build.yml

name: Chroma Server Image

on:
  workflow_dispatch:
    inputs:
      chroma_version:
        description: 'Chroma version to use for the image'
        required: true
        default: '0.6.3'
      latest:
        description: 'Whether to use the latest tag'
        required: false
        default: 'false'

env:
  GHCR_REGISTRY: ghcr.io
  DOCKERHUB_REGISTRY: docker.io
  GHCR_IMAGE_NAME: ${{ github.repository }}/chroma
  DOCKERHUB_IMAGE_NAME: amikos/chroma
  AWS_REGION : "eu-west-1"
  PYTHON_ALPINE_BASE: "${{ vars.PYTHON_ALPINE_DIGEST }}"
  PYTHON_BOOKWORM_BASE: "${{ vars.PYTHON_BOOKWORM_DIGEST }}"

permissions:
    id-token: write   # This is required for requesting the JWT
    contents: read
    packages: write

jobs:

  build:
    name: ${{ matrix.base }} Chroma Server Image
    strategy:
      fail-fast: false
      matrix:
        base: ["bookworm", "alpine"]
    runs-on: ubuntu-24.04-arm
    
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Checkout Chroma repository
        uses: actions/checkout@v4
        with:
          repository: chroma-core/chroma
          path: chroma
          token: ${{ secrets.GITHUB_TOKEN }}
          submodules: recursive
          ref: ${{ inputs.chroma_version }}

      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::531530523245:role/github-oidc
          role-session-name: chroma-images-oidc
          aws-region: ${{ env.AWS_REGION }}

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3.8.0

      - name: Set Python Base Digest
        id: set-digest
        run: |
          if [ "${{ matrix.base }}" = "alpine" ]; then
            echo "PYTHON_BASE_DIGEST=${{ env.PYTHON_ALPINE_BASE }}" >> $GITHUB_ENV
          else
            echo "PYTHON_BASE_DIGEST=${{ env.PYTHON_BOOKWORM_BASE }}" >> $GITHUB_ENV
          fi
          # Debug output
          echo "Selected digest for ${{ matrix.base }}: ${{ env.PYTHON_BASE_DIGEST }}"

      - name: Configure
        run: |
          set -e
          cp common/log_config.yaml chroma/log_config.yaml
          cp common/docker_entrypoint.sh chroma/docker_entrypoint.sh
          rm -rf chroma/chromadb/utils/embedding_functions
          cp common/embedding_functions.py chroma/chromadb/utils/embedding_functions.py
          cp common/.dockerignore chroma/.dockerignore
          cp ${{ matrix.base }}/Dockerfile.${{ matrix.base }} chroma/Dockerfile

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            image=moby/buildkit:latest
          install: true

      - name: Cache Docker layers
        uses: actions/cache@v3
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-buildx-${{ matrix.base }}-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-buildx-${{ matrix.base }}-
            ${{ runner.os }}-buildx-

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_IMAGE_NAME }}
            ${{ env.DOCKERHUB_REGISTRY }}/${{ env.DOCKERHUB_IMAGE_NAME }}
          tags: |
            type=semver,pattern=${{ inputs.chroma_version }}-${{ matrix.base }}
            type=raw,value=${{ inputs.chroma_version }}-${{ matrix.base }}
            type=raw,value=latest-${{ matrix.base }},enable=${{ inputs.latest == 'true' }}
            type=raw,value=latest,enable=${{ inputs.latest == 'true' && matrix.base == 'bookworm' }}
            type=raw,value=sha-${{ matrix.base }},prefix=${{ github.sha }}

      - name: Build Docker image for testing
        uses: docker/build-push-action@v5
        with:
          context: ./chroma
          push: false
          load: true
          platforms: linux/arm64  # Specific for testing
          tags: local-test-image:${{ matrix.base }}
          build-args: |
            PYTHON_BASE_DIGEST=${{ env.PYTHON_BASE_DIGEST }}
          cache-from: type=local,src=/tmp/.buildx-cache
          cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max

      - name: Move cache
        run: |
          rm -rf /tmp/.buildx-cache
          mv /tmp/.buildx-cache-new /tmp/.buildx-cache

      - name: Test
        id: test
        #skip this step
        if: false
        shell: bash
        run: |
          set -e
          export FIRST_TAG="local-test-image:${{ matrix.base }}"
          export CHROMA_PORT=${{ env.CHROMA_PORT }}
          cd chroma && pip install -r requirements.txt && pip install -r requirements_dev.txt && cd ..
          bash bin/integration-test.sh ${{ env.TESTS }}
        env:
          CHROMA_PORT: 8000
          TESTS: "--ignore-glob 'chromadb/test/property/*' --ignore='chromadb/test/test_cli.py' --ignore-glob 'chromadb/test/distributed/*' --ignore='chromadb/test/auth/test_simple_rbac_authz.py' --ignore='chromadb/test/ef/' --ignore='chromadb/test/db' --ignore='chromadb/test/segment/distributed' --ignore='chromadb/test/test_logservice.py' --ignore='chromadb/test/proto' --ignore='chromadb/test/auth/'"

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
        with:
          image-ref: local-test-image:${{ matrix.base }}
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'

      - name: Set up Docker Buildx for push
        if: success()
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        if: success()
        uses: docker/login-action@v3
        with:
          registry: ${{ env.GHCR_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log in to Docker Hub
        if: success()
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and Push Final Image
        if: success()
        id: build-and-push
        uses: docker/build-push-action@v5
        with:
          context: ./chroma
          push: true
          platforms: linux/amd64,linux/arm64
          sbom: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=local,src=/tmp/.buildx-cache
          cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
          build-args: |
             PYTHON_BASE_DIGEST=${{ env.PYTHON_BASE_DIGEST }}

      - name: Get image refs
        id: image-ref
        run: |
          set -e
          # Get the first tag for each registry
          GHCR_TAG="$(echo '${{ steps.meta.outputs.tags }}' | grep '^ghcr.io' | head -n 1)"
          DOCKERHUB_TAG="$(echo '${{ steps.meta.outputs.tags }}' | grep '^docker.io' | head -n 1)"
          echo "ghcr-ref=${GHCR_TAG}@${{ steps.build-and-push.outputs.digest }}" >> $GITHUB_OUTPUT
          echo "dockerhub-ref=${DOCKERHUB_TAG}@${{ steps.build-and-push.outputs.digest }}" >> $GITHUB_OUTPUT

      - name: Run Trivy SBOM for GHCR
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
        with:
          image-ref: ${{ steps.image-ref.outputs.ghcr-ref }}
          format: 'cyclonedx'
          output: 'chroma.ghcr.${{ matrix.base }}.cdx.json'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
        env:
          TRIVY_USERNAME: ${{ github.actor }}
          TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}

      - name: Run Trivy SBOM for Docker Hub
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
        with:
          image-ref: ${{ steps.image-ref.outputs.dockerhub-ref }}
          format: 'cyclonedx'
          output: 'chroma.dockerhub.${{ matrix.base }}.cdx.json'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
        env:
          TRIVY_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          TRIVY_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Run Trivy Vulnerability Scan for GHCR
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
        with:
          image-ref: ${{ steps.image-ref.outputs.ghcr-ref }}
          format: json
          output: 'chroma.ghcr.${{ matrix.base }}.vuln.json'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
        env:
          TRIVY_USERNAME: ${{ github.actor }}
          TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}

      - name: Run Trivy Vulnerability Scan for Docker Hub
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
        with:
          image-ref: ${{ steps.image-ref.outputs.dockerhub-ref }}
          format: json
          output: 'chroma.dockerhub.${{ matrix.base }}.vuln.json'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
        env:
          TRIVY_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          TRIVY_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Upload Security Scan Results and SBOMs
        uses: actions/upload-artifact@v4
        with:
          name: security-artifacts-${{ matrix.base }}
          path: |
            chroma.*.cdx.json
            chroma.*.vuln.json
          retention-days: 30
          
      - name: Sign
        run: |
          set -e
          export AWS_REGION=${{ env.AWS_REGION }}
          # Sign GHCR images with GHCR artifacts
          for tag in $(echo '${{ steps.meta.outputs.tags }}' | grep '^ghcr.io'); do
            # cosign sign -y --key ${COSIGN_PUBLIC_KEY} "${tag}@${{ steps.build-and-push.outputs.digest }}"
            cosign sign -y --key ${COSIGN_PUBLIC_KEY} --rekor-url=https://rekor.sigstore.dev "${tag}@${{ steps.build-and-push.outputs.digest }}"
            cosign attest -y --key ${COSIGN_PUBLIC_KEY} --type cyclonedx --predicate chroma.ghcr.${{ matrix.base }}.cdx.json "${tag}@${{ steps.build-and-push.outputs.digest }}"
            cosign attest -y --key ${COSIGN_PUBLIC_KEY} --type https://in-toto.io/Statement/v1 --predicate chroma.ghcr.${{ matrix.base }}.vuln.json "${tag}@${{ steps.build-and-push.outputs.digest }}"
            # cosign attach sbom --sbom chroma.ghcr.${{ matrix.base }}.cdx.json "${tag}@${{ steps.build-and-push.outputs.digest }}"
            # cosign attach attestation --attestation chroma.ghcr.${{ matrix.base }}.vuln.json "${tag}@${{ steps.build-and-push.outputs.digest }}"
          done
          # Sign Docker Hub images with Docker Hub artifacts
          for tag in $(echo '${{ steps.meta.outputs.tags }}' | grep '^docker.io'); do
            # cosign sign -y --key ${COSIGN_PUBLIC_KEY} "${tag}@${{ steps.build-and-push.outputs.digest }}"
            cosign sign -y --key ${COSIGN_PUBLIC_KEY} --rekor-url=https://rekor.sigstore.dev "${tag}@${{ steps.build-and-push.outputs.digest }}"
            cosign attest -y --key ${COSIGN_PUBLIC_KEY} --type cyclonedx --predicate chroma.dockerhub.${{ matrix.base }}.cdx.json "${tag}@${{ steps.build-and-push.outputs.digest }}"
            cosign attest -y --key ${COSIGN_PUBLIC_KEY} --type https://in-toto.io/Statement/v1 --predicate chroma.dockerhub.${{ matrix.base }}.vuln.json "${tag}@${{ steps.build-and-push.outputs.digest }}"
            # cosign attach sbom --sbom chroma.dockerhub.cdx.json "${tag}@${{ steps.build-and-push.outputs.digest }}"
            # cosign attach attestation --attestation chroma.dockerhub.vuln.json "${tag}@${{ steps.build-and-push.outputs.digest }}"
          done
        env:
          COSIGN_PUBLIC_KEY: ${{ secrets.AWS_KMS_OSS_IMAGE_SIGNING_KEY }}

      - name: Docker Hub Description
        uses: peter-evans/dockerhub-description@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
          repository: amikos/chroma
          readme-filepath: ./README.md