST} push-${DIST}
+    # We use the publish-images.sh script to pull the images from IN_REGISTRY into the CI_REGISTRY.
+    - ./hack/publish-images.sh ${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST} ${OUT_IMAGE_NAME}:${OUT_VERSION}-${DIST}
 
 image-vectoradd-ubuntu22.04:
   extends:
diff --git a/deployments/container/Makefile b/deployments/container/Makefile
@@ -21,8 +21,7 @@ include $(CURDIR)/versions.mk
 
 # The Makefile describes the build process for a single CUDA sample: e.g. `vectorAdd`
 ifeq ($(SAMPLE),)
-# Use vectorAdd as the default sample
-	SAMPLE := vectorAdd
+$(error "SAMPLE is unset")
 endif
 LOWER_CASE_SAMPLE := $(shell echo $(SAMPLE) | tr '[:upper:]' '[:lower:]')
 
@@ -76,24 +75,11 @@ include $(CURDIR)/deployments/container/multi-arch.mk
 endif
 
 push-%: DIST = $(*)
-push-short: DIST = $(DEFAULT_PUSH_TARGET)
-push-sample: DIST = $(DEFAULT_PUSH_TARGET)
-
-# For the default push target we also push a short tag equal to the version.
-# We skip this for the development release
-DEVEL_RELEASE_IMAGE_VERSION ?= devel
-PUSH_MULTIPLE_TAGS ?= true
-PUSH_SAMPLE_ONLY_TAG ?= false
-ifeq ($(strip $(OUT_IMAGE_VERSION)),$(DEVEL_RELEASE_IMAGE_VERSION))
-PUSH_MULTIPLE_TAGS = false
-endif
-ifeq ($(PUSH_MULTIPLE_TAGS),true)
-push-$(DEFAULT_PUSH_TARGET): push-short
-# If required we retag and push the image tagged only with the sample name
-ifeq ($(PUSH_SAMPLE_ONLY_TAG),true)
-push-$(DEFAULT_PUSH_TARGET): push-sample
-endif
-endif
+
+# For the default push target we also push a short tag equal to the sample and version.
+SHORT_IMAGE_TAG = $(LOWER_CASE_SAMPLE)-$(OUT_IMAGE_VERSION)
+SAMPLE_ONLY_IMAGE_TAG = $(LOWER_CASE_SAMPLE)
+push-$(DEFAULT_PUSH_TARGET): OUT_IMAGE_ALIASES = $(patsubst %,$(OUT_IMAGE_NAME):%,$(SHORT_IMAGE_TAG) $(SAMPLE_ONLY_IMAGE_TAG))
 
 build-%: DIST = $(*)
 # For the following samples, we use specific Dockerfiles:
@@ -120,19 +106,11 @@ $(IMAGE_TARGETS): image-%:
 		-f $(DOCKERFILE) \
 		$(CURDIR)
 
-# Handle the default build target.
-.PHONY: build
-build: $(DEFAULT_PUSH_TARGET)
-$(DEFAULT_PUSH_TARGET): build-$(DEFAULT_PUSH_TARGET)
-$(DEFAULT_PUSH_TARGET): DIST = $(DEFAULT_PUSH_TARGET)
-
-REGCTL ?= regctl
-$(PUSH_TARGETS): push-%:
-	$(REGCTL) \
-	        image copy \
-	        $(IMAGE) $(OUT_IMAGE)
-
-push-short:
-	$(REGCTL) \
-	        image copy \
-	        $(IMAGE) $(OUT_IMAGE_NAME):$(OUT_IMAGE_VERSION)
+
+# If PUSH_ON_BUILD is set
+ifeq ($(PUSH_ON_BUILD),true)
+$(BUILD_TARGETS): build-%: image-%
+	$(CURDIR)/hack/publish-images.sh $(IMAGE) $(OUT_IMAGE) $(OUT_IMAGE_ALIASES)
+else
+$(BUILD_TARGETS): build-%: image-%
+endif
diff --git a/deployments/container/multi-arch.mk b/deployments/container/multi-arch.mk
@@ -16,4 +16,8 @@ PUSH_ON_BUILD ?= false
 DOCKER_BUILD_OPTIONS = --output=type=image,push=$(PUSH_ON_BUILD)
 DOCKER_BUILD_PLATFORM_OPTIONS = --platform=linux/amd64,linux/arm64
 
-$(BUILD_TARGETS): build-%: image-%
+# If we're using --putput=type=image,push=true we need
+# to skip the first image in the list of images passed to either
+# publish-images.sh script.
+# TODO: Is there a more "stable" way to handle this.
+SKIP_FIRST_IMAGE_ON_PUBLISH = $(PUSH_ON_BUILD)
diff --git a/deployments/container/native-only.mk b/deployments/container/native-only.mk
@@ -15,18 +15,3 @@
 PUSH_ON_BUILD ?= false
 ARCH ?= $(shell uname -m)
 DOCKER_BUILD_PLATFORM_OPTIONS = --platform=linux/$(ARCH)
-
-ifeq ($(PUSH_ON_BUILD),true)
-$(BUILD_TARGETS): build-%: image-%
-	$(DOCKER) push "$(IMAGE)"
-else
-$(BUILD_TARGETS): build-%: image-%
-endif
-
-# For the default distribution we also retag the image.
-# Note: This needs to be updated for multi-arch images.
-ifeq ($(IMAGE_TAG),$(VERSION)-$(DIST))
-$(DEFAULT_PUSH_TARGET):
-	$(DOCKER) image inspect $(IMAGE) > /dev/null || $(DOCKER) pull $(IMAGE)
-	$(DOCKER) tag $(IMAGE) $(subst :$(IMAGE_TAG),:$(VERSION),$(IMAGE))
-endif
diff --git a/hack/publish-images.sh b/hack/publish-images.sh
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+
+# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This script is used to publish images to a registry. It checks whether the image
+# already exists in the registry and skips publishing if it does. This can be overridden
+# using the FORCE_PUBLISH_IMAGES environment variable.
+
+set -ex
+
+: ${DOCKER=docker}
+: ${REGCTL=regctl}
+
+# publish_docker uses docker to publish an image.
+# In this case, the image is first retagged (if required) and then pushed.
+function publish_docker() {
+    if [[ "${1}" != "${2}" ]]; then
+        ${DOCKER} tag ${1} ${2}
+    fi
+    ${DOCKER} push ${2}
+}
+
+# publish_regctl uses regctl to copy an image from one registry to another.
+# If the two images are the same, this is a no-op.
+function publish_regctl() {
+    if [[ "${1}" != "${2}" ]]; then
+        ${REGCTL} image copy ${1} ${2}
+    fi
+}
+
+function publish() {
+    if [[ $(command -v ${REGCTL}) || x"${BUILD_MULTI_ARCH_IMAGES}" == x"true" ]]; then
+        publish_regctl $@
+    else
+        publish_docker $@
+    fi
+}
+
+INPUT_IMAGE=$1
+shift
+if [[ x"${SKIP_FIRST_IMAGE_ON_PUBLISH}" == x"true" ]]; then
+    shift
+fi
+
+for OUTPUT_IMAGE in "${@}"; do
+    echo "Publishing ${INPUT_IMAGE} as ${OUTPUT_IMAGE}"
+    publish ${INPUT_IMAGE} ${OUTPUT_IMAGE}
+done
