Motivation
Core deliverable of the epic: a reusable workflow that bakes the service images from docker/backend.ai-* dockerfiles (seven including the agent, BA-7271) and pushes them to Docker Hub using OIDC — no stored registry credentials.
Details
New .github/workflows/docker-images.yml with on: [workflow_call, workflow_dispatch] (same shape as sbom.yml):
prepare job
- Build the matrix via the shared dockerfile-discovery script (BA-7267) — the agent dockerfile from BA-7271 is picked up automatically once it lands.
- Resolve
PYTHON_VERSION from pants.toml and normalized PKGVER from VERSION (reuse the normalization in scripts/build-wheels.sh).
build-push job (matrix over the service images)
environment: deploy-to-dockerhub; permissions: contents: read, id-token: write.- Checkout, then download the
wheels artifact into dist/ (the dockerfiles install wheels from dist/ + root requirements.txt; build context = repo root).
docker/setup-qemu-action + docker/setup-buildx-action; build linux/amd64,linux/arm64 (aarch64 wheels are already produced by scripts/build-wheels.sh).- OIDC login:
docker/login-action@v4 (≥ 4.5.0) with username: lablup, no password, env: DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTION_ID }}.
docker/metadata-action for tags: the version tag always; latest only when scripts/determine-release-type.py says the version is final (do not re-implement prerelease detection).docker/build-push-action with push: true, build args PYTHON_VERSION / PKGVER, and provenance + SBOM attestations enabled.
Guardrails (.github/AGENTS.md): pin all third-party actions to commit SHAs with # vN comments; never interpolate ${{ }} into shell — pass values via env: and quoted arguments; any multi-line logic goes to scripts/.
Depends on: BA-7266, BA-7267. The workflow does not hard-depend on BA-7271 — the matrix builds whatever service dockerfiles exist, so the agent image joins automatically when BA-7271 merges.
Success Criteria
JIRA Issue: BA-7268
Motivation
Core deliverable of the epic: a reusable workflow that bakes the service images from
docker/backend.ai-*dockerfiles (seven including the agent, BA-7271) and pushes them to Docker Hub using OIDC — no stored registry credentials.Details
New
.github/workflows/docker-images.ymlwithon: [workflow_call, workflow_dispatch](same shape assbom.yml):prepare job
PYTHON_VERSIONfrompants.tomland normalizedPKGVERfromVERSION(reuse the normalization inscripts/build-wheels.sh).build-push job (matrix over the service images)
environment: deploy-to-dockerhub;permissions: contents: read, id-token: write.wheelsartifact intodist/(the dockerfiles install wheels fromdist/+ rootrequirements.txt; build context = repo root).docker/setup-qemu-action+docker/setup-buildx-action; buildlinux/amd64,linux/arm64(aarch64 wheels are already produced byscripts/build-wheels.sh).docker/login-action@v4(≥ 4.5.0) withusername: lablup, no password,env: DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTION_ID}}.docker/metadata-actionfor tags: the version tag always;latestonly whenscripts/determine-release-type.pysays the version is final (do not re-implement prerelease detection).docker/build-push-actionwithpush: true, build argsPYTHON_VERSION/PKGVER, and provenance + SBOM attestations enabled.Guardrails (
.github/AGENTS.md): pin all third-party actions to commit SHAs with# vNcomments; never interpolate${{}} into shell — pass values viaenv:and quoted arguments; any multi-line logic goes toscripts/.Depends on: BA-7266, BA-7267. The workflow does not hard-depend on BA-7271 — the matrix builds whatever service dockerfiles exist, so the agent image joins automatically when BA-7271 merges.
Success Criteria
workflow_dispatchrun on a tag builds and pushes all service images (seven once BA-7271 lands) multi-arch with correct tags.JIRA Issue: BA-7268