mirror of
https://github.com/luxfi/graph.git
synced 2026-09-24 00:26:07 +00:00
zeekayandHanzo Dev
ac42de990c
hanzo-build-linux-amd64, lux-build-linux-amd64, zoo-build-linux-amd64 and every other org-prefixed spelling all meant the same machine. Which org a job belongs to does not change which host can build it, so the org bought one pool name per org per arch and each could go stale on its own -- the evo host alone answered to fourteen names for one label. One vocabulary now: linux-amd64, linux-arm64, macos-arm64, win-amd64. The generic labels every plain workflow uses (ubuntu-latest, self-hosted) are untouched, so naive CI keeps working. Co-authored-by: Hanzo Dev <[email protected]>
88 lines
3.2 KiB
YAML
88 lines
3.2 KiB
YAML
name: Release
|
|
|
|
# Builds ghcr.io/luxfi/graph on the native runners (git.hanzo.ai → git-runner).
|
|
#
|
|
# This replaces .github/workflows/docker.yml, which was the only thing pushing
|
|
# this image and which ran on `runs-on: lux-build` — an ARC autoscaling runner
|
|
# set that no longer exists. The cluster has no ARC CRDs, no ARC namespace and
|
|
# no such pool, so every `v*` tag queued a job nothing could pick up. A job
|
|
# naming a label no runner carries does not fail; it waits.
|
|
#
|
|
# Two further things had to change for this to work off GitHub at all:
|
|
#
|
|
# * ghcr auth. The old workflow logged in with the instance GITHUB_TOKEN. On
|
|
# this forge that is a Hanzo Git token and carries no rights at ghcr.io, so
|
|
# the login step is a guaranteed failure. GHCR_USER / GHCR_TOKEN are org
|
|
# Actions secrets sourced from KMS, which is what luxfi/node and luxfi/kms
|
|
# authenticate with.
|
|
#
|
|
# * Layer cache. `type=gha` is the GitHub-hosted Actions cache service. The
|
|
# registry cache is backend-independent and lives next to the image it
|
|
# caches.
|
|
#
|
|
# Semver-only: only a v* tag produces a {{version}} manifest, plus an immutable
|
|
# sha tag on every run. No :latest, no floating tags.
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
# A release is not made irrelevant by a newer one — let it finish.
|
|
concurrency:
|
|
group: release-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
docker:
|
|
runs-on: [linux-amd64]
|
|
# The arm64 leg compiles under emulation; 45 minutes was sized for amd64
|
|
# alone and would abort the release part-way through the second platform.
|
|
timeout-minutes: 180
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# binfmt for the emulated arm64 leg. One job builds both platforms on the
|
|
# amd64 pool, so without an interpreter registered the arm64 RUN steps
|
|
# have nothing to execute.
|
|
- uses: docker/setup-qemu-action@v3
|
|
|
|
- uses: docker/setup-buildx-action@v3
|
|
with:
|
|
driver: docker-container
|
|
driver-opts: network=host
|
|
|
|
- uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ secrets.GHCR_USER }}
|
|
password: ${{ secrets.GHCR_TOKEN }}
|
|
|
|
- id: meta
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ghcr.io/luxfi/graph
|
|
flavor: latest=false
|
|
tags: |
|
|
type=semver,pattern={{version}}
|
|
type=sha,prefix=sha-
|
|
|
|
# Both architectures under one manifest list. The lab runs amd64 and
|
|
# arm64, so a single-arch tag deploys on half of it. arm64 is emulated:
|
|
# the Dockerfile builds graphd with CGO against sqlite-dev, so the compile
|
|
# runs inside the target-arch container rather than cross-compiling on
|
|
# TARGETARCH. Slower, not wrong — see the timeout above.
|
|
- uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
platforms: linux/amd64,linux/arm64
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
cache-from: type=registry,ref=ghcr.io/luxfi/graph:buildcache
|
|
cache-to: type=registry,ref=ghcr.io/luxfi/graph:buildcache,mode=max
|
|
provenance: false
|
|
push: true
|