Next computerd image #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Build the computerd image from the commit that passed CI on the release | |
| # branch. The mutable :next tag lets release candidates use the versioned | |
| # package and matching daemon before publication. | |
| name: Next computerd image | |
| on: | |
| workflow_run: | |
| workflows: ["CI"] | |
| branches: [release] | |
| types: [completed] | |
| workflow_dispatch: {} | |
| concurrency: | |
| # Only the newest release commit may publish the mutable :next tag. | |
| group: ${{ github.workflow }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| packages: write | |
| pull-requests: write | |
| jobs: | |
| build: | |
| if: >- | |
| ${{ | |
| github.repository == 'cloudflare/computer' && | |
| ( | |
| ( | |
| github.event_name == 'workflow_run' && | |
| github.event.workflow_run.conclusion == 'success' && | |
| ( | |
| github.event.workflow_run.event == 'push' || | |
| github.event.workflow_run.event == 'workflow_dispatch' | |
| ) && | |
| github.event.workflow_run.head_branch == 'release' && | |
| github.event.workflow_run.head_repository.full_name == github.repository | |
| ) || | |
| ( | |
| github.event_name == 'workflow_dispatch' && | |
| github.ref == 'refs/heads/release' | |
| ) | |
| ) | |
| }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| # workflow_run checks out the default branch by default. Build the | |
| # exact commit whose CI run succeeded instead. | |
| ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.ref }} | |
| fetch-depth: 1 | |
| - uses: ./.github/actions/install | |
| - name: Install system dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y --no-install-recommends libfuse2t64 fuse3 | |
| # build-bin generates the SEA blob with the active Node executable and | |
| # injects it into the pinned Node 22.22.3 target binary. | |
| - name: Use the target Node version for the binary build | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 22.22.3 | |
| # computerd's binary build bundles the sibling packages, so their dist/ | |
| # directories must exist before build:bin runs. | |
| - name: Build all workspaces | |
| run: npm run build --workspaces --if-present | |
| - name: Build the computerd binary | |
| run: npm run build:bin --workspace @cloudflare/computerd | |
| - name: Stage the computerd binary | |
| run: | | |
| mkdir -p packages/computer-computerd-linux-x64/bin | |
| cp artifacts/computerd/computerd-linux-x64 \ | |
| packages/computer-computerd-linux-x64/bin/computerd | |
| chmod 755 packages/computer-computerd-linux-x64/bin/computerd | |
| - name: Set up buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # A slower CI run for an older commit can finish after a newer one. Do | |
| # not let that run replace the newer release image. | |
| - name: Verify the release branch has not advanced | |
| id: release-sha | |
| run: | | |
| git fetch --no-tags --depth=1 origin release | |
| if [[ "$(git rev-parse HEAD)" != "$(git rev-parse FETCH_HEAD)" ]]; then | |
| echo "release advanced while this image was building; skipping the push" | |
| echo "current=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "current=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Build and push the next image | |
| if: steps.release-sha.outputs.current == 'true' | |
| run: | | |
| docker buildx build \ | |
| --platform linux/amd64 \ | |
| --push \ | |
| --provenance=false \ | |
| --tag ghcr.io/cloudflare/computer-computerd-linux-x64:next \ | |
| --file packages/computer-computerd-linux-x64/Dockerfile \ | |
| packages/computer-computerd-linux-x64 | |
| - name: Update the release PR with the next image | |
| if: steps.release-sha.outputs.current == 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| pr_number="$(gh pr list --repo "$GITHUB_REPOSITORY" --state open \ | |
| --base main --head release --json number \ | |
| --jq '.[0].number // empty')" | |
| if [[ -z "$pr_number" ]]; then | |
| echo "No open release pull request found; skipping the image comment" | |
| exit 0 | |
| fi | |
| body_file="$(mktemp)" | |
| cat > "$body_file" <<'EOF' | |
| <!-- computerd-next-image --> | |
| The `computerd` image for this release candidate is ready. Copy this stage into your Dockerfile: | |
| ```dockerfile | |
| FROM ghcr.io/cloudflare/computer-computerd-linux-x64:next AS computerd | |
| ``` | |
| EOF | |
| commit_sha="$(git rev-parse HEAD)" | |
| printf '\nBuilt from [`%s`](%s/commit/%s).\n' \ | |
| "${commit_sha:0:7}" "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" "$commit_sha" \ | |
| >> "$body_file" | |
| comment_id="$(gh api --paginate \ | |
| "repos/$GITHUB_REPOSITORY/issues/$pr_number/comments" \ | |
| --jq '.[] | select(.user.login == "github-actions[bot]" and (.body | contains("<!-- computerd-next-image -->"))) | .id' \ | |
| | sed -n '1p')" | |
| payload="$(jq -n --rawfile body "$body_file" '{ body: $body }')" | |
| if [[ -n "$comment_id" ]]; then | |
| gh api --method PATCH \ | |
| "repos/$GITHUB_REPOSITORY/issues/comments/$comment_id" \ | |
| --input - <<< "$payload" | |
| else | |
| gh api --method POST \ | |
| "repos/$GITHUB_REPOSITORY/issues/$pr_number/comments" \ | |
| --input - <<< "$payload" | |
| fi |