Container.yml

# Based on:
# * <https://docs.github.com/en/actions/publishing-packages/publishing-docker-images>
# * <https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners>

name: Publish Docker container

on:
  push:
    tags:
      - 'v*'
    branches:
      - main

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  JULIA_VERSION: "1.12"

jobs:
  build:
    name: Container for ${{ matrix.platform }} - CUDA ${{ matrix.cuda }}
    permissions:
      contents: read
      packages: write

    strategy:
      matrix:
        cuda: ["12.9", "13.2"]
        platform: ["linux/amd64"]
        os: ["ubuntu-24.04"]
        include:
          # Additional arm64 build for the latest CUDA version.
          - cuda: "13.2"
            platform: "linux/arm64"
            os: "ubuntu-24.04-arm"

    runs-on: ${{ matrix.os }}

    steps:
      - name: Check out the repo
        uses: actions/checkout@v6

      - name: Compute build variables
        id: vars
        run: |
          # Docker rejects uppercase image names.
          image=$(echo "${IMAGE_NAME}" | tr 'A-Z' 'a-z')
          echo "image=${image}" >> $GITHUB_OUTPUT

          cuda_major=$(echo ${{ matrix.cuda }} | cut -d'.' -f1)
          echo "variant=cuda${cuda_major}" >> $GITHUB_OUTPUT

          # platform is e.g. linux/amd64 — use a slug for filenames and artifact names.
          echo "platform_slug=$(echo "${{ matrix.platform }}" | tr / -)" >> $GITHUB_OUTPUT

          version=$(grep "^version = " Project.toml | cut -d'"' -f2)
          echo "version=${version}" >> $GITHUB_OUTPUT

          if [[ "${{ matrix.platform }}" == "linux/amd64" ]]; then
            echo "cpu_target=generic;sandybridge,-xsaveopt,clone_all;haswell,-rdrnd,base(1)" >> $GITHUB_OUTPUT
          elif [[ "${{ matrix.platform }}" == "linux/arm64" ]]; then
            echo "cpu_target=generic;cortex-a57;thunderx2t99;carmel,clone_all;apple-m1,base(3);neoverse-512tvb,base(3)" >> $GITHUB_OUTPUT
          fi

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push image by digest
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: ${{ matrix.platform }}
          provenance: false
          labels: |
            org.opencontainers.image.version=${{ steps.vars.outputs.version }}
          outputs: type=image,name=${{ env.REGISTRY }}/${{ steps.vars.outputs.image }},push-by-digest=true,name-canonical=true,push=true
          build-args: |
            JULIA_VERSION=${{ env.JULIA_VERSION }}
            CUDA_VERSION=${{ matrix.cuda }}
            PACKAGE_REF=${{ github.ref_type == 'tag' && github.ref_name || github.sha }}
            JULIA_CPU_TARGET=${{ steps.vars.outputs.cpu_target }}

      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          # "__" separator avoids collisions with hyphens in either part.
          echo "${{ steps.build.outputs.digest }}" \
            > "/tmp/digests/${{ steps.vars.outputs.variant }}__${{ steps.vars.outputs.platform_slug }}"

      - name: Upload digest
        uses: actions/upload-artifact@v7
        with:
          name: digest-${{ steps.vars.outputs.variant }}-${{ steps.vars.outputs.platform_slug }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    name: Merge multi-arch manifests
    needs: build
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write

    steps:
      - name: Lowercase image name
        id: image
        run: |
          echo "name=$(echo "${IMAGE_NAME}" | tr 'A-Z' 'a-z')" >> $GITHUB_OUTPUT

      - name: Classify ref
        id: ref
        run: |
          # base_name: the version-like prefix used in `<base>-cuda<c>` tags.
          # is_stable: whether to additionally publish the bare `cuda<c>` alias
          # (i.e. on non-prerelease release tag pushes).
          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
            echo "base_name=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT
            if [[ "${GITHUB_REF_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
              echo "is_stable=true" >> $GITHUB_OUTPUT
            else
              echo "is_stable=false" >> $GITHUB_OUTPUT
            fi
          else
            echo "base_name=dev" >> $GITHUB_OUTPUT
            echo "is_stable=false" >> $GITHUB_OUTPUT
          fi

      - name: Download digests
        uses: actions/download-artifact@v8
        with:
          path: /tmp/digests
          pattern: digest-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create manifest lists
        env:
          IMAGE: ${{ env.REGISTRY }}/${{ steps.image.outputs.name }}
          BASE_NAME: ${{ steps.ref.outputs.base_name }}
          IS_STABLE: ${{ steps.ref.outputs.is_stable }}
        run: |
          set -euo pipefail

          # Group digest files by variant (everything before "__").
          declare -A variants
          for file in /tmp/digests/*; do
            name=${file##*/}
            variants[${name%%__*}]=1
          done

          for variant in "${!variants[@]}"; do
            sources=()
            for file in /tmp/digests/"${variant}"__*; do
              sources+=("${IMAGE}@$(cat "${file}")")
            done

            # Always: <base>-<variant> (e.g. v6.1.0-cuda13, dev-cuda13)
            tags=("${IMAGE}:${BASE_NAME}-${variant}")
            # On stable releases, additionally publish the bare <variant>
            # alias (e.g. cuda13) pointing at the latest stable release.
            if [[ "${IS_STABLE}" == "true" ]]; then
              tags+=("${IMAGE}:${variant}")
            fi

            tag_args=()
            for tag in "${tags[@]}"; do
              tag_args+=(--tag "${tag}")
            done

            echo "Creating manifest ${tags[*]} from ${#sources[@]} platforms"
            docker buildx imagetools create "${tag_args[@]}" "${sources[@]}"
          done