fix(#341): pin dev by digest so pods converge; symmetric convergence … #170
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build Docker image | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ['v*'] | |
| schedule: | |
| - cron: '0 6 * * 1' # Mondays 06:00 UTC — refresh base image + unpinned deps | |
| workflow_dispatch: | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Set up Buildx | |
| uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 | |
| - name: Compute image tags | |
| id: tags | |
| run: | | |
| repo=ghcr.io/boettiger-lab/mcp-data-server | |
| case "${{ github.event_name }}" in | |
| push) | |
| if [ "${{ github.ref_type }}" = "tag" ]; then | |
| # Release tag (vX.Y.Z): immutable version tag + immutable sha. | |
| tags="$repo:${{ github.ref_name }}"$'\n'"$repo:${{ github.sha }}" | |
| else | |
| # Push to main: moving dev tag + immutable sha. | |
| tags="$repo:main"$'\n'"$repo:${{ github.sha }}" | |
| fi | |
| ;; | |
| *) | |
| # schedule / workflow_dispatch: dep+base refresh. Move ONLY the dev | |
| # tag — never mint a :sha or :vX.Y.Z from a non-push event. | |
| tags="$repo:main" | |
| ;; | |
| esac | |
| # Version stamp baked into the image: the tag on release builds, else "main". | |
| if [ "${{ github.ref_type }}" = "tag" ]; then | |
| app_version="${{ github.ref_name }}" | |
| else | |
| app_version="main" | |
| fi | |
| { | |
| echo "tags<<EOF" | |
| echo "$tags" | |
| echo "EOF" | |
| echo "app_version=$app_version" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Build and push | |
| id: build | |
| uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 | |
| with: | |
| context: . | |
| push: true | |
| tags: ${{ steps.tags.outputs.tags }} | |
| build-args: | | |
| APP_VERSION=${{ steps.tags.outputs.app_version }} | |
| GIT_SHA=${{ github.sha }} | |
| # Pushes reuse the cached deps layer (fast code-only builds). The weekly | |
| # cron and manual workflow_dispatch both set no-cache + pull so they | |
| # re-resolve unpinned deps and pull a fresh base image (security patches); | |
| # cache-to still warms the cache for subsequent pushes. | |
| # (When no-cache=true, cache-from is ignored by design; cache-to is kept | |
| # so the next code-push still gets a warm cache.) | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| no-cache: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }} | |
| pull: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }} | |
| - name: Smoke-test image | |
| run: | | |
| image="ghcr.io/boettiger-lab/mcp-data-server@${{ steps.build.outputs.digest }}" | |
| docker pull "$image" | |
| docker run --rm "$image" python -c "import duckdb; c=duckdb.connect(); c.sql('LOAD httpfs'); c.sql('LOAD spatial'); c.sql('LOAD h3'); c.sql('SELECT h3_latlng_to_cell(37.8, -122.4, 5)'); c.sql('SELECT ST_Point(0, 0)'); print('OK: httpfs/spatial/h3 loaded and functional')" | |
| - name: Report image digest | |
| run: | | |
| { | |
| echo "### Image digest" | |
| echo '```' | |
| echo "${{ steps.build.outputs.digest }}" | |
| echo '```' | |
| } >> "$GITHUB_STEP_SUMMARY" |