build.yml

name: Docker images

on: [push, pull_request, workflow_dispatch]

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: ${{ matrix.image }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: ["ubuntu-latest"]
        image:
          # Run slower jobs first to give them a headstart and reduce waiting time
          - "ubuntu-26.04-resolute-ppc64le"
          - "ubuntu-26.04-resolute-s390x"
          # test image for manylinux-wheel build
          - "fedora-43-amd64"
          # Then run the remainder
          - "alpine"
          - "amazon-2023-amd64"
          - "arch"
          - "centos-stream-9-amd64"
          - "centos-stream-10-amd64"
          - "debian-13-trixie-x86"
          - "debian-13-trixie-amd64"
          - "fedora-44-amd64"
          - "gentoo"
          - "ubuntu-24.04-noble-amd64"
          - "ubuntu-26.04-resolute-amd64"
          # has a dependency on the test image
          - "manylinux_2_28-wheel-build"
        include:
          - image: "manylinux_2_28-wheel-build"
            test-image: "fedora-43-amd64"
          - image: "ubuntu-26.04-resolute-ppc64le"
            qemu-arch: "ppc64le"
            docker-args: "--platform linux/ppc64le"
          - image: "ubuntu-26.04-resolute-s390x"
            qemu-arch: "s390x"
            docker-args: "--platform linux/s390x"
          - image: "ubuntu-26.04-resolute-arm64v8"
            os: "ubuntu-24.04-arm"

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          submodules: true

      - name: Set up QEMU
        if: "matrix.qemu-arch"
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
        with:
          platforms: ${{ matrix.qemu-arch }}

      - name: Prepare build
        run: |
          sudo apt-get update && sudo apt-get install -qyy debootstrap
          if [[ -n "$matrix.test-image" ]]; then
            git submodule update --remote --init --recursive Pillow
          else
            git submodule update --remote Pillow
          fi
          cd Pillow && git checkout main

      - name: Test Image Build
        if: "matrix.test-image"
        run: |
          cd "${{ matrix.test-image }}"
          make pull || (make update && make build BRANCH=main)
        env:
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKER_ARGS: ${{ matrix.docker-args }}

      - name: Build image
        id: build
        run: |
          cd "${{ matrix.image }}" && make update
          if [[ -n "$DOCKER_USERNAME" ]]; then
            echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin && echo "logged_in=true" >> "$GITHUB_OUTPUT"
          fi
          make build BRANCH=main
        env:
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
          DOCKER_ARGS: ${{ matrix.docker-args }}

      - name: Test image
        run: |
          cd "${{ matrix.image }}"
          make test BRANCH=main
        env:
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}

      - name: Log image size
        run: |
          docker images

      - name: Push image
        if: "steps.build.outputs.logged_in == 'true'
                           && github.event_name == 'push'
                           && github.ref == 'refs/heads/main'"
        run: make push-${{ matrix.image }} BRANCH=main
        env:
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}

  # The valgrind suite is slow, so build its image once, test it across
  # parallel split jobs, and push only after every split has passed.
  build-valgrind:
    name: ubuntu-24.04-noble-amd64-valgrind build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          submodules: true

      - name: Prepare build
        run: |
          git submodule update --remote Pillow
          cd Pillow && git checkout main

      - name: Build image
        run: |
          cd ubuntu-24.04-noble-amd64-valgrind && make update
          if [[ -n "$DOCKER_USERNAME" ]]; then
            echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
          fi
          make build BRANCH=main
        env:
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}

      - name: Save image
        run: make -C ubuntu-24.04-noble-amd64-valgrind save BRANCH=main

      - name: Upload image
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ubuntu-24.04-noble-amd64-valgrind
          path: ubuntu-24.04-noble-amd64-valgrind/image.tar
          retention-days: 1

  test-valgrind:
    name: ubuntu-24.04-noble-amd64-valgrind ${{ matrix.split }}
    needs: build-valgrind
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        split: [1, 2, 3, 4]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          submodules: true

      - name: Download image
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ubuntu-24.04-noble-amd64-valgrind

      - name: Prepare test
        run: |
          git submodule update --remote Pillow
          cd Pillow && git checkout main

      - name: Load image
        run: |
          if [[ -n "$DOCKER_USERNAME" ]]; then
            echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
          fi
          docker load -i image.tar
        env:
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}

      - name: Test image
        run: |
          cd ubuntu-24.04-noble-amd64-valgrind
          make test BRANCH=main
        env:
          SPLIT_INDEX: ${{ matrix.split }}
          SPLIT_COUNT: ${{ strategy.job-total }}

  push-valgrind:
    name: Push ubuntu-24.04-noble-amd64-valgrind
    needs: test-valgrind
    runs-on: ubuntu-latest
    if: "github.event_name == 'push'
        && github.ref == 'refs/heads/main'"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Download image
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ubuntu-24.04-noble-amd64-valgrind

      - name: Load image
        id: build
        run: |
          if [[ -n "$DOCKER_USERNAME" ]]; then
            echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin && echo "logged_in=true" >> "$GITHUB_OUTPUT"
          fi
          docker load -i image.tar
        env:
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}

      - name: Log image size
        run: |
          docker images

      - name: Push image
        if: "steps.build.outputs.logged_in == 'true'"
        run: make push-ubuntu-24.04-noble-amd64-valgrind BRANCH=main
        env:
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}

  success:
    needs: [build, push-valgrind]
    runs-on: ubuntu-latest
    name: Build successful
    steps:
      - name: Success
        run: echo Build Successful