Skip to content

Commit 663f7c2

Browse files
willwang-openaiwillwang-openai
committed
split gha jobs
1 parent d8be823 commit 663f7c2

File tree

1 file changed

+87
-79
lines changed

1 file changed

+87
-79
lines changed

‎.github/workflows/build-image.yml‎

Lines changed: 87 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -17,89 +17,97 @@ env:
1717
IMAGE_NAME: ${{ github.repository }}
1818

1919
jobs:
20-
build-and-push:
20+
build-amd64:
2121
runs-on: ubuntu-latest
22-
permissions:
23-
contents: read
24-
packages: write
25-
attestations: write
26-
id-token: write
22+
outputs:
23+
digest: ${{ steps.build.outputs.digest }}
2724
steps:
28-
# Disk cleanup
29-
- run: df -h
30-
- name: "disk-cleanup"
31-
run: |
32-
sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
33-
sudo docker image prune --all --force
34-
sudo docker builder prune -af
35-
- run: df -h
25+
- name: Free disk
26+
run: |
27+
sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL || true
28+
docker system prune -af || true
29+
- uses: actions/checkout@v4
30+
- uses: docker/login-action@v3
31+
with:
32+
registry: ${{ env.REGISTRY }}
33+
username: ${{ github.actor }}
34+
password: ${{ secrets.GITHUB_TOKEN }}
35+
- uses: docker/setup-qemu-action@v3
36+
- uses: docker/setup-buildx-action@v3
37+
- name: Build & push (amd64)
38+
id: build
39+
uses: docker/build-push-action@v6
40+
with:
41+
platforms: linux/amd64
42+
push: ${{ github.event_name == 'push' }}
43+
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:amd64-${{ github.sha }}
44+
# Use GHA cache only (works on PRs). Swap to registry cache on pushes if you prefer.
45+
cache-from: type=gha,scope=${{ github.workflow }}-${{ runner.os }}-amd64
46+
cache-to: type=gha,mode=min,scope=${{ github.workflow }}-${{ runner.os }}-amd64
47+
provenance: false
48+
sbom: false
49+
secrets: |
50+
GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
3651
37-
- name: Checkout
38-
uses: actions/checkout@v4
39-
40-
- name: Log in to ghcr.io
41-
uses: docker/login-action@v3
42-
with:
43-
registry: ${{ env.REGISTRY }}
44-
username: ${{ github.actor }}
45-
password: ${{ secrets.GITHUB_TOKEN }}
46-
47-
- name: Set up QEMU
48-
uses: docker/setup-qemu-action@v3
49-
50-
- name: Set up Docker Buildx
51-
uses: docker/setup-buildx-action@v3
52-
53-
# Build & push per-arch under SHA-suffixed tags to avoid a single-arch :latest window
54-
- name: Build and push (amd64)
55-
id: build_amd64
56-
uses: docker/build-push-action@v6
57-
with:
58-
platforms: linux/amd64
59-
push: ${{ github.event_name == 'push' }}
60-
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:amd64-${{ github.sha }}
61-
cache-from: type=gha,scope=${{ github.workflow }}-${{ runner.os }}-amd64
62-
cache-to: type=gha,mode=min,scope=${{ github.workflow }}-${{ runner.os }}-amd64
63-
provenance: false
64-
sbom: false
65-
secrets: |
66-
GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
52+
build-arm64:
53+
runs-on: ubuntu-latest
54+
outputs:
55+
digest: ${{ steps.build.outputs.digest }}
56+
steps:
57+
- name: Free disk
58+
run: |
59+
sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL || true
60+
docker system prune -af || true
61+
- uses: actions/checkout@v4
62+
- uses: docker/login-action@v3
63+
with:
64+
registry: ${{ env.REGISTRY }}
65+
username: ${{ github.actor }}
66+
password: ${{ secrets.GITHUB_TOKEN }}
67+
- uses: docker/setup-qemu-action@v3
68+
- uses: docker/setup-buildx-action@v3
69+
- name: Build & push (arm64)
70+
id: build
71+
uses: docker/build-push-action@v6
72+
with:
73+
platforms: linux/arm64
74+
push: ${{ github.event_name == 'push' }}
75+
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:arm64-${{ github.sha }}
76+
cache-from: type=gha,scope=${{ github.workflow }}-${{ runner.os }}-arm64
77+
cache-to: type=gha,mode=min,scope=${{ github.workflow }}-${{ runner.os }}-arm64
78+
provenance: false
79+
sbom: false
80+
secrets: |
81+
GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
6782
68-
- name: Build and push (arm64)
69-
id: build_arm64
70-
uses: docker/build-push-action@v6
71-
with:
72-
platforms: linux/arm64
73-
push: ${{ github.event_name == 'push' }}
74-
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:arm64-${{ github.sha }}
75-
cache-from: type=gha,scope=${{ github.workflow }}-${{ runner.os }}-arm64
76-
cache-to: type=gha,mode=min,scope=${{ github.workflow }}-${{ runner.os }}-arm64
77-
provenance: false
78-
sbom: false
79-
secrets: |
80-
GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
83+
manifest-and-attest:
84+
if: ${{ github.event_name == 'push' }}
85+
runs-on: ubuntu-latest
86+
needs: [build-amd64, build-arm64]
87+
steps:
88+
- uses: docker/login-action@v3
89+
with:
90+
registry: ${{ env.REGISTRY }}
91+
username: ${{ github.actor }}
92+
password: ${{ secrets.GITHUB_TOKEN }}
8193

82-
# Create a multi-arch manifest for :latest and :{sha}
83-
- name: Create multi-arch manifest
84-
if: ${{ github.event_name == 'push' }}
85-
run: |
86-
docker buildx imagetools create \
87-
-t "$REGISTRY/$IMAGE_NAME:latest" \
88-
-t "$REGISTRY/$IMAGE_NAME:${GITHUB_SHA}" \
89-
"$REGISTRY/$IMAGE_NAME@${{ steps.build_amd64.outputs.digest }}" \
90-
"$REGISTRY/$IMAGE_NAME@${{ steps.build_arm64.outputs.digest }}"
94+
- name: Stitch multi-arch manifest (:latest and :sha)
95+
run: |
96+
docker buildx imagetools create \
97+
-t "$REGISTRY/$IMAGE_NAME:latest" \
98+
-t "$REGISTRY/$IMAGE_NAME:${GITHUB_SHA}" \
99+
"$REGISTRY/$IMAGE_NAME@${{ needs.build-amd64.outputs.digest }}" \
100+
"$REGISTRY/$IMAGE_NAME@${{ needs.build-arm64.outputs.digest }}"
91101
92-
- name: Get manifest digest
93-
id: manifest_digest
94-
if: ${{ github.event_name == 'push' }}
95-
run: |
96-
DIGEST=$(docker buildx imagetools inspect "$REGISTRY/$IMAGE_NAME:latest" | awk '/^Digest:/{print $2; exit}')
97-
echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
102+
- name: Get manifest digest
103+
id: manifest
104+
run: |
105+
DIGEST=$(docker buildx imagetools inspect "$REGISTRY/$IMAGE_NAME:latest" | awk '/^Digest:/{print $2; exit}')
106+
echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
98107
99-
- name: Generate artifact attestation
100-
uses: actions/attest-build-provenance@v2
101-
if: ${{ github.event_name == 'push' }}
102-
with:
103-
push-to-registry: true
104-
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
105-
subject-digest: ${{ steps.manifest_digest.outputs.digest }}
108+
- name: Generate artifact attestation
109+
uses: actions/attest-build-provenance@v2
110+
with:
111+
push-to-registry: true
112+
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
113+
subject-digest: ${{ steps.manifest.outputs.digest }}

0 commit comments

Comments
 (0)