promotion.yaml

# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Carbide Promotion to Carbide Registry

on:
  workflow_call:
    inputs:
      runner:
        description: "Runner type for the job"
        required: false
        default: "ubuntu-latest"
        type: string
      semantic_version:
        description: "Semantic version from VERSION file"
        required: true
        type: string
      build_artifacts:
        description: "JSON array of build artifacts"
        required: false
        type: string
    secrets:
      NVCR_STG_USERNAME:
        required: true
      NVCR_STG_TOKEN:
        required: true
      NVCR_PROD_USERNAME:
        required: true
      NVCR_PROD_TOKEN:
        required: true
      GITTAG_PAT_TOKEN:
        required: true

jobs:
  # ============================================================================
  # Approve Promote to Carbide Registry
  # ============================================================================
  promote-carbide-rest-to-carbide-registry:
    runs-on: ${{ inputs.runner }}
    environment: 
      name: promote-carbide-registry
    steps:
      - name: Approve Promote to Carbide Registry
        run: |
          echo "Received build artifacts: ${{ inputs.build_artifacts }}"  
          echo "Approve Promote to Carbide Registry"
          echo "Promote Carbide REST to registry ngcr.io/0837451325059433/carbide"

  # ============================================================================
  # Prepare Promotion Matrix
  # ============================================================================
  prepare-matrix:
    runs-on: ${{ inputs.runner }}
    needs: promote-carbide-rest-to-carbide-registry
    outputs:
      images: ${{ steps.gen-matrix.outputs.images }}
      artifacts: ${{ steps.gen-matrix.outputs.artifacts }}
    steps:
      - id: gen-matrix
        run: |
          # Transform build_artifacts into matrix for promote-image.yml
          echo '${{ inputs.build_artifacts }}' > artifacts.json
          
          # Generate Image Matrix
          jq -c '[ .[] | {
            source: .image_ref | split(":") | .[0],
            source_tag: .image_ref | split(":") | .[1],
            destination: (.image_ref | split(":") | .[0] | sub("carbide-dev"; "carbide")),
            destination_tag: "${{ inputs.semantic_version }}"
          } ]' artifacts.json > image_matrix.json
          
          # Generate Artifact Matrix (Flatten binaries and image tarballs)
          jq -c '[
            .[] | 
            (if .binary_resource != null and .binary_resource != "" then {
              type: "binary",
              org: (.binary_resource | split("/")[0]),
              team: (.binary_resource | split("/")[1]),
              name: (.binary_resource | split("/")[2]),
              source_tag: (.image_ref | split(":")[1])
            } else empty end),
            (if .image_resource != null and .image_resource != "" then {
              type: "image_tarball",
              org: (.image_resource | split("/")[0]),
              team: (.image_resource | split("/")[1]),
              name: (.image_resource | split("/")[2]),
              source_tag: (.image_ref | split(":")[1])
            } else empty end)
          ]' artifacts.json > artifact_matrix.json

          echo "images=$(cat image_matrix.json)" >> $GITHUB_OUTPUT
          echo "artifacts=$(cat artifact_matrix.json)" >> $GITHUB_OUTPUT

  # ============================================================================
  # Promote Images (Carbide Registry)
  # ============================================================================
  promote-images:
    needs: prepare-matrix
    strategy:
      matrix:
        include: ${{ fromJson(needs.prepare-matrix.outputs.images) }}
      fail-fast: false
    uses: NVIDIA/dsx-github-actions/.github/workflows/promote-image.yml@95e609360851cfc141918c2c21e57762d77394ac
    with:
      source: ${{ matrix.source }}
      source_tag: ${{ matrix.source_tag }}
      destination: ${{ matrix.destination }}
      destination_tag: ${{ matrix.destination_tag }}
    secrets:
      SOURCE_USERNAME: ${{ secrets.NVCR_STG_USERNAME }}
      SOURCE_PASSWORD: ${{ secrets.NVCR_STG_TOKEN }}
      DEST_USERNAME: ${{ secrets.NVCR_PROD_USERNAME }}
      DEST_PASSWORD: ${{ secrets.NVCR_PROD_TOKEN }}

  # ============================================================================
  # Promote Artifacts (Resources)
  # ============================================================================
  promote-artifacts:
    runs-on: ${{ inputs.runner }}
    needs: 
      - promote-carbide-rest-to-carbide-registry
      - prepare-matrix
    strategy:
      matrix:
        include: ${{ fromJson(needs.prepare-matrix.outputs.artifacts) }}
      fail-fast: false
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install NGC CLI
        shell: bash
        run: |
          chmod +x ./.github/scripts/install-ngc-cli.sh
          ./.github/scripts/install-ngc-cli.sh

      - name: Promote Resource (${{ matrix.type }})
        env:
          SOURCE_TOKEN: ${{ secrets.NVCR_STG_TOKEN }}
          DEST_TOKEN: ${{ secrets.NVCR_PROD_TOKEN }}
          SEMANTIC_VERSION: ${{ inputs.semantic_version }}
        run: |
          chmod +x ./.github/scripts/promote-single-ngc-resource.sh
          ./.github/scripts/promote-single-ngc-resource.sh \
            "${{ matrix.org }}" \
            "${{ matrix.team }}" \
            "${{ matrix.name }}" \
            "${{ matrix.source_tag }}" \
            "$SEMANTIC_VERSION"