feat: container builds on release #553
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -60,7 +60,6 @@ DCO | |
| CITATION.md | ||
| CODE_OF_CONDUCT.md | ||
| SECURITY.md | ||
| design.md | ||
|
|
||
| # Dev-only dotfiles | ||
|
|
||
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,159 @@ | ||||||||||
| # Copyright (c) 2024-2026, NVIDIA CORPORATION. | ||||||||||
| # | ||||||||||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||||||||||
| # you may not use this file except in compliance with the License. | ||||||||||
| # You may obtain a copy of the License at | ||||||||||
| # | ||||||||||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||||||||||
| # | ||||||||||
| # Unless required by applicable law or agreed to in writing, software | ||||||||||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||||||||||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||||||||||
| # See the License for the specific language governing permissions and | ||||||||||
| # limitations under the License. | ||||||||||
|
|
||||||||||
| name: Container Build | ||||||||||
|
|
||||||||||
| on: | ||||||||||
| pull_request: | ||||||||||
| branches: | ||||||||||
| - main | ||||||||||
| paths: | ||||||||||
| - '.dockerignore' | ||||||||||
| - '.github/workflows/container-build.yml' | ||||||||||
| - 'containers/**' | ||||||||||
| - 'Makefile' | ||||||||||
| - 'pyproject.toml' | ||||||||||
| - 'uv.lock' | ||||||||||
| push: | ||||||||||
| tags: | ||||||||||
| - 'v*' | ||||||||||
| workflow_dispatch: | ||||||||||
|
|
||||||||||
| defaults: | ||||||||||
| run: | ||||||||||
| shell: bash -x -e -u -o pipefail {0} | ||||||||||
|
|
||||||||||
| concurrency: | ||||||||||
| group: ${{ github.workflow }}-${{ github.ref }} | ||||||||||
| cancel-in-progress: true | ||||||||||
|
|
||||||||||
| permissions: | ||||||||||
| contents: read | ||||||||||
| packages: write | ||||||||||
|
|
||||||||||
| env: | ||||||||||
| REGISTRY_IMAGE: ghcr.io/nvidia-nemo/safe-synthesizer | ||||||||||
|
|
||||||||||
| jobs: | ||||||||||
| build: | ||||||||||
| name: Build ${{ matrix.variant }} image | ||||||||||
| runs-on: ubuntu-latest | ||||||||||
| strategy: | ||||||||||
| fail-fast: false | ||||||||||
| matrix: | ||||||||||
| include: | ||||||||||
| - variant: cu129 | ||||||||||
| extra: cu129 | ||||||||||
| platforms: linux/amd64 | ||||||||||
| steps: | ||||||||||
| - name: Checkout | ||||||||||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | ||||||||||
|
kendrickb-nvidia marked this conversation as resolved.
|
||||||||||
| with: | ||||||||||
| persist-credentials: false | ||||||||||
| fetch-depth: 0 | ||||||||||
|
Comment on lines
+53
to
+54
Contributor
There was a problem hiding this comment.
Suggested change
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time! |
||||||||||
|
|
||||||||||
| - name: Resolve package version | ||||||||||
| id: package-version | ||||||||||
| run: | | ||||||||||
| if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then | ||||||||||
| version="${GITHUB_REF_NAME#v}" | ||||||||||
| else | ||||||||||
| version="0.0.0+${GITHUB_SHA::12}" | ||||||||||
| fi | ||||||||||
| echo "version=${version}" >> "$GITHUB_OUTPUT" | ||||||||||
|
|
||||||||||
| - name: Set up Docker Buildx | ||||||||||
| uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 | ||||||||||
|
|
||||||||||
| - name: Log in to GHCR | ||||||||||
| if: >- | ||||||||||
| ${{ | ||||||||||
| github.event_name == 'push' || | ||||||||||
| ( | ||||||||||
| github.event_name == 'pull_request' && | ||||||||||
| github.event.pull_request.head.repo.full_name == github.repository | ||||||||||
| ) | ||||||||||
| }} | ||||||||||
| uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 | ||||||||||
| with: | ||||||||||
| registry: ghcr.io | ||||||||||
| username: ${{ github.actor }} | ||||||||||
| password: ${{ secrets.GITHUB_TOKEN }} | ||||||||||
|
|
||||||||||
| - name: Extract image metadata | ||||||||||
| id: meta | ||||||||||
| uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 | ||||||||||
| with: | ||||||||||
| images: ${{ env.REGISTRY_IMAGE }} | ||||||||||
| flavor: | | ||||||||||
| latest=false | ||||||||||
| tags: | | ||||||||||
| type=raw,value=${{ matrix.variant }},enable=${{ startsWith(github.ref, 'refs/tags/v') }} | ||||||||||
| type=raw,value=latest-${{ matrix.variant }},enable=${{ startsWith(github.ref, 'refs/tags/v') }} | ||||||||||
| type=ref,event=pr,prefix=pr-,suffix=-${{ matrix.variant }} | ||||||||||
| type=sha,prefix=sha-,suffix=-${{ matrix.variant }} | ||||||||||
| type=semver,pattern={{version}}-${{ matrix.variant }} | ||||||||||
| type=semver,pattern={{major}}.{{minor}}-${{ matrix.variant }} | ||||||||||
| labels: | | ||||||||||
| org.opencontainers.image.version=${{ steps.package-version.outputs.version }} | ||||||||||
| com.nvidia.nemo.safe-synthesizer.extra=${{ matrix.extra }} | ||||||||||
| com.nvidia.nemo.safe-synthesizer.variant=${{ matrix.variant }} | ||||||||||
|
Comment on lines
+84
to
+93
Contributor
There was a problem hiding this comment. 🧩 Analysis chain🌐 Web query:
💡 Result: In the docker/metadata-action, the choice between type=raw and type=semver significantly impacts how pre-release versions are handled, particularly regarding tag floating, prefix stripping, and automatic 'latest' tag generation [1][2]. Type=semver The semver type is designed for automated versioning based on SemVer-compliant Git tags [1]. It includes opinionated, built-in logic for pre-release handling [1]. - Pre-release behavior: When a pre-release (e.g., v1.2.3-alpha) is detected, the action intentionally limits tag generation [1][3]. It will typically only produce the full version string ({{version}} or {{raw}}) and avoids creating broader, mutable 'floating' tags like the major (e.g., v1) or minor (e.g., v1.2) identifiers [1][2]. This is by design to prevent unstable pre-release code from overriding stable production tags [1]. - Prefix handling: By default, type=semver strips the 'v' prefix from tags [4][2]. To preserve the 'v', you should use the prefix attribute (e.g., type=semver,pattern={{version}},prefix=v) rather than hardcoding it into the pattern [4][2]. - Latest tag: For pre-releases, the implicit 'latest' tag generation (if flavor.latest=auto is used) is automatically disabled [5]. Type=raw The raw type provides a way to output custom, explicit tag values [1]. - Pre-release behavior: It does not inherently understand SemVer or distinguish between releases and pre-releases [1]. It simply outputs exactly what is provided in the value attribute [1]. - Floating tags: If you use type=raw to manually create 'floating' tags (e.g., naming your image 'my-app:1'), the action will create these tags regardless of whether the source tag is a pre-release [6]. You must implement your own conditional logic using the enable attribute if you wish to prevent pre-release versions from overriding these tags [3][6]. - Usage: This type is best suited for scenarios where you need full control over the tag naming convention and do not want the action's opinionated semver logic applied [1]. Summary Table Feature | type=semver | type=raw --- | --- | --- Automatic Pre-release Logic | Yes (Limits output to prevent overriding) [1] | No (Literal output) [1] Prefix Handling | Automatically strips 'v' (configurable) [4][2] | None (Literal) [1] Implicit 'latest' Tag | Automatically disabled for pre-releases [5] | Not influenced (can lead to conflicts) [5] Control | Opinionated/Automated [1] | Manual/Explicit [1] To maintain safety during pre-release cycles, prefer type=semver to benefit from the built-in safeguards that prevent unstable builds from inadvertently updating 'latest' or major/minor floating tags [1][5]. Use type=raw only when you have specific, non-standard naming requirements and are prepared to manually manage the conditional logic for when those tags should be applied [6]. Citations:
Prevent RC tags from overwriting the floating In Gate these 🔧 Possible approach (exclude RC prereleases from the raw floating tags)- type=raw,value=${{ matrix.variant }},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
- type=raw,value=latest-${{ matrix.variant }},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+ type=raw,value=${{ matrix.variant }},enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, 'rc') }}
+ type=raw,value=latest-${{ matrix.variant }},enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, 'rc') }} |
||||||||||
|
|
||||||||||
| - name: Build and push image | ||||||||||
| if: >- | ||||||||||
| ${{ | ||||||||||
| github.event_name == 'push' || | ||||||||||
| ( | ||||||||||
| github.event_name == 'pull_request' && | ||||||||||
| github.event.pull_request.head.repo.full_name == github.repository | ||||||||||
| ) | ||||||||||
| }} | ||||||||||
| uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 | ||||||||||
| with: | ||||||||||
| context: . | ||||||||||
| file: containers/Dockerfile.cuda | ||||||||||
| target: runtime | ||||||||||
| platforms: ${{ matrix.platforms }} | ||||||||||
| push: true | ||||||||||
| build-args: | | ||||||||||
| CONTAINER_EXTRA=${{ matrix.extra }} | ||||||||||
| CONTAINER_VARIANT=${{ matrix.variant }} | ||||||||||
| PACKAGE_VERSION=${{ steps.package-version.outputs.version }} | ||||||||||
| labels: ${{ steps.meta.outputs.labels }} | ||||||||||
| tags: ${{ steps.meta.outputs.tags }} | ||||||||||
| cache-from: type=registry,ref=${{ env.REGISTRY_IMAGE }}:buildcache-${{ matrix.variant }} | ||||||||||
| cache-to: type=registry,ref=${{ env.REGISTRY_IMAGE }}:buildcache-${{ matrix.variant }},mode=max,oci-mediatypes=true,image-manifest=true | ||||||||||
|
|
||||||||||
| - name: Build image | ||||||||||
| if: >- | ||||||||||
| ${{ | ||||||||||
| github.event_name != 'push' && | ||||||||||
| ( | ||||||||||
| github.event_name != 'pull_request' || | ||||||||||
| github.event.pull_request.head.repo.full_name != github.repository | ||||||||||
| ) | ||||||||||
| }} | ||||||||||
| uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 | ||||||||||
| with: | ||||||||||
| context: . | ||||||||||
| file: containers/Dockerfile.cuda | ||||||||||
| target: runtime | ||||||||||
| platforms: ${{ matrix.platforms }} | ||||||||||
| push: false | ||||||||||
| build-args: | | ||||||||||
| CONTAINER_EXTRA=${{ matrix.extra }} | ||||||||||
| CONTAINER_VARIANT=${{ matrix.variant }} | ||||||||||
| PACKAGE_VERSION=${{ steps.package-version.outputs.version }} | ||||||||||
| labels: ${{ steps.meta.outputs.labels }} | ||||||||||
| tags: ${{ steps.meta.outputs.tags }} | ||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Quote the Mermaid node label -- nested brackets will break the diagram.
tag[Tag push v[0-9]*]contains[and]inside the node text. Mermaid terminates the label at the first], leaving*]to cause a parse/render error. Wrap the label in quotes.📝 Proposed fix
As per coding guidelines: "Use Mermaid diagrams with no spaces in node IDs, quote labels with special characters".