|
| 1 | +name: Docker build (fork PRs) |
| 2 | + |
| 3 | +# A fast check for Docker build errors introduced by the current PR. |
| 4 | +# Implemented separately from the full-stack build in docker.yml because |
| 5 | +# pull requests opened from forks get a read-only GITHUB_TOKEN and cannot push |
| 6 | +# to ghcr.io/pecanproject, so the normal Docker GHA workflow (docker.yml) skips |
| 7 | +# them (see the gate on its `rversion` job). This workflow gives those PRs a |
| 8 | +# real "does the image stack still build" signal without pushing anything. |
| 9 | +# |
| 10 | +# The images build on top of each other (depends -> base -> models -> sipnet). |
| 11 | +# The normal workflow runs each as a separate job and pulls the parent back from |
| 12 | +# ghcr, which needs a registry we can't push to from a fork. Here we build the |
| 13 | +# whole chain in a single job with plain `docker build`, so each image stays in |
| 14 | +# the runner's local image store and the next `FROM pecan/<parent>:latest` |
| 15 | +# resolves locally. No registry, no push, no secrets. |
| 16 | +# |
| 17 | +# Scope is the core linear chain only (depends -> base -> models -> sipnet). It |
| 18 | +# fits the default runner disk (~19 GB free; the resident stack is ~5-6 GB). The |
| 19 | +# other model binaries, baseplus (docs/executor/api) and extras images are not |
| 20 | +# built here to keep the job within disk and time budget. |
| 21 | + |
| 22 | +on: |
| 23 | + pull_request: |
| 24 | + workflow_dispatch: |
| 25 | + |
| 26 | +permissions: |
| 27 | + contents: read |
| 28 | + |
| 29 | +jobs: |
| 30 | + build-stack: |
| 31 | + # Only fork PRs. Same-repo PRs are already covered by docker.yml, which can |
| 32 | + # push pr-* tags to ghcr because they run with a writable token. |
| 33 | + if: github.event.pull_request.head.repo.full_name != github.repository |
| 34 | + runs-on: ubuntu-latest |
| 35 | + env: |
| 36 | + R_VERSION: "4.4" |
| 37 | + steps: |
| 38 | + - uses: actions/checkout@v6 |
| 39 | + |
| 40 | + - name: Disk space before build |
| 41 | + run: df -h / |
| 42 | + |
| 43 | + # NOTE: do not add docker/setup-buildx-action here. Plain `docker build` |
| 44 | + # uses the default docker-engine builder, which resolves each |
| 45 | + # `FROM pecan/<parent>:latest` from the local image store built by the |
| 46 | + # previous step. The docker-container buildx driver would not see those |
| 47 | + # local images and every FROM after depends would fail. |
| 48 | + - name: Build depends -> base -> models -> sipnet (no push) |
| 49 | + run: | |
| 50 | + set -euxo pipefail |
| 51 | +
|
| 52 | + # depends: FROM rocker/tidyverse:${R_VERSION} |
| 53 | + docker build -f docker/depends/Dockerfile \ |
| 54 | + --build-arg R_VERSION="${R_VERSION}" \ |
| 55 | + -t pecan/depends:latest \ |
| 56 | + docker/depends |
| 57 | +
|
| 58 | + # base: FROM pecan/depends:latest (resolved from the local store) |
| 59 | + docker build -f docker/base/Dockerfile \ |
| 60 | + -t pecan/base:latest \ |
| 61 | + . |
| 62 | +
|
| 63 | + # models: FROM pecan/base:latest |
| 64 | + docker build -f docker/models/Dockerfile \ |
| 65 | + -t pecan/models:latest \ |
| 66 | + docker/models |
| 67 | +
|
| 68 | + # sipnet: FROM pecan/models:latest |
| 69 | + docker build -f models/sipnet/Dockerfile \ |
| 70 | + --build-arg MODEL_VERSION=git \ |
| 71 | + -t pecan/model-sipnet-git:latest \ |
| 72 | + models/sipnet |
| 73 | +
|
| 74 | + - name: Disk space after build |
| 75 | + if: always() |
| 76 | + run: df -h / |
0 commit comments