Nightly SST Container Build #14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Nightly SST Container Build | |
| on: | |
| schedule: | |
| - cron: '0 10 * * *' # Daily at 10AM UTC (2 AM Pacific Standard Time (PST), 3 AM Pacific Daylight Time (PDT)) | |
| workflow_dispatch: # Manual trigger for testing | |
| inputs: | |
| force_build: | |
| description: 'Force build even if no updates detected' | |
| required: false | |
| default: false | |
| type: boolean | |
| mpich_version: | |
| description: 'MPICH version to use' | |
| required: false | |
| default: '4.0.2' | |
| type: string | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository_owner }}/sst-core | |
| DOCKERFILE: sst-containers/Containerfile.tag | |
| SST_REPO: https://github.com/sstsimulator/sst-core.git | |
| SST_BRANCH: master | |
| BUILD_NCPUS: 2 | |
| MAX_IMAGE_SIZE: 2147483648 # 2GB in bytes | |
| TAG_PREFIX: master | |
| # inputs context is only available for workflow_dispatch, not scheduled runs | |
| # The fallback '4.0.2' ensures scheduled runs have a default value | |
| # See: https://docs.github.com/en/actions/learn-github-actions/contexts#inputs-context | |
| MPICH_VERSION: ${{ inputs.mpich_version || '4.0.2' }} | |
| jobs: | |
| check-updates: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: read | |
| outputs: | |
| build_needed: ${{ steps.check.outputs.build_needed }} | |
| current_sha: ${{ steps.check.outputs.current_sha }} | |
| short_sha: ${{ steps.check.outputs.short_sha }} | |
| steps: | |
| - name: Check for SST-core branch updates | |
| id: check | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| # Get current commit SHA from SST-core master branch | |
| CURRENT_SHA=$(gh api /repos/sstsimulator/sst-core/branches/${{ env.SST_BRANCH }} --jq '.commit.sha') | |
| SHORT_SHA=${CURRENT_SHA:0:7} | |
| echo "Current SST-core ${{ env.SST_BRANCH }} SHA: $CURRENT_SHA" | |
| echo "Short SHA: $SHORT_SHA" | |
| # Create our tag as master-{short_sha} | |
| TARGET_TAG="${{ env.TAG_PREFIX }}-${SHORT_SHA}" | |
| echo "Checking for existing tag: $TARGET_TAG" | |
| # List all package versions and check if our tag exists | |
| EXISTING_TAG=$(gh api "/orgs/${{ github.repository_owner }}/packages/container/sst-core/versions" \ | |
| --jq ".[] | select(.metadata.container.tags[]? == \"$TARGET_TAG\") | .metadata.container.tags[]" \ | |
| 2>/dev/null | grep -x "$TARGET_TAG" || echo "") | |
| if [ -n "$EXISTING_TAG" ]; then | |
| echo "::notice::Image with tag $TARGET_TAG already exists, skipping build" | |
| BUILD_NEEDED="false" | |
| else | |
| echo "::notice::No image found with tag $TARGET_TAG, build needed" | |
| BUILD_NEEDED="true" | |
| fi | |
| # Handle force_build override (only if explicitly set) | |
| FORCE_BUILD="${{ inputs.force_build }}" | |
| if [ "$FORCE_BUILD" = "true" ]; then | |
| BUILD_NEEDED="true" | |
| echo "::notice::Build forced by force_build=true parameter" | |
| fi | |
| # Set outputs | |
| echo "build_needed=$BUILD_NEEDED" >> $GITHUB_OUTPUT | |
| echo "current_sha=$CURRENT_SHA" >> $GITHUB_OUTPUT | |
| echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT | |
| build-container: | |
| needs: check-updates | |
| if: needs.check-updates.outputs.build_needed == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Cache MPICH tarball | |
| id: cache-mpich | |
| uses: actions/cache@v4 | |
| with: | |
| path: sst-containers/mpich-${{ env.MPICH_VERSION }}.tar.gz | |
| key: mpich-${{ env.MPICH_VERSION }} | |
| - name: Download MPICH source | |
| if: steps.cache-mpich.outputs.cache-hit != 'true' | |
| working-directory: ./sst-containers | |
| run: | | |
| echo "Downloading MPICH ${{ env.MPICH_VERSION }}..." | |
| wget https://www.mpich.org/static/downloads/${{ env.MPICH_VERSION }}/mpich-${{ env.MPICH_VERSION }}.tar.gz | |
| - name: Verify MPICH tarball | |
| working-directory: ./sst-containers | |
| run: | | |
| if [ -f "mpich-${{ env.MPICH_VERSION }}.tar.gz" ]; then | |
| echo "MPICH tarball present (from ${{ steps.cache-mpich.outputs.cache-hit == 'true' && 'cache' || 'download' }})" | |
| ls -lh mpich-${{ env.MPICH_VERSION }}.tar.gz | |
| else | |
| echo "ERROR: MPICH tarball not found" | |
| exit 1 | |
| fi | |
| - name: Log in to Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Extract metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=raw,value=${{ env.TAG_PREFIX }}-${{ needs.check-updates.outputs.short_sha }} | |
| type=raw,value=${{ env.TAG_PREFIX }}-latest | |
| labels: | | |
| org.opencontainers.image.source=${{ env.SST_REPO }} | |
| org.opencontainers.image.revision=${{ needs.check-updates.outputs.current_sha }} | |
| org.opencontainers.image.created=${{ github.event.repository.updated_at }} | |
| - name: Build and push container image | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: ./sst-containers | |
| file: ${{ env.DOCKERFILE }} | |
| target: core-build | |
| push: true | |
| platforms: linux/amd64 | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| build-args: | | |
| SSTrepo=${{ env.SST_REPO }} | |
| tag=${{ needs.check-updates.outputs.current_sha }} | |
| NCPUS=${{ env.BUILD_NCPUS }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| validate-container: | |
| needs: [check-updates, build-container] | |
| if: needs.check-updates.outputs.build_needed == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Log in to Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Pull and validate container | |
| run: | | |
| # Pull the newly built image | |
| docker pull --platform linux/amd64 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.TAG_PREFIX }}-${{ needs.check-updates.outputs.short_sha }} | |
| # Run basic validation | |
| echo "Testing SST installation..." | |
| docker run --rm --platform linux/amd64 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.TAG_PREFIX }}-${{ needs.check-updates.outputs.short_sha }} \ | |
| -c "which sst && sst --version" | |
| # Verify image size is reasonable (less than 2GB) | |
| IMAGE_SIZE=$(docker image inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.TAG_PREFIX }}-${{ needs.check-updates.outputs.short_sha }} --format='{{.Size}}') | |
| MAX_SIZE=${{ env.MAX_IMAGE_SIZE }} | |
| if [ $IMAGE_SIZE -gt $MAX_SIZE ]; then | |
| echo "ERROR: Image size ($IMAGE_SIZE bytes) exceeds maximum expected size ($MAX_SIZE bytes)" | |
| exit 1 | |
| else | |
| echo "Image size validation passed: $IMAGE_SIZE bytes" | |
| fi | |
| - name: Container validation summary | |
| run: | | |
| echo "Container validation completed successfully" | |
| echo "Image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.TAG_PREFIX }}-${{ needs.check-updates.outputs.short_sha }}" | |
| echo "Also tagged as: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.TAG_PREFIX }}-latest" | |
| echo "Built from SST-core commit: ${{ needs.check-updates.outputs.current_sha }}" | |
| echo "" | |
| echo "The SST-core SHA is stored in the container image label: org.opencontainers.image.revision" | |
| echo "Future builds will check the tag (short SHA) to determine if a rebuild is needed" |