fix(mesh): publish the estate so every transport can report it #1077
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker | |
| on: | |
| push: | |
| # `main` is the release branch: pushes here publish the released image and | |
| # update `latest`; `v*` tags publish versioned images. develop does not | |
| # publish — it is validated via the pull_request trigger below. | |
| branches: [main] | |
| tags: ["v*"] | |
| pull_request: | |
| branches: [main, develop] | |
| workflow_dispatch: | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| # Run the image before anyone can publish it. A green `build` only proves the | |
| # Dockerfile compiles — it never started a container, so defects that break | |
| # the first documented command shipped anyway (#2187, #2188). This builds | |
| # amd64 natively, loads it into the local daemon, and exercises the README | |
| # paths: CLI mine + verbatim search across two containers, a real MCP stdio | |
| # handshake, and `compose config` on both shipped Compose files. | |
| smoke: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| # amd64 only and `load: true`: the smoke run needs a real image in the | |
| # local daemon, and buildx cannot load a multi-arch manifest. Shares the | |
| # `build` job's gha cache scope, so this is mostly a cache hit. | |
| - name: Build image for smoke test | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| platforms: linux/amd64 | |
| push: false | |
| load: true | |
| tags: mempalace:smoke | |
| # Read the publish job's cache too (its amd64 layers are identical), | |
| # but write to a private scope so an amd64-only export never lands on | |
| # top of that job's multi-arch one. Same split as `scope=gpu` below. | |
| cache-from: | | |
| type=gha | |
| type=gha,scope=smoke | |
| cache-to: ${{ github.event_name != 'pull_request' && 'type=gha,mode=max,scope=smoke' || '' }} | |
| # Reaches Chroma's S3 once to fetch the ~80 MB embedding model, so it is | |
| # network-dependent; that download is itself part of a user's first run. | |
| - name: Smoke test | |
| run: ./scripts/docker-smoke.sh mempalace:smoke | |
| build: | |
| runs-on: ubuntu-latest | |
| # Never publish an image the smoke test has not cleared. | |
| needs: smoke | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # Needed for the emulated linux/arm64 build on real pushes. | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| # Only authenticate + push for in-repo events. Fork PRs lack the | |
| # packages:write token, so they build (to validate the Dockerfile) but | |
| # do not push. | |
| - name: Log in to GHCR | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@v4.5.2 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata | |
| id: meta | |
| uses: docker/metadata-action@v6 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| # latest -> main (the latest release); semver tags -> released versions. | |
| tags: | | |
| type=ref,event=branch | |
| type=ref,event=pr | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }} | |
| - name: Build and push | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| # Publish multi-arch (amd64 + arm64 for Apple Silicon / ARM hosts) on | |
| # real pushes; keep PRs amd64-only so the emulated arm64 build does not | |
| # slow the PR check. | |
| platforms: ${{ github.event_name != 'pull_request' && 'linux/amd64,linux/arm64' || 'linux/amd64' }} | |
| push: ${{ github.event_name != 'pull_request' }} | |
| provenance: mode=max | |
| sbom: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| # Fork PRs get a read-only Actions cache, so writing it just emits 403 | |
| # noise — only export cache on in-repo events. | |
| cache-to: ${{ github.event_name != 'pull_request' && 'type=gha,mode=max' || '' }} | |
| # Build-only validation for the CUDA image so it cannot silently rot (CUDA base | |
| # tag drift, cross-stage interpreter/venv copy paths, the `gpu` extra). The | |
| # runner has no GPU, so this only proves the image *compiles*; it is never | |
| # published (users build it themselves, per the README). | |
| build-gpu: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Build GPU image (validation only — not published) | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| file: ./Dockerfile.gpu | |
| platforms: linux/amd64 | |
| push: false | |
| cache-from: type=gha,scope=gpu | |
| cache-to: ${{ github.event_name != 'pull_request' && 'type=gha,mode=max,scope=gpu' || '' }} |