next-computerd-image.yml

# Build the computerd image from the commit that passed CI on the release
# branch. The mutable :next tag lets release candidates use the versioned
# package and matching daemon before publication.

name: Next computerd image

on:
  workflow_run:
    workflows: ["CI"]
    branches: [release]
    types: [completed]
  workflow_dispatch: {}

concurrency:
  # Only the newest release commit may publish the mutable :next tag.
  group: ${{ github.workflow }}
  cancel-in-progress: true

permissions:
  contents: read
  packages: write
  pull-requests: write

jobs:
  build:
    if: >-
      ${{
        github.repository == 'cloudflare/computer' &&
        (
          (
            github.event_name == 'workflow_run' &&
            github.event.workflow_run.conclusion == 'success' &&
            (
              github.event.workflow_run.event == 'push' ||
              github.event.workflow_run.event == 'workflow_dispatch'
            ) &&
            github.event.workflow_run.head_branch == 'release' &&
            github.event.workflow_run.head_repository.full_name == github.repository
          ) ||
          (
            github.event_name == 'workflow_dispatch' &&
            github.ref == 'refs/heads/release'
          )
        )
      }}
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v6
        with:
          # workflow_run checks out the default branch by default. Build the
          # exact commit whose CI run succeeded instead.
          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.ref }}
          fetch-depth: 1

      - uses: ./.github/actions/install

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends libfuse2t64 fuse3

      # build-bin generates the SEA blob with the active Node executable and
      # injects it into the pinned Node 22.22.3 target binary.
      - name: Use the target Node version for the binary build
        uses: actions/setup-node@v6
        with:
          node-version: 22.22.3

      # computerd's binary build bundles the sibling packages, so their dist/
      # directories must exist before build:bin runs.
      - name: Build all workspaces
        run: npm run build --workspaces --if-present

      - name: Build the computerd binary
        run: npm run build:bin --workspace @cloudflare/computerd

      - name: Stage the computerd binary
        run: |
          mkdir -p packages/computer-computerd-linux-x64/bin
          cp artifacts/computerd/computerd-linux-x64 \
            packages/computer-computerd-linux-x64/bin/computerd
          chmod 755 packages/computer-computerd-linux-x64/bin/computerd

      - name: Set up buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # A slower CI run for an older commit can finish after a newer one. Do
      # not let that run replace the newer release image.
      - name: Verify the release branch has not advanced
        id: release-sha
        run: |
          git fetch --no-tags --depth=1 origin release
          if [[ "$(git rev-parse HEAD)" != "$(git rev-parse FETCH_HEAD)" ]]; then
            echo "release advanced while this image was building; skipping the push"
            echo "current=false" >> "$GITHUB_OUTPUT"
          else
            echo "current=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Build and push the next image
        if: steps.release-sha.outputs.current == 'true'
        run: |
          docker buildx build \
            --platform linux/amd64 \
            --push \
            --provenance=false \
            --tag ghcr.io/cloudflare/computer-computerd-linux-x64:next \
            --file packages/computer-computerd-linux-x64/Dockerfile \
            packages/computer-computerd-linux-x64

      - name: Update the release PR with the next image
        if: steps.release-sha.outputs.current == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          pr_number="$(gh pr list --repo "$GITHUB_REPOSITORY" --state open \
            --base main --head release --json number \
            --jq '.[0].number // empty')"
          if [[ -z "$pr_number" ]]; then
            echo "No open release pull request found; skipping the image comment"
            exit 0
          fi

          body_file="$(mktemp)"
          cat > "$body_file" <<'EOF'
          <!-- computerd-next-image -->
          The `computerd` image for this release candidate is ready. Copy this stage into your Dockerfile:

          ```dockerfile
          FROM ghcr.io/cloudflare/computer-computerd-linux-x64:next AS computerd
          ```
          EOF
          commit_sha="$(git rev-parse HEAD)"
          printf '\nBuilt from [`%s`](%s/commit/%s).\n' \
            "${commit_sha:0:7}" "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" "$commit_sha" \
            >> "$body_file"

          comment_id="$(gh api --paginate \
            "repos/$GITHUB_REPOSITORY/issues/$pr_number/comments" \
            --jq '.[] | select(.user.login == "github-actions[bot]" and (.body | contains("<!-- computerd-next-image -->"))) | .id' \
            | sed -n '1p')"

          payload="$(jq -n --rawfile body "$body_file" '{ body: $body }')"
          if [[ -n "$comment_id" ]]; then
            gh api --method PATCH \
              "repos/$GITHUB_REPOSITORY/issues/comments/$comment_id" \
              --input - <<< "$payload"
          else
            gh api --method POST \
              "repos/$GITHUB_REPOSITORY/issues/$pr_number/comments" \
              --input - <<< "$payload"
          fi