mirror of
https://github.com/onyx-dot-app/onyx.git
synced 2026-10-23 20:02:57 -05:00
1818 lines
75 KiB
YAML
1818 lines
75 KiB
YAML
name: Build and Push Docker Images on Tag
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "*"
|
|
workflow_dispatch:
|
|
|
|
# Set restrictive default permissions for all jobs. Jobs that need more permissions
|
|
# should explicitly declare them.
|
|
permissions:
|
|
# Required for OIDC authentication with AWS
|
|
id-token: write # zizmor: ignore[excessive-permissions]
|
|
|
|
env:
|
|
EDGE_TAG: ${{ startsWith(github.ref_name, 'nightly-latest') }}
|
|
|
|
jobs:
|
|
# Determine which components to build based on the tag
|
|
determine-builds:
|
|
# NOTE: Github-hosted runners have about 20s faster queue times and are preferred here.
|
|
runs-on: ubuntu-slim
|
|
timeout-minutes: 90
|
|
outputs:
|
|
build-desktop: ${{ steps.check.outputs.build-desktop }}
|
|
build-web: ${{ steps.check.outputs.build-web }}
|
|
build-web-cloud: ${{ steps.check.outputs.build-web-cloud }}
|
|
build-backend: ${{ steps.check.outputs.build-backend }}
|
|
build-backend-craft: ${{ steps.check.outputs.build-backend-craft }}
|
|
build-model-server: ${{ steps.check.outputs.build-model-server }}
|
|
is-cloud-tag: ${{ steps.check.outputs.is-cloud-tag }}
|
|
is-stable: ${{ steps.check.outputs.is-stable }}
|
|
is-beta: ${{ steps.check.outputs.is-beta }}
|
|
is-stable-standalone: ${{ steps.check.outputs.is-stable-standalone }}
|
|
is-beta-standalone: ${{ steps.check.outputs.is-beta-standalone }}
|
|
is-craft-latest: ${{ steps.check.outputs.is-craft-latest }}
|
|
is-test-run: ${{ steps.check.outputs.is-test-run }}
|
|
sanitized-tag: ${{ steps.check.outputs.sanitized-tag }}
|
|
short-sha: ${{ steps.check.outputs.short-sha }}
|
|
steps:
|
|
- name: Check which components to build and version info
|
|
id: check
|
|
env:
|
|
EVENT_NAME: ${{ github.event_name }}
|
|
run: |
|
|
TAG="${GITHUB_REF_NAME}"
|
|
# Sanitize tag name by replacing slashes with hyphens (for Docker tag compatibility)
|
|
SANITIZED_TAG=$(echo "$TAG" | tr '/' '-')
|
|
SHORT_SHA="${GITHUB_SHA::7}"
|
|
|
|
# Initialize all flags to false
|
|
IS_CLOUD=false
|
|
IS_NIGHTLY=false
|
|
IS_VERSION_TAG=false
|
|
IS_STABLE=false
|
|
IS_BETA=false
|
|
IS_STABLE_STANDALONE=false
|
|
IS_BETA_STANDALONE=false
|
|
IS_CRAFT_LATEST=false
|
|
IS_PROD_TAG=false
|
|
IS_TEST_RUN=false
|
|
BUILD_DESKTOP=false
|
|
BUILD_WEB=false
|
|
BUILD_WEB_CLOUD=false
|
|
BUILD_BACKEND=true
|
|
BUILD_BACKEND_CRAFT=false
|
|
BUILD_MODEL_SERVER=true
|
|
|
|
# Determine tag type based on pattern matching (do regex checks once)
|
|
if [[ "$TAG" == craft-* ]]; then
|
|
IS_CRAFT_LATEST=true
|
|
fi
|
|
if [[ "$TAG" == *cloud* ]]; then
|
|
IS_CLOUD=true
|
|
fi
|
|
if [[ "$TAG" == nightly* ]]; then
|
|
IS_NIGHTLY=true
|
|
fi
|
|
if [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+ ]]; then
|
|
IS_VERSION_TAG=true
|
|
fi
|
|
if [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
|
IS_STABLE=true
|
|
fi
|
|
if [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-beta(\.[0-9]+)?$ ]]; then
|
|
IS_BETA=true
|
|
fi
|
|
|
|
# Determine what to build based on tag type
|
|
if [[ "$IS_CLOUD" == "true" ]]; then
|
|
BUILD_WEB_CLOUD=true
|
|
else
|
|
BUILD_WEB=true
|
|
# Only build desktop for semver tags (excluding beta)
|
|
if [[ "$IS_VERSION_TAG" == "true" ]] && [[ "$IS_BETA" != "true" ]]; then
|
|
BUILD_DESKTOP=true
|
|
fi
|
|
fi
|
|
|
|
# Craft-latest builds backend with Craft enabled
|
|
if [[ "$IS_CRAFT_LATEST" == "true" ]]; then
|
|
BUILD_BACKEND_CRAFT=true
|
|
BUILD_BACKEND=false
|
|
fi
|
|
|
|
# Standalone version checks (for backend/model-server - version excluding cloud tags)
|
|
if [[ "$IS_STABLE" == "true" ]] && [[ "$IS_CLOUD" != "true" ]]; then
|
|
IS_STABLE_STANDALONE=true
|
|
fi
|
|
if [[ "$IS_BETA" == "true" ]] && [[ "$IS_CLOUD" != "true" ]]; then
|
|
IS_BETA_STANDALONE=true
|
|
fi
|
|
|
|
# Determine if this is a production tag
|
|
# Production tags are: version tags (v1.2.3*) or nightly tags
|
|
if [[ "$IS_VERSION_TAG" == "true" ]] || [[ "$IS_NIGHTLY" == "true" ]]; then
|
|
IS_PROD_TAG=true
|
|
fi
|
|
|
|
# Determine if this is a test run (workflow_dispatch on non-production ref)
|
|
if [[ "$EVENT_NAME" == "workflow_dispatch" ]] && [[ "$IS_PROD_TAG" != "true" ]]; then
|
|
IS_TEST_RUN=true
|
|
fi
|
|
{
|
|
echo "build-desktop=$BUILD_DESKTOP"
|
|
echo "build-web=$BUILD_WEB"
|
|
echo "build-web-cloud=$BUILD_WEB_CLOUD"
|
|
echo "build-backend=$BUILD_BACKEND"
|
|
echo "build-backend-craft=$BUILD_BACKEND_CRAFT"
|
|
echo "build-model-server=$BUILD_MODEL_SERVER"
|
|
echo "is-cloud-tag=$IS_CLOUD"
|
|
echo "is-stable=$IS_STABLE"
|
|
echo "is-beta=$IS_BETA"
|
|
echo "is-stable-standalone=$IS_STABLE_STANDALONE"
|
|
echo "is-beta-standalone=$IS_BETA_STANDALONE"
|
|
echo "is-craft-latest=$IS_CRAFT_LATEST"
|
|
echo "is-test-run=$IS_TEST_RUN"
|
|
echo "sanitized-tag=$SANITIZED_TAG"
|
|
echo "short-sha=$SHORT_SHA"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
check-version-tag:
|
|
runs-on: ubuntu-slim
|
|
timeout-minutes: 10
|
|
if: ${{ !startsWith(github.ref_name, 'nightly-latest') && github.event_name != 'workflow_dispatch' }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
fetch-depth: 0
|
|
|
|
- name: Setup uv
|
|
uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # ratchet:astral-sh/setup-uv@v7
|
|
with:
|
|
version: "0.9.9"
|
|
# NOTE: This isn't caching much and zizmor suggests this could be poisoned, so disable.
|
|
enable-cache: false
|
|
|
|
- name: Validate tag is versioned correctly
|
|
run: |
|
|
uv run --no-sync --with release-tag tag --check
|
|
|
|
notify-slack-on-tag-check-failure:
|
|
needs:
|
|
- check-version-tag
|
|
if: always() && needs.check-version-tag.result == 'failure' && github.event_name != 'workflow_dispatch'
|
|
runs-on: ubuntu-slim
|
|
timeout-minutes: 10
|
|
environment: release
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Send Slack notification
|
|
uses: ./.github/actions/slack-notify
|
|
with:
|
|
webhook-url: ${{ secrets.MONITOR_DEPLOYMENTS_WEBHOOK }}
|
|
failed-jobs: "• check-version-tag"
|
|
title: "🚨 Version Tag Check Failed"
|
|
ref-name: ${{ github.ref_name }}
|
|
|
|
# Create GitHub release first, before desktop builds start.
|
|
# This ensures all desktop matrix jobs upload to the same release instead of
|
|
# racing to create duplicate releases.
|
|
create-release:
|
|
needs: determine-builds
|
|
if: needs.determine-builds.outputs.build-desktop == 'true'
|
|
runs-on: ubuntu-slim
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: write
|
|
outputs:
|
|
release-id: ${{ steps.create-release.outputs.id }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Determine release tag
|
|
id: release-tag
|
|
env:
|
|
IS_TEST_RUN: ${{ needs.determine-builds.outputs.is-test-run }}
|
|
SHORT_SHA: ${{ needs.determine-builds.outputs.short-sha }}
|
|
run: |
|
|
if [ "${IS_TEST_RUN}" == "true" ]; then
|
|
echo "tag=v0.0.0-dev+${SHORT_SHA}" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "tag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Create GitHub Release
|
|
id: create-release
|
|
uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # ratchet:softprops/action-gh-release@v2
|
|
with:
|
|
tag_name: ${{ steps.release-tag.outputs.tag }}
|
|
name: ${{ steps.release-tag.outputs.tag }}
|
|
body: "See the assets to download this version and install."
|
|
draft: true
|
|
prerelease: false
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
build-desktop:
|
|
needs:
|
|
- determine-builds
|
|
- create-release
|
|
if: needs.determine-builds.outputs.build-desktop == 'true'
|
|
permissions:
|
|
id-token: write
|
|
contents: write
|
|
actions: read
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- platform: "macos-latest" # Build a universal image for macOS.
|
|
args: "--target universal-apple-darwin"
|
|
- platform: "ubuntu-24.04"
|
|
args: "--bundles deb,rpm"
|
|
- platform: "ubuntu-24.04-arm" # Only available in public repos.
|
|
args: "--bundles deb,rpm"
|
|
- platform: "windows-latest"
|
|
args: ""
|
|
|
|
runs-on: ${{ matrix.platform }}
|
|
timeout-minutes: 90
|
|
environment: release
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
|
|
with:
|
|
# NOTE: persist-credentials is needed for tauri-action to upload assets to GitHub releases.
|
|
persist-credentials: true # zizmor: ignore[artipacked]
|
|
|
|
- name: Configure AWS credentials
|
|
if: startsWith(matrix.platform, 'macos-')
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
if: startsWith(matrix.platform, 'macos-')
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
APPLE_ID, deploy/apple-id
|
|
APPLE_PASSWORD, deploy/apple-password
|
|
APPLE_CERTIFICATE, deploy/apple-certificate
|
|
APPLE_CERTIFICATE_PASSWORD, deploy/apple-certificate-password
|
|
KEYCHAIN_PASSWORD, deploy/keychain-password
|
|
APPLE_TEAM_ID, deploy/apple-team-id
|
|
parse-json-secrets: true
|
|
|
|
- name: install dependencies (ubuntu only)
|
|
if: startsWith(matrix.platform, 'ubuntu-')
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y \
|
|
build-essential \
|
|
libglib2.0-dev \
|
|
libgirepository1.0-dev \
|
|
libgtk-3-dev \
|
|
libjavascriptcoregtk-4.1-dev \
|
|
libwebkit2gtk-4.1-dev \
|
|
libayatana-appindicator3-dev \
|
|
gobject-introspection \
|
|
pkg-config \
|
|
curl \
|
|
xdg-utils
|
|
|
|
- name: setup node
|
|
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # ratchet:actions/setup-node@v6.2.0
|
|
with:
|
|
node-version: 24
|
|
package-manager-cache: false
|
|
|
|
- name: install Rust stable
|
|
uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b # zizmor: ignore[impostor-commit]
|
|
with:
|
|
# Those targets are only used on macos runners so it's in an `if` to slightly speed up windows and linux builds.
|
|
targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
|
|
|
|
- name: install frontend dependencies
|
|
working-directory: ./desktop
|
|
run: npm install
|
|
|
|
- name: Inject version (Unix)
|
|
if: runner.os != 'Windows'
|
|
working-directory: ./desktop
|
|
env:
|
|
SHORT_SHA: ${{ needs.determine-builds.outputs.short-sha }}
|
|
IS_TEST_RUN: ${{ needs.determine-builds.outputs.is-test-run }}
|
|
run: |
|
|
if [ "${IS_TEST_RUN}" == "true" ]; then
|
|
VERSION="0.0.0-dev+${SHORT_SHA}"
|
|
else
|
|
VERSION="${GITHUB_REF_NAME#v}"
|
|
fi
|
|
echo "Injecting version: $VERSION"
|
|
|
|
# Update Cargo.toml
|
|
sed "s/^version = .*/version = \"$VERSION\"/" src-tauri/Cargo.toml > src-tauri/Cargo.toml.tmp
|
|
mv src-tauri/Cargo.toml.tmp src-tauri/Cargo.toml
|
|
|
|
# Update tauri.conf.json
|
|
jq --arg v "$VERSION" '.version = $v' src-tauri/tauri.conf.json > src-tauri/tauri.conf.json.tmp
|
|
mv src-tauri/tauri.conf.json.tmp src-tauri/tauri.conf.json
|
|
|
|
# Update package.json
|
|
jq --arg v "$VERSION" '.version = $v' package.json > package.json.tmp
|
|
mv package.json.tmp package.json
|
|
|
|
echo "Versions set to: $VERSION"
|
|
|
|
- name: Inject version (Windows)
|
|
if: runner.os == 'Windows'
|
|
working-directory: ./desktop
|
|
shell: pwsh
|
|
env:
|
|
IS_TEST_RUN: ${{ needs.determine-builds.outputs.is-test-run }}
|
|
run: |
|
|
# Windows MSI requires numeric-only build metadata, so we skip the SHA suffix
|
|
if ($env:IS_TEST_RUN -eq "true") {
|
|
$VERSION = "0.0.0"
|
|
} else {
|
|
# Strip 'v' prefix and any pre-release suffix (e.g., -beta.13) for MSI compatibility
|
|
$VERSION = "$env:GITHUB_REF_NAME" -replace '^v', '' -replace '-.*$', ''
|
|
}
|
|
Write-Host "Injecting version: $VERSION"
|
|
|
|
# Update Cargo.toml
|
|
$cargo = Get-Content src-tauri/Cargo.toml -Raw
|
|
$cargo = $cargo -replace '(?m)^version = .*', "version = `"$VERSION`""
|
|
Set-Content src-tauri/Cargo.toml $cargo -NoNewline
|
|
|
|
# Update tauri.conf.json
|
|
$json = Get-Content src-tauri/tauri.conf.json | ConvertFrom-Json
|
|
$json.version = $VERSION
|
|
$json | ConvertTo-Json -Depth 100 | Set-Content src-tauri/tauri.conf.json
|
|
|
|
# Update package.json
|
|
$pkg = Get-Content package.json | ConvertFrom-Json
|
|
$pkg.version = $VERSION
|
|
$pkg | ConvertTo-Json -Depth 100 | Set-Content package.json
|
|
|
|
Write-Host "Versions set to: $VERSION"
|
|
|
|
- name: Import Apple Developer Certificate
|
|
if: startsWith(matrix.platform, 'macos-')
|
|
run: |
|
|
echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
|
|
security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
|
|
security default-keychain -s build.keychain
|
|
security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
|
|
security set-keychain-settings -t 3600 -u build.keychain
|
|
security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
|
|
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
|
|
security find-identity -v -p codesigning build.keychain
|
|
|
|
- name: Verify Certificate
|
|
if: startsWith(matrix.platform, 'macos-')
|
|
run: |
|
|
CERT_INFO=$(security find-identity -v -p codesigning build.keychain | grep -E "(Developer ID Application|Apple Distribution|Apple Development)" | head -n 1)
|
|
CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
|
|
echo "CERT_ID=$CERT_ID" >> $GITHUB_ENV
|
|
echo "Certificate imported."
|
|
|
|
- uses: tauri-apps/tauri-action@73fb865345c54760d875b94642314f8c0c894afa # ratchet:tauri-apps/tauri-action@action-v0.6.1
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
APPLE_ID: ${{ env.APPLE_ID }}
|
|
APPLE_PASSWORD: ${{ env.APPLE_PASSWORD }}
|
|
APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }}
|
|
APPLE_TEAM_ID: ${{ env.APPLE_TEAM_ID }}
|
|
with:
|
|
# Use the release created by the create-release job to avoid race conditions
|
|
# when multiple matrix jobs try to create/update the same release simultaneously
|
|
releaseId: ${{ needs.create-release.outputs.release-id }}
|
|
assetNamePattern: "[name]_[arch][ext]"
|
|
args: ${{ matrix.args }}
|
|
|
|
build-web-amd64:
|
|
needs: determine-builds
|
|
if: needs.determine-builds.outputs.build-web == 'true'
|
|
runs-on:
|
|
- runs-on
|
|
- runner=4cpu-linux-x64
|
|
- run-id=${{ github.run_id }}-web-amd64
|
|
- extras=ecr-cache
|
|
timeout-minutes: 90
|
|
environment: release
|
|
outputs:
|
|
digest: ${{ steps.build.outputs.digest }}
|
|
env:
|
|
REGISTRY_IMAGE: onyxdotapp/onyx-web-server
|
|
steps:
|
|
- uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
DOCKER_USERNAME, deploy/docker-username
|
|
DOCKER_TOKEN, deploy/docker-token
|
|
parse-json-secrets: true
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5
|
|
with:
|
|
images: ${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }}
|
|
flavor: |
|
|
latest=false
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3
|
|
with:
|
|
username: ${{ env.DOCKER_USERNAME }}
|
|
password: ${{ env.DOCKER_TOKEN }}
|
|
|
|
- name: Build and push AMD64
|
|
id: build
|
|
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
|
|
with:
|
|
context: ./web
|
|
file: ./web/Dockerfile
|
|
platforms: linux/amd64
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
build-args: |
|
|
ONYX_VERSION=${{ github.ref_name }}
|
|
NODE_OPTIONS=--max-old-space-size=8192
|
|
cache-from: |
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:web-cache-amd64
|
|
type=registry,ref=${{ env.REGISTRY_IMAGE }}:edge
|
|
type=registry,ref=${{ env.REGISTRY_IMAGE }}:latest
|
|
cache-to: |
|
|
type=inline
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:web-cache-amd64,mode=max
|
|
outputs: type=image,name=${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
|
|
no-cache: ${{ vars.DOCKER_NO_CACHE == 'true' }}
|
|
|
|
build-web-arm64:
|
|
needs: determine-builds
|
|
if: needs.determine-builds.outputs.build-web == 'true'
|
|
runs-on:
|
|
- runs-on
|
|
- runner=4cpu-linux-arm64
|
|
- run-id=${{ github.run_id }}-web-arm64
|
|
- extras=ecr-cache
|
|
timeout-minutes: 90
|
|
environment: release
|
|
outputs:
|
|
digest: ${{ steps.build.outputs.digest }}
|
|
env:
|
|
REGISTRY_IMAGE: onyxdotapp/onyx-web-server
|
|
steps:
|
|
- uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
DOCKER_USERNAME, deploy/docker-username
|
|
DOCKER_TOKEN, deploy/docker-token
|
|
parse-json-secrets: true
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5
|
|
with:
|
|
images: ${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }}
|
|
flavor: |
|
|
latest=false
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3
|
|
with:
|
|
username: ${{ env.DOCKER_USERNAME }}
|
|
password: ${{ env.DOCKER_TOKEN }}
|
|
|
|
- name: Build and push ARM64
|
|
id: build
|
|
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
|
|
with:
|
|
context: ./web
|
|
file: ./web/Dockerfile
|
|
platforms: linux/arm64
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
build-args: |
|
|
ONYX_VERSION=${{ github.ref_name }}
|
|
NODE_OPTIONS=--max-old-space-size=8192
|
|
cache-from: |
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:web-cache-arm64
|
|
type=registry,ref=${{ env.REGISTRY_IMAGE }}:edge
|
|
type=registry,ref=${{ env.REGISTRY_IMAGE }}:latest
|
|
cache-to: |
|
|
type=inline
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:web-cache-arm64,mode=max
|
|
outputs: type=image,name=${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
|
|
no-cache: ${{ vars.DOCKER_NO_CACHE == 'true' }}
|
|
|
|
merge-web:
|
|
needs:
|
|
- determine-builds
|
|
- build-web-amd64
|
|
- build-web-arm64
|
|
runs-on:
|
|
- runs-on
|
|
- runner=2cpu-linux-x64
|
|
- run-id=${{ github.run_id }}-merge-web
|
|
- extras=ecr-cache
|
|
timeout-minutes: 90
|
|
environment: release
|
|
env:
|
|
REGISTRY_IMAGE: onyxdotapp/onyx-web-server
|
|
steps:
|
|
- uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
DOCKER_USERNAME, deploy/docker-username
|
|
DOCKER_TOKEN, deploy/docker-token
|
|
parse-json-secrets: true
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3
|
|
with:
|
|
username: ${{ env.DOCKER_USERNAME }}
|
|
password: ${{ env.DOCKER_TOKEN }}
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5
|
|
with:
|
|
images: ${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }}
|
|
flavor: |
|
|
latest=false
|
|
tags: |
|
|
type=raw,value=${{ needs.determine-builds.outputs.is-test-run == 'true' && format('web-{0}', needs.determine-builds.outputs.sanitized-tag) || github.ref_name }}
|
|
type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && needs.determine-builds.outputs.is-stable == 'true' && 'latest' || '' }}
|
|
type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && env.EDGE_TAG == 'true' && 'edge' || '' }}
|
|
type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && needs.determine-builds.outputs.is-beta == 'true' && 'beta' || '' }}
|
|
|
|
- name: Create and push manifest
|
|
env:
|
|
IMAGE_REPO: ${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }}
|
|
AMD64_DIGEST: ${{ needs.build-web-amd64.outputs.digest }}
|
|
ARM64_DIGEST: ${{ needs.build-web-arm64.outputs.digest }}
|
|
META_TAGS: ${{ steps.meta.outputs.tags }}
|
|
run: |
|
|
IMAGES="${IMAGE_REPO}@${AMD64_DIGEST} ${IMAGE_REPO}@${ARM64_DIGEST}"
|
|
docker buildx imagetools create \
|
|
$(printf '%s\n' "${META_TAGS}" | xargs -I {} echo -t {}) \
|
|
$IMAGES
|
|
|
|
build-web-cloud-amd64:
|
|
needs: determine-builds
|
|
if: needs.determine-builds.outputs.build-web-cloud == 'true'
|
|
runs-on:
|
|
- runs-on
|
|
- runner=4cpu-linux-x64
|
|
- run-id=${{ github.run_id }}-web-cloud-amd64
|
|
- extras=ecr-cache
|
|
timeout-minutes: 90
|
|
environment: release
|
|
outputs:
|
|
digest: ${{ steps.build.outputs.digest }}
|
|
env:
|
|
REGISTRY_IMAGE: onyxdotapp/onyx-web-server-cloud
|
|
steps:
|
|
- uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
DOCKER_USERNAME, deploy/docker-username
|
|
DOCKER_TOKEN, deploy/docker-token
|
|
parse-json-secrets: true
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5
|
|
with:
|
|
images: ${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }}
|
|
flavor: |
|
|
latest=false
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3
|
|
with:
|
|
username: ${{ env.DOCKER_USERNAME }}
|
|
password: ${{ env.DOCKER_TOKEN }}
|
|
|
|
- name: Build and push AMD64
|
|
id: build
|
|
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
|
|
with:
|
|
context: ./web
|
|
file: ./web/Dockerfile
|
|
platforms: linux/amd64
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
build-args: |
|
|
ONYX_VERSION=${{ github.ref_name }}
|
|
NEXT_PUBLIC_CLOUD_ENABLED=true
|
|
NEXT_PUBLIC_POSTHOG_KEY=${{ secrets.POSTHOG_KEY }}
|
|
NEXT_PUBLIC_POSTHOG_HOST=${{ secrets.POSTHOG_HOST }}
|
|
NEXT_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}
|
|
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=${{ secrets.STRIPE_PUBLISHABLE_KEY }}
|
|
NEXT_PUBLIC_RECAPTCHA_SITE_KEY=${{ vars.NEXT_PUBLIC_RECAPTCHA_SITE_KEY }}
|
|
NEXT_PUBLIC_GTM_ENABLED=true
|
|
NEXT_PUBLIC_FORGOT_PASSWORD_ENABLED=true
|
|
NEXT_PUBLIC_INCLUDE_ERROR_POPUP_SUPPORT_LINK=true
|
|
NODE_OPTIONS=--max-old-space-size=8192
|
|
cache-from: |
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:cloudweb-cache-amd64
|
|
type=registry,ref=${{ env.REGISTRY_IMAGE }}:latest
|
|
cache-to: |
|
|
type=inline
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:cloudweb-cache-amd64,mode=max
|
|
outputs: type=image,name=${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
|
|
no-cache: ${{ vars.DOCKER_NO_CACHE == 'true' }}
|
|
|
|
build-web-cloud-arm64:
|
|
needs: determine-builds
|
|
if: needs.determine-builds.outputs.build-web-cloud == 'true'
|
|
runs-on:
|
|
- runs-on
|
|
- runner=4cpu-linux-arm64
|
|
- run-id=${{ github.run_id }}-web-cloud-arm64
|
|
- extras=ecr-cache
|
|
timeout-minutes: 90
|
|
environment: release
|
|
outputs:
|
|
digest: ${{ steps.build.outputs.digest }}
|
|
env:
|
|
REGISTRY_IMAGE: onyxdotapp/onyx-web-server-cloud
|
|
steps:
|
|
- uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
DOCKER_USERNAME, deploy/docker-username
|
|
DOCKER_TOKEN, deploy/docker-token
|
|
parse-json-secrets: true
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5
|
|
with:
|
|
images: ${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }}
|
|
flavor: |
|
|
latest=false
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3
|
|
with:
|
|
username: ${{ env.DOCKER_USERNAME }}
|
|
password: ${{ env.DOCKER_TOKEN }}
|
|
|
|
- name: Build and push ARM64
|
|
id: build
|
|
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
|
|
with:
|
|
context: ./web
|
|
file: ./web/Dockerfile
|
|
platforms: linux/arm64
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
build-args: |
|
|
ONYX_VERSION=${{ github.ref_name }}
|
|
NEXT_PUBLIC_CLOUD_ENABLED=true
|
|
NEXT_PUBLIC_POSTHOG_KEY=${{ secrets.POSTHOG_KEY }}
|
|
NEXT_PUBLIC_POSTHOG_HOST=${{ secrets.POSTHOG_HOST }}
|
|
NEXT_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}
|
|
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=${{ secrets.STRIPE_PUBLISHABLE_KEY }}
|
|
NEXT_PUBLIC_RECAPTCHA_SITE_KEY=${{ vars.NEXT_PUBLIC_RECAPTCHA_SITE_KEY }}
|
|
NEXT_PUBLIC_GTM_ENABLED=true
|
|
NEXT_PUBLIC_FORGOT_PASSWORD_ENABLED=true
|
|
NEXT_PUBLIC_INCLUDE_ERROR_POPUP_SUPPORT_LINK=true
|
|
NODE_OPTIONS=--max-old-space-size=8192
|
|
cache-from: |
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:cloudweb-cache-arm64
|
|
type=registry,ref=${{ env.REGISTRY_IMAGE }}:latest
|
|
cache-to: |
|
|
type=inline
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:cloudweb-cache-arm64,mode=max
|
|
outputs: type=image,name=${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
|
|
no-cache: ${{ vars.DOCKER_NO_CACHE == 'true' }}
|
|
|
|
merge-web-cloud:
|
|
needs:
|
|
- determine-builds
|
|
- build-web-cloud-amd64
|
|
- build-web-cloud-arm64
|
|
runs-on:
|
|
- runs-on
|
|
- runner=2cpu-linux-x64
|
|
- run-id=${{ github.run_id }}-merge-web-cloud
|
|
- extras=ecr-cache
|
|
timeout-minutes: 90
|
|
environment: release
|
|
env:
|
|
REGISTRY_IMAGE: onyxdotapp/onyx-web-server-cloud
|
|
steps:
|
|
- uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
DOCKER_USERNAME, deploy/docker-username
|
|
DOCKER_TOKEN, deploy/docker-token
|
|
parse-json-secrets: true
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3
|
|
with:
|
|
username: ${{ env.DOCKER_USERNAME }}
|
|
password: ${{ env.DOCKER_TOKEN }}
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5
|
|
with:
|
|
images: ${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }}
|
|
flavor: |
|
|
latest=false
|
|
tags: |
|
|
type=raw,value=${{ needs.determine-builds.outputs.is-test-run == 'true' && format('web-cloud-{0}', needs.determine-builds.outputs.sanitized-tag) || github.ref_name }}
|
|
|
|
- name: Create and push manifest
|
|
env:
|
|
IMAGE_REPO: ${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }}
|
|
AMD64_DIGEST: ${{ needs.build-web-cloud-amd64.outputs.digest }}
|
|
ARM64_DIGEST: ${{ needs.build-web-cloud-arm64.outputs.digest }}
|
|
META_TAGS: ${{ steps.meta.outputs.tags }}
|
|
run: |
|
|
IMAGES="${IMAGE_REPO}@${AMD64_DIGEST} ${IMAGE_REPO}@${ARM64_DIGEST}"
|
|
docker buildx imagetools create \
|
|
$(printf '%s\n' "${META_TAGS}" | xargs -I {} echo -t {}) \
|
|
$IMAGES
|
|
|
|
build-backend-amd64:
|
|
needs: determine-builds
|
|
if: needs.determine-builds.outputs.build-backend == 'true'
|
|
runs-on:
|
|
- runs-on
|
|
- runner=2cpu-linux-x64
|
|
- run-id=${{ github.run_id }}-backend-amd64
|
|
- extras=ecr-cache
|
|
timeout-minutes: 90
|
|
environment: release
|
|
outputs:
|
|
digest: ${{ steps.build.outputs.digest }}
|
|
env:
|
|
REGISTRY_IMAGE: ${{ contains(github.ref_name, 'cloud') && 'onyxdotapp/onyx-backend-cloud' || 'onyxdotapp/onyx-backend' }}
|
|
steps:
|
|
- uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
|
|
|
|
- name: Checkout code
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
DOCKER_USERNAME, deploy/docker-username
|
|
DOCKER_TOKEN, deploy/docker-token
|
|
parse-json-secrets: true
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5
|
|
with:
|
|
images: ${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }}
|
|
flavor: |
|
|
latest=false
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3
|
|
with:
|
|
username: ${{ env.DOCKER_USERNAME }}
|
|
password: ${{ env.DOCKER_TOKEN }}
|
|
|
|
- name: Build and push AMD64
|
|
id: build
|
|
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
|
|
with:
|
|
context: ./backend
|
|
file: ./backend/Dockerfile
|
|
platforms: linux/amd64
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
build-args: |
|
|
ONYX_VERSION=${{ github.ref_name }}
|
|
cache-from: |
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:backend-cache-amd64
|
|
type=registry,ref=${{ env.REGISTRY_IMAGE }}:edge
|
|
type=registry,ref=${{ env.REGISTRY_IMAGE }}:latest
|
|
cache-to: |
|
|
type=inline
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:backend-cache-amd64,mode=max
|
|
outputs: type=image,name=${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
|
|
no-cache: ${{ vars.DOCKER_NO_CACHE == 'true' }}
|
|
|
|
build-backend-arm64:
|
|
needs: determine-builds
|
|
if: needs.determine-builds.outputs.build-backend == 'true'
|
|
runs-on:
|
|
- runs-on
|
|
- runner=2cpu-linux-arm64
|
|
- run-id=${{ github.run_id }}-backend-arm64
|
|
- extras=ecr-cache
|
|
timeout-minutes: 90
|
|
environment: release
|
|
outputs:
|
|
digest: ${{ steps.build.outputs.digest }}
|
|
env:
|
|
REGISTRY_IMAGE: ${{ contains(github.ref_name, 'cloud') && 'onyxdotapp/onyx-backend-cloud' || 'onyxdotapp/onyx-backend' }}
|
|
steps:
|
|
- uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
|
|
|
|
- name: Checkout code
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
DOCKER_USERNAME, deploy/docker-username
|
|
DOCKER_TOKEN, deploy/docker-token
|
|
parse-json-secrets: true
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5
|
|
with:
|
|
images: ${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }}
|
|
flavor: |
|
|
latest=false
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3
|
|
with:
|
|
username: ${{ env.DOCKER_USERNAME }}
|
|
password: ${{ env.DOCKER_TOKEN }}
|
|
|
|
- name: Build and push ARM64
|
|
id: build
|
|
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
|
|
with:
|
|
context: ./backend
|
|
file: ./backend/Dockerfile
|
|
platforms: linux/arm64
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
build-args: |
|
|
ONYX_VERSION=${{ github.ref_name }}
|
|
cache-from: |
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:backend-cache-arm64
|
|
type=registry,ref=${{ env.REGISTRY_IMAGE }}:edge
|
|
type=registry,ref=${{ env.REGISTRY_IMAGE }}:latest
|
|
cache-to: |
|
|
type=inline
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:backend-cache-arm64,mode=max
|
|
outputs: type=image,name=${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
|
|
no-cache: ${{ vars.DOCKER_NO_CACHE == 'true' }}
|
|
|
|
merge-backend:
|
|
needs:
|
|
- determine-builds
|
|
- build-backend-amd64
|
|
- build-backend-arm64
|
|
runs-on:
|
|
- runs-on
|
|
- runner=2cpu-linux-x64
|
|
- run-id=${{ github.run_id }}-merge-backend
|
|
- extras=ecr-cache
|
|
timeout-minutes: 90
|
|
environment: release
|
|
env:
|
|
REGISTRY_IMAGE: ${{ contains(github.ref_name, 'cloud') && 'onyxdotapp/onyx-backend-cloud' || 'onyxdotapp/onyx-backend' }}
|
|
steps:
|
|
- uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
DOCKER_USERNAME, deploy/docker-username
|
|
DOCKER_TOKEN, deploy/docker-token
|
|
parse-json-secrets: true
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3
|
|
with:
|
|
username: ${{ env.DOCKER_USERNAME }}
|
|
password: ${{ env.DOCKER_TOKEN }}
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5
|
|
with:
|
|
images: ${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }}
|
|
flavor: |
|
|
latest=false
|
|
tags: |
|
|
type=raw,value=${{ needs.determine-builds.outputs.is-test-run == 'true' && format('backend-{0}', needs.determine-builds.outputs.sanitized-tag) || github.ref_name }}
|
|
type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && needs.determine-builds.outputs.is-stable-standalone == 'true' && 'latest' || '' }}
|
|
type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && env.EDGE_TAG == 'true' && 'edge' || '' }}
|
|
type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && needs.determine-builds.outputs.is-beta-standalone == 'true' && 'beta' || '' }}
|
|
|
|
- name: Create and push manifest
|
|
env:
|
|
IMAGE_REPO: ${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }}
|
|
AMD64_DIGEST: ${{ needs.build-backend-amd64.outputs.digest }}
|
|
ARM64_DIGEST: ${{ needs.build-backend-arm64.outputs.digest }}
|
|
META_TAGS: ${{ steps.meta.outputs.tags }}
|
|
run: |
|
|
IMAGES="${IMAGE_REPO}@${AMD64_DIGEST} ${IMAGE_REPO}@${ARM64_DIGEST}"
|
|
docker buildx imagetools create \
|
|
$(printf '%s\n' "${META_TAGS}" | xargs -I {} echo -t {}) \
|
|
$IMAGES
|
|
|
|
build-backend-craft-amd64:
|
|
needs: determine-builds
|
|
if: needs.determine-builds.outputs.build-backend-craft == 'true'
|
|
runs-on:
|
|
- runs-on
|
|
- runner=2cpu-linux-x64
|
|
- run-id=${{ github.run_id }}-backend-craft-amd64
|
|
- extras=ecr-cache
|
|
timeout-minutes: 90
|
|
environment: release
|
|
outputs:
|
|
digest: ${{ steps.build.outputs.digest }}
|
|
env:
|
|
REGISTRY_IMAGE: onyxdotapp/onyx-backend
|
|
steps:
|
|
- uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
|
|
|
|
- name: Checkout code
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
DOCKER_USERNAME, deploy/docker-username
|
|
DOCKER_TOKEN, deploy/docker-token
|
|
parse-json-secrets: true
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5
|
|
with:
|
|
images: ${{ env.REGISTRY_IMAGE }}
|
|
flavor: |
|
|
latest=false
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3
|
|
with:
|
|
username: ${{ env.DOCKER_USERNAME }}
|
|
password: ${{ env.DOCKER_TOKEN }}
|
|
|
|
- name: Build and push AMD64
|
|
id: build
|
|
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
|
|
with:
|
|
context: ./backend
|
|
file: ./backend/Dockerfile
|
|
platforms: linux/amd64
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
build-args: |
|
|
ONYX_VERSION=${{ github.ref_name }}
|
|
ENABLE_CRAFT=true
|
|
cache-from: |
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:backend-craft-cache-amd64
|
|
type=registry,ref=${{ env.REGISTRY_IMAGE }}:latest
|
|
cache-to: |
|
|
type=inline
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:backend-craft-cache-amd64,mode=max
|
|
outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
|
|
no-cache: ${{ vars.DOCKER_NO_CACHE == 'true' }}
|
|
|
|
build-backend-craft-arm64:
|
|
needs: determine-builds
|
|
if: needs.determine-builds.outputs.build-backend-craft == 'true'
|
|
runs-on:
|
|
- runs-on
|
|
- runner=2cpu-linux-arm64
|
|
- run-id=${{ github.run_id }}-backend-craft-arm64
|
|
- extras=ecr-cache
|
|
timeout-minutes: 90
|
|
environment: release
|
|
outputs:
|
|
digest: ${{ steps.build.outputs.digest }}
|
|
env:
|
|
REGISTRY_IMAGE: onyxdotapp/onyx-backend
|
|
steps:
|
|
- uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
|
|
|
|
- name: Checkout code
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
DOCKER_USERNAME, deploy/docker-username
|
|
DOCKER_TOKEN, deploy/docker-token
|
|
parse-json-secrets: true
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5
|
|
with:
|
|
images: ${{ env.REGISTRY_IMAGE }}
|
|
flavor: |
|
|
latest=false
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3
|
|
with:
|
|
username: ${{ env.DOCKER_USERNAME }}
|
|
password: ${{ env.DOCKER_TOKEN }}
|
|
|
|
- name: Build and push ARM64
|
|
id: build
|
|
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
|
|
with:
|
|
context: ./backend
|
|
file: ./backend/Dockerfile
|
|
platforms: linux/arm64
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
build-args: |
|
|
ONYX_VERSION=${{ github.ref_name }}
|
|
ENABLE_CRAFT=true
|
|
cache-from: |
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:backend-craft-cache-arm64
|
|
type=registry,ref=${{ env.REGISTRY_IMAGE }}:latest
|
|
cache-to: |
|
|
type=inline
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:backend-craft-cache-arm64,mode=max
|
|
outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
|
|
no-cache: ${{ vars.DOCKER_NO_CACHE == 'true' }}
|
|
|
|
merge-backend-craft:
|
|
needs:
|
|
- determine-builds
|
|
- build-backend-craft-amd64
|
|
- build-backend-craft-arm64
|
|
if: needs.determine-builds.outputs.build-backend-craft == 'true'
|
|
runs-on:
|
|
- runs-on
|
|
- runner=2cpu-linux-x64
|
|
- run-id=${{ github.run_id }}-merge-backend-craft
|
|
- extras=ecr-cache
|
|
timeout-minutes: 90
|
|
environment: release
|
|
env:
|
|
REGISTRY_IMAGE: onyxdotapp/onyx-backend
|
|
steps:
|
|
- uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
DOCKER_USERNAME, deploy/docker-username
|
|
DOCKER_TOKEN, deploy/docker-token
|
|
parse-json-secrets: true
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3
|
|
with:
|
|
username: ${{ env.DOCKER_USERNAME }}
|
|
password: ${{ env.DOCKER_TOKEN }}
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5
|
|
with:
|
|
images: ${{ env.REGISTRY_IMAGE }}
|
|
flavor: |
|
|
latest=false
|
|
tags: |
|
|
type=raw,value=craft-latest
|
|
# TODO: Consider aligning craft-latest tags with regular backend builds (e.g., latest, edge, beta)
|
|
# to keep tagging strategy consistent across all backend images
|
|
|
|
- name: Create and push manifest
|
|
env:
|
|
IMAGE_REPO: ${{ env.REGISTRY_IMAGE }}
|
|
AMD64_DIGEST: ${{ needs.build-backend-craft-amd64.outputs.digest }}
|
|
ARM64_DIGEST: ${{ needs.build-backend-craft-arm64.outputs.digest }}
|
|
META_TAGS: ${{ steps.meta.outputs.tags }}
|
|
run: |
|
|
IMAGES="${IMAGE_REPO}@${AMD64_DIGEST} ${IMAGE_REPO}@${ARM64_DIGEST}"
|
|
docker buildx imagetools create \
|
|
$(printf '%s\n' "${META_TAGS}" | xargs -I {} echo -t {}) \
|
|
$IMAGES
|
|
|
|
build-model-server-amd64:
|
|
needs: determine-builds
|
|
if: needs.determine-builds.outputs.build-model-server == 'true'
|
|
runs-on:
|
|
- runs-on
|
|
- runner=2cpu-linux-x64
|
|
- run-id=${{ github.run_id }}-model-server-amd64
|
|
- volume=40gb
|
|
- extras=ecr-cache
|
|
timeout-minutes: 90
|
|
environment: release
|
|
outputs:
|
|
digest: ${{ steps.build.outputs.digest }}
|
|
env:
|
|
REGISTRY_IMAGE: ${{ contains(github.ref_name, 'cloud') && 'onyxdotapp/onyx-model-server-cloud' || 'onyxdotapp/onyx-model-server' }}
|
|
steps:
|
|
- uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
|
|
|
|
- name: Checkout code
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
DOCKER_USERNAME, deploy/docker-username
|
|
DOCKER_TOKEN, deploy/docker-token
|
|
parse-json-secrets: true
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5
|
|
with:
|
|
images: ${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }}
|
|
flavor: |
|
|
latest=false
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
|
|
with:
|
|
buildkitd-flags: ${{ vars.DOCKER_DEBUG == 'true' && '--debug' || '' }}
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3
|
|
with:
|
|
username: ${{ env.DOCKER_USERNAME }}
|
|
password: ${{ env.DOCKER_TOKEN }}
|
|
|
|
- name: Build and push AMD64
|
|
id: build
|
|
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
|
|
env:
|
|
DEBUG: ${{ vars.DOCKER_DEBUG == 'true' && 1 || 0 }}
|
|
with:
|
|
context: ./backend
|
|
file: ./backend/Dockerfile.model_server
|
|
platforms: linux/amd64
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
build-args: |
|
|
ONYX_VERSION=${{ github.ref_name }}
|
|
cache-from: |
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:model-server-cache-amd64
|
|
type=registry,ref=${{ env.REGISTRY_IMAGE }}:edge
|
|
type=registry,ref=${{ env.REGISTRY_IMAGE }}:latest
|
|
cache-to: |
|
|
type=inline
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:model-server-cache-amd64,mode=max
|
|
outputs: type=image,name=${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
|
|
no-cache: ${{ env.EDGE_TAG != 'true' && vars.MODEL_SERVER_NO_CACHE == 'true' }}
|
|
provenance: false
|
|
sbom: false
|
|
|
|
build-model-server-arm64:
|
|
needs: determine-builds
|
|
if: needs.determine-builds.outputs.build-model-server == 'true'
|
|
runs-on:
|
|
- runs-on
|
|
- runner=2cpu-linux-arm64
|
|
- run-id=${{ github.run_id }}-model-server-arm64
|
|
- volume=40gb
|
|
- extras=ecr-cache
|
|
timeout-minutes: 90
|
|
environment: release
|
|
outputs:
|
|
digest: ${{ steps.build.outputs.digest }}
|
|
env:
|
|
REGISTRY_IMAGE: ${{ contains(github.ref_name, 'cloud') && 'onyxdotapp/onyx-model-server-cloud' || 'onyxdotapp/onyx-model-server' }}
|
|
steps:
|
|
- uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
|
|
|
|
- name: Checkout code
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
DOCKER_USERNAME, deploy/docker-username
|
|
DOCKER_TOKEN, deploy/docker-token
|
|
parse-json-secrets: true
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5
|
|
with:
|
|
images: ${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }}
|
|
flavor: |
|
|
latest=false
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
|
|
with:
|
|
buildkitd-flags: ${{ vars.DOCKER_DEBUG == 'true' && '--debug' || '' }}
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3
|
|
with:
|
|
username: ${{ env.DOCKER_USERNAME }}
|
|
password: ${{ env.DOCKER_TOKEN }}
|
|
|
|
- name: Build and push ARM64
|
|
id: build
|
|
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
|
|
env:
|
|
DEBUG: ${{ vars.DOCKER_DEBUG == 'true' && 1 || 0 }}
|
|
with:
|
|
context: ./backend
|
|
file: ./backend/Dockerfile.model_server
|
|
platforms: linux/arm64
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
build-args: |
|
|
ONYX_VERSION=${{ github.ref_name }}
|
|
cache-from: |
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:model-server-cache-arm64
|
|
type=registry,ref=${{ env.REGISTRY_IMAGE }}:edge
|
|
type=registry,ref=${{ env.REGISTRY_IMAGE }}:latest
|
|
cache-to: |
|
|
type=inline
|
|
type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:model-server-cache-arm64,mode=max
|
|
outputs: type=image,name=${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
|
|
no-cache: ${{ env.EDGE_TAG != 'true' && vars.MODEL_SERVER_NO_CACHE == 'true' }}
|
|
provenance: false
|
|
sbom: false
|
|
|
|
merge-model-server:
|
|
needs:
|
|
- determine-builds
|
|
- build-model-server-amd64
|
|
- build-model-server-arm64
|
|
runs-on:
|
|
- runs-on
|
|
- runner=2cpu-linux-x64
|
|
- run-id=${{ github.run_id }}-merge-model-server
|
|
- extras=ecr-cache
|
|
timeout-minutes: 90
|
|
environment: release
|
|
env:
|
|
REGISTRY_IMAGE: ${{ contains(github.ref_name, 'cloud') && 'onyxdotapp/onyx-model-server-cloud' || 'onyxdotapp/onyx-model-server' }}
|
|
steps:
|
|
- uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
DOCKER_USERNAME, deploy/docker-username
|
|
DOCKER_TOKEN, deploy/docker-token
|
|
parse-json-secrets: true
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3
|
|
with:
|
|
username: ${{ env.DOCKER_USERNAME }}
|
|
password: ${{ env.DOCKER_TOKEN }}
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5
|
|
with:
|
|
images: ${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }}
|
|
flavor: |
|
|
latest=false
|
|
tags: |
|
|
type=raw,value=${{ needs.determine-builds.outputs.is-test-run == 'true' && format('model-server-{0}', needs.determine-builds.outputs.sanitized-tag) || github.ref_name }}
|
|
type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && needs.determine-builds.outputs.is-stable-standalone == 'true' && 'latest' || '' }}
|
|
type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && env.EDGE_TAG == 'true' && 'edge' || '' }}
|
|
type=raw,value=${{ needs.determine-builds.outputs.is-test-run != 'true' && needs.determine-builds.outputs.is-beta-standalone == 'true' && 'beta' || '' }}
|
|
|
|
- name: Create and push manifest
|
|
env:
|
|
IMAGE_REPO: ${{ needs.determine-builds.outputs.is-test-run == 'true' && env.RUNS_ON_ECR_CACHE || env.REGISTRY_IMAGE }}
|
|
AMD64_DIGEST: ${{ needs.build-model-server-amd64.outputs.digest }}
|
|
ARM64_DIGEST: ${{ needs.build-model-server-arm64.outputs.digest }}
|
|
META_TAGS: ${{ steps.meta.outputs.tags }}
|
|
run: |
|
|
IMAGES="${IMAGE_REPO}@${AMD64_DIGEST} ${IMAGE_REPO}@${ARM64_DIGEST}"
|
|
docker buildx imagetools create \
|
|
$(printf '%s\n' "${META_TAGS}" | xargs -I {} echo -t {}) \
|
|
$IMAGES
|
|
|
|
trivy-scan-web:
|
|
needs:
|
|
- determine-builds
|
|
- merge-web
|
|
if: needs.merge-web.result == 'success'
|
|
runs-on:
|
|
- runs-on
|
|
- runner=2cpu-linux-arm64
|
|
- run-id=${{ github.run_id }}-trivy-scan-web
|
|
- extras=ecr-cache
|
|
timeout-minutes: 90
|
|
environment: release
|
|
env:
|
|
REGISTRY_IMAGE: onyxdotapp/onyx-web-server
|
|
steps:
|
|
- uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
DOCKER_USERNAME, deploy/docker-username
|
|
DOCKER_TOKEN, deploy/docker-token
|
|
parse-json-secrets: true
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # ratchet:nick-fields/retry@v3
|
|
with:
|
|
timeout_minutes: 30
|
|
max_attempts: 3
|
|
retry_wait_seconds: 10
|
|
command: |
|
|
if [ "${{ needs.determine-builds.outputs.is-test-run }}" == "true" ]; then
|
|
SCAN_IMAGE="${{ env.RUNS_ON_ECR_CACHE }}:web-${{ needs.determine-builds.outputs.sanitized-tag }}"
|
|
else
|
|
SCAN_IMAGE="docker.io/${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }}"
|
|
fi
|
|
docker run --rm -v $HOME/.cache/trivy:/root/.cache/trivy \
|
|
-e TRIVY_DB_REPOSITORY="public.ecr.aws/aquasecurity/trivy-db:2" \
|
|
-e TRIVY_JAVA_DB_REPOSITORY="public.ecr.aws/aquasecurity/trivy-java-db:1" \
|
|
-e TRIVY_USERNAME="${{ env.DOCKER_USERNAME }}" \
|
|
-e TRIVY_PASSWORD="${{ env.DOCKER_TOKEN }}" \
|
|
aquasec/trivy@sha256:a22415a38938a56c379387a8163fcb0ce38b10ace73e593475d3658d578b2436 \
|
|
image \
|
|
--skip-version-check \
|
|
--timeout 20m \
|
|
--severity CRITICAL,HIGH \
|
|
${SCAN_IMAGE}
|
|
|
|
trivy-scan-web-cloud:
|
|
needs:
|
|
- determine-builds
|
|
- merge-web-cloud
|
|
if: needs.merge-web-cloud.result == 'success'
|
|
runs-on:
|
|
- runs-on
|
|
- runner=2cpu-linux-arm64
|
|
- run-id=${{ github.run_id }}-trivy-scan-web-cloud
|
|
- extras=ecr-cache
|
|
timeout-minutes: 90
|
|
environment: release
|
|
env:
|
|
REGISTRY_IMAGE: onyxdotapp/onyx-web-server-cloud
|
|
steps:
|
|
- uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
DOCKER_USERNAME, deploy/docker-username
|
|
DOCKER_TOKEN, deploy/docker-token
|
|
parse-json-secrets: true
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # ratchet:nick-fields/retry@v3
|
|
with:
|
|
timeout_minutes: 30
|
|
max_attempts: 3
|
|
retry_wait_seconds: 10
|
|
command: |
|
|
if [ "${{ needs.determine-builds.outputs.is-test-run }}" == "true" ]; then
|
|
SCAN_IMAGE="${{ env.RUNS_ON_ECR_CACHE }}:web-cloud-${{ needs.determine-builds.outputs.sanitized-tag }}"
|
|
else
|
|
SCAN_IMAGE="docker.io/${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }}"
|
|
fi
|
|
docker run --rm -v $HOME/.cache/trivy:/root/.cache/trivy \
|
|
-e TRIVY_DB_REPOSITORY="public.ecr.aws/aquasecurity/trivy-db:2" \
|
|
-e TRIVY_JAVA_DB_REPOSITORY="public.ecr.aws/aquasecurity/trivy-java-db:1" \
|
|
-e TRIVY_USERNAME="${{ env.DOCKER_USERNAME }}" \
|
|
-e TRIVY_PASSWORD="${{ env.DOCKER_TOKEN }}" \
|
|
aquasec/trivy@sha256:a22415a38938a56c379387a8163fcb0ce38b10ace73e593475d3658d578b2436 \
|
|
image \
|
|
--skip-version-check \
|
|
--timeout 20m \
|
|
--severity CRITICAL,HIGH \
|
|
${SCAN_IMAGE}
|
|
|
|
trivy-scan-backend:
|
|
needs:
|
|
- determine-builds
|
|
- merge-backend
|
|
if: needs.merge-backend.result == 'success'
|
|
runs-on:
|
|
- runs-on
|
|
- runner=2cpu-linux-arm64
|
|
- run-id=${{ github.run_id }}-trivy-scan-backend
|
|
- extras=ecr-cache
|
|
timeout-minutes: 90
|
|
environment: release
|
|
env:
|
|
REGISTRY_IMAGE: ${{ contains(github.ref_name, 'cloud') && 'onyxdotapp/onyx-backend-cloud' || 'onyxdotapp/onyx-backend' }}
|
|
steps:
|
|
- uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
DOCKER_USERNAME, deploy/docker-username
|
|
DOCKER_TOKEN, deploy/docker-token
|
|
parse-json-secrets: true
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # ratchet:nick-fields/retry@v3
|
|
with:
|
|
timeout_minutes: 30
|
|
max_attempts: 3
|
|
retry_wait_seconds: 10
|
|
command: |
|
|
if [ "${{ needs.determine-builds.outputs.is-test-run }}" == "true" ]; then
|
|
SCAN_IMAGE="${{ env.RUNS_ON_ECR_CACHE }}:backend-${{ needs.determine-builds.outputs.sanitized-tag }}"
|
|
else
|
|
SCAN_IMAGE="docker.io/${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }}"
|
|
fi
|
|
docker run --rm -v $HOME/.cache/trivy:/root/.cache/trivy \
|
|
-v ${{ github.workspace }}/backend/.trivyignore:/tmp/.trivyignore:ro \
|
|
-e TRIVY_DB_REPOSITORY="public.ecr.aws/aquasecurity/trivy-db:2" \
|
|
-e TRIVY_JAVA_DB_REPOSITORY="public.ecr.aws/aquasecurity/trivy-java-db:1" \
|
|
-e TRIVY_USERNAME="${{ env.DOCKER_USERNAME }}" \
|
|
-e TRIVY_PASSWORD="${{ env.DOCKER_TOKEN }}" \
|
|
aquasec/trivy@sha256:a22415a38938a56c379387a8163fcb0ce38b10ace73e593475d3658d578b2436 \
|
|
image \
|
|
--skip-version-check \
|
|
--timeout 20m \
|
|
--severity CRITICAL,HIGH \
|
|
--ignorefile /tmp/.trivyignore \
|
|
${SCAN_IMAGE}
|
|
|
|
trivy-scan-model-server:
|
|
needs:
|
|
- determine-builds
|
|
- merge-model-server
|
|
if: needs.merge-model-server.result == 'success'
|
|
runs-on:
|
|
- runs-on
|
|
- runner=2cpu-linux-arm64
|
|
- run-id=${{ github.run_id }}-trivy-scan-model-server
|
|
- extras=ecr-cache
|
|
timeout-minutes: 90
|
|
environment: release
|
|
env:
|
|
REGISTRY_IMAGE: ${{ contains(github.ref_name, 'cloud') && 'onyxdotapp/onyx-model-server-cloud' || 'onyxdotapp/onyx-model-server' }}
|
|
steps:
|
|
- uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Get AWS Secrets
|
|
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
|
|
with:
|
|
secret-ids: |
|
|
DOCKER_USERNAME, deploy/docker-username
|
|
DOCKER_TOKEN, deploy/docker-token
|
|
parse-json-secrets: true
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # ratchet:nick-fields/retry@v3
|
|
with:
|
|
timeout_minutes: 30
|
|
max_attempts: 3
|
|
retry_wait_seconds: 10
|
|
command: |
|
|
if [ "${{ needs.determine-builds.outputs.is-test-run }}" == "true" ]; then
|
|
SCAN_IMAGE="${{ env.RUNS_ON_ECR_CACHE }}:model-server-${{ needs.determine-builds.outputs.sanitized-tag }}"
|
|
else
|
|
SCAN_IMAGE="docker.io/${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }}"
|
|
fi
|
|
docker run --rm -v $HOME/.cache/trivy:/root/.cache/trivy \
|
|
-e TRIVY_DB_REPOSITORY="public.ecr.aws/aquasecurity/trivy-db:2" \
|
|
-e TRIVY_JAVA_DB_REPOSITORY="public.ecr.aws/aquasecurity/trivy-java-db:1" \
|
|
-e TRIVY_USERNAME="${{ env.DOCKER_USERNAME }}" \
|
|
-e TRIVY_PASSWORD="${{ env.DOCKER_TOKEN }}" \
|
|
aquasec/trivy@sha256:a22415a38938a56c379387a8163fcb0ce38b10ace73e593475d3658d578b2436 \
|
|
image \
|
|
--skip-version-check \
|
|
--timeout 20m \
|
|
--severity CRITICAL,HIGH \
|
|
${SCAN_IMAGE}
|
|
|
|
notify-slack-on-failure:
|
|
needs:
|
|
- determine-builds
|
|
- build-desktop
|
|
- build-web-amd64
|
|
- build-web-arm64
|
|
- merge-web
|
|
- build-web-cloud-amd64
|
|
- build-web-cloud-arm64
|
|
- merge-web-cloud
|
|
- build-backend-amd64
|
|
- build-backend-arm64
|
|
- merge-backend
|
|
- build-backend-craft-amd64
|
|
- build-backend-craft-arm64
|
|
- merge-backend-craft
|
|
- build-model-server-amd64
|
|
- build-model-server-arm64
|
|
- merge-model-server
|
|
if: always() && (needs.build-desktop.result == 'failure' || needs.build-web-amd64.result == 'failure' || needs.build-web-arm64.result == 'failure' || needs.merge-web.result == 'failure' || needs.build-web-cloud-amd64.result == 'failure' || needs.build-web-cloud-arm64.result == 'failure' || needs.merge-web-cloud.result == 'failure' || needs.build-backend-amd64.result == 'failure' || needs.build-backend-arm64.result == 'failure' || needs.merge-backend.result == 'failure' || (needs.determine-builds.outputs.build-backend-craft == 'true' && (needs.build-backend-craft-amd64.result == 'failure' || needs.build-backend-craft-arm64.result == 'failure' || needs.merge-backend-craft.result == 'failure')) || needs.build-model-server-amd64.result == 'failure' || needs.build-model-server-arm64.result == 'failure' || needs.merge-model-server.result == 'failure') && needs.determine-builds.outputs.is-test-run != 'true'
|
|
# NOTE: Github-hosted runners have about 20s faster queue times and are preferred here.
|
|
runs-on: ubuntu-slim
|
|
timeout-minutes: 90
|
|
environment: release
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Determine failed jobs
|
|
id: failed-jobs
|
|
shell: bash
|
|
run: |
|
|
FAILED_JOBS=""
|
|
if [ "${NEEDS_BUILD_DESKTOP_RESULT}" == "failure" ]; then
|
|
FAILED_JOBS="${FAILED_JOBS}• build-desktop\\n"
|
|
fi
|
|
if [ "${NEEDS_BUILD_WEB_AMD64_RESULT}" == "failure" ]; then
|
|
FAILED_JOBS="${FAILED_JOBS}• build-web-amd64\\n"
|
|
fi
|
|
if [ "${NEEDS_BUILD_WEB_ARM64_RESULT}" == "failure" ]; then
|
|
FAILED_JOBS="${FAILED_JOBS}• build-web-arm64\\n"
|
|
fi
|
|
if [ "${NEEDS_MERGE_WEB_RESULT}" == "failure" ]; then
|
|
FAILED_JOBS="${FAILED_JOBS}• merge-web\\n"
|
|
fi
|
|
if [ "${NEEDS_BUILD_WEB_CLOUD_AMD64_RESULT}" == "failure" ]; then
|
|
FAILED_JOBS="${FAILED_JOBS}• build-web-cloud-amd64\\n"
|
|
fi
|
|
if [ "${NEEDS_BUILD_WEB_CLOUD_ARM64_RESULT}" == "failure" ]; then
|
|
FAILED_JOBS="${FAILED_JOBS}• build-web-cloud-arm64\\n"
|
|
fi
|
|
if [ "${NEEDS_MERGE_WEB_CLOUD_RESULT}" == "failure" ]; then
|
|
FAILED_JOBS="${FAILED_JOBS}• merge-web-cloud\\n"
|
|
fi
|
|
if [ "${NEEDS_BUILD_BACKEND_AMD64_RESULT}" == "failure" ]; then
|
|
FAILED_JOBS="${FAILED_JOBS}• build-backend-amd64\\n"
|
|
fi
|
|
if [ "${NEEDS_BUILD_BACKEND_ARM64_RESULT}" == "failure" ]; then
|
|
FAILED_JOBS="${FAILED_JOBS}• build-backend-arm64\\n"
|
|
fi
|
|
if [ "${NEEDS_MERGE_BACKEND_RESULT}" == "failure" ]; then
|
|
FAILED_JOBS="${FAILED_JOBS}• merge-backend\\n"
|
|
fi
|
|
if [ "${NEEDS_BUILD_MODEL_SERVER_AMD64_RESULT}" == "failure" ]; then
|
|
FAILED_JOBS="${FAILED_JOBS}• build-model-server-amd64\\n"
|
|
fi
|
|
if [ "${NEEDS_BUILD_MODEL_SERVER_ARM64_RESULT}" == "failure" ]; then
|
|
FAILED_JOBS="${FAILED_JOBS}• build-model-server-arm64\\n"
|
|
fi
|
|
if [ "${NEEDS_MERGE_MODEL_SERVER_RESULT}" == "failure" ]; then
|
|
FAILED_JOBS="${FAILED_JOBS}• merge-model-server\\n"
|
|
fi
|
|
# Remove trailing \n and set output
|
|
FAILED_JOBS=$(printf '%s' "$FAILED_JOBS" | sed 's/\\n$//')
|
|
echo "jobs=$FAILED_JOBS" >> "$GITHUB_OUTPUT"
|
|
env:
|
|
NEEDS_BUILD_DESKTOP_RESULT: ${{ needs.build-desktop.result }}
|
|
NEEDS_BUILD_WEB_AMD64_RESULT: ${{ needs.build-web-amd64.result }}
|
|
NEEDS_BUILD_WEB_ARM64_RESULT: ${{ needs.build-web-arm64.result }}
|
|
NEEDS_MERGE_WEB_RESULT: ${{ needs.merge-web.result }}
|
|
NEEDS_BUILD_WEB_CLOUD_AMD64_RESULT: ${{ needs.build-web-cloud-amd64.result }}
|
|
NEEDS_BUILD_WEB_CLOUD_ARM64_RESULT: ${{ needs.build-web-cloud-arm64.result }}
|
|
NEEDS_MERGE_WEB_CLOUD_RESULT: ${{ needs.merge-web-cloud.result }}
|
|
NEEDS_BUILD_BACKEND_AMD64_RESULT: ${{ needs.build-backend-amd64.result }}
|
|
NEEDS_BUILD_BACKEND_ARM64_RESULT: ${{ needs.build-backend-arm64.result }}
|
|
NEEDS_MERGE_BACKEND_RESULT: ${{ needs.merge-backend.result }}
|
|
NEEDS_BUILD_MODEL_SERVER_AMD64_RESULT: ${{ needs.build-model-server-amd64.result }}
|
|
NEEDS_BUILD_MODEL_SERVER_ARM64_RESULT: ${{ needs.build-model-server-arm64.result }}
|
|
NEEDS_MERGE_MODEL_SERVER_RESULT: ${{ needs.merge-model-server.result }}
|
|
|
|
- name: Send Slack notification
|
|
uses: ./.github/actions/slack-notify
|
|
with:
|
|
webhook-url: ${{ secrets.MONITOR_DEPLOYMENTS_WEBHOOK }}
|
|
failed-jobs: ${{ steps.failed-jobs.outputs.jobs }}
|
|
title: "🚨 Deployment Workflow Failed"
|
|
ref-name: ${{ github.ref_name }}
|