native-token-transfers/.github/workflows/tilt-images.yml at e568eb34194f249070b90a415dbe42e4414c48c1 · wormhole-foundation/native-token-transfers · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
name: Tilt Images

# Pre-build expensive Docker images used by Tilt CI to speed up builds
# These images are pushed to ghcr.io and pulled by tilt.yml workflow

on:
  workflow_dispatch:
  workflow_call:
    outputs:
      solana-image:
        description: "The full ntt-solana-contract image reference"
        value: ${{ jobs.build-solana.outputs.image }}
      evm-image:
        description: "The full ntt-evm-contract image reference"
        value: ${{ jobs.build-evm.outputs.image }}
  push:
    branches:
      - main
    paths:
      - "solana/**"
      - "evm/**"
      - ".github/workflows/tilt-images.yml"
  pull_request:
    paths:
      - "solana/**"
      - "evm/**"
      - ".github/workflows/tilt-images.yml"

env:
  REGISTRY: ghcr.io

jobs:
  # Build ntt-solana-contract image (the expensive one - anchor build takes 2-4 min)
  build-solana:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      image: ${{ steps.meta.outputs.tags }}
    steps:
      - name: Free disk space
        run: |
          # Remove unnecessary tools to free up ~20GB
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
          sudo docker image prune --all --force

      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Log in to Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate content hash
        id: hash
        run: |
          # Hash solana directory contents for cache key
          HASH=$(find solana -type f \( -name "*.rs" -o -name "*.toml" -o -name "Cargo.lock" -o -name "Anchor.toml" \) -exec sha256sum {} \; | sort | sha256sum | cut -c1-16)
          echo "hash=${HASH}" >> $GITHUB_OUTPUT

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
        with:
          images: ${{ env.REGISTRY }}/${{ github.repository }}/ntt-solana-contract
          tags: |
            type=sha,prefix=
            type=raw,value=${{ steps.hash.outputs.hash }}
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push ntt-solana-contract
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: .
          file: solana/Dockerfile
          target: builder
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          # Use registry-based caching for builder layers
          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ github.repository }}/ntt-solana-contract:buildcache
          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ github.repository }}/ntt-solana-contract:buildcache,mode=max

  # Build ntt-evm-contract image (faster, but still benefits from caching)
  build-evm:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      image: ${{ steps.meta.outputs.tags }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: recursive
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Log in to Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate content hash
        id: hash
        run: |
          # Hash evm directory contents for cache key
          HASH=$(find evm -type f \( -name "*.sol" -o -name "foundry.toml" \) -exec sha256sum {} \; | sort | sha256sum | cut -c1-16)
          echo "hash=${HASH}" >> $GITHUB_OUTPUT

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
        with:
          images: ${{ env.REGISTRY }}/${{ github.repository }}/ntt-evm-contract
          tags: |
            type=sha,prefix=
            type=raw,value=${{ steps.hash.outputs.hash }}
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push ntt-evm-contract
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: evm
          file: evm/Dockerfile
          target: foundry-export
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          # Use registry-based caching (GHA cache can hang on large uploads)
          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ github.repository }}/ntt-evm-contract:buildcache
          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ github.repository }}/ntt-evm-contract:buildcache,mode=max