fix(evaluator): Enable authentication for the evaluator worker #623
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker Build | |
| on: | |
| merge_group: | |
| types: [ checks_requested ] | |
| pull_request: | |
| branches: | |
| - main | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - "[0-9]+.[0-9]+.[0-9]+" | |
| - "[0-9]+.[0-9]+.[0-9]+-RC[0-9]+" | |
| workflow_dispatch: | |
| env: | |
| REGISTRY: ghcr.io | |
| IS_PR: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }} | |
| IS_RELEASE: ${{ startsWith(github.ref, 'refs/tags/') && !contains(github.ref, '-RC') }} | |
| jobs: | |
| build-base-image: | |
| name: Build Base Image | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| packages: write | |
| outputs: | |
| ort-server-version: ${{ steps.version.outputs.version }} | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Setup Gradle | |
| uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 | |
| - name: Get ORT-Server Version | |
| id: version | |
| run: | | |
| ORT_SERVER_VERSION=$(./gradlew -q printVersion) | |
| echo "ORT_SERVER_VERSION=${ORT_SERVER_VERSION}" >> $GITHUB_ENV | |
| echo "version=${ORT_SERVER_VERSION}" >> $GITHUB_OUTPUT | |
| - name: Extract Docker Metadata for base image | |
| id: meta-base-image | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/ort-server-base-image | |
| tags: | | |
| type=raw,value=${{ env.ORT_SERVER_VERSION }} | |
| type=ref,event=branch | |
| type=sha | |
| type=raw,value=latest,enable=${{ env.IS_RELEASE }} | |
| - name: Set cache-to | |
| run: | | |
| # Only write to the registry cache of the base image if the workflow is not running for a PR. | |
| echo "BASE_CACHE_TO=$([[ ${{ env.IS_PR }} == 'false' ]] && echo 'type=registry,ref=${{ env.REGISTRY }}/${{ github.repository_owner }}/ort-server-base-image:cache,mode=max' || echo '')" >> $GITHUB_ENV | |
| # Build the base image exactly once and export it as a tarball, so that all matrix jobs of the "build" job can reuse | |
| # the identical image (and therefore the cache layers built on top of it) without rebuilding it in parallel. | |
| - name: Build base image | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: docker | |
| file: docker/Base.Dockerfile | |
| tags: localhost:5000/ort-server-base-image:${{ env.ORT_SERVER_VERSION }} | |
| labels: ${{ steps.meta-base-image.outputs.labels }} | |
| outputs: type=docker,dest=/tmp/ort-server-base-image.tar | |
| cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ github.repository_owner }}/ort-server-base-image:cache | |
| cache-to: ${{ env.BASE_CACHE_TO }} | |
| - name: Upload base image artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: ort-server-base-image | |
| path: /tmp/ort-server-base-image.tar | |
| retention-days: 1 | |
| # Publish the base image to the registry for non-PR builds. This reuses the cache written above, so it is a cache | |
| # hit that produces the identical image and only pushes it to the registry. | |
| - name: Publish base image to registry | |
| if: ${{ env.IS_PR == 'false' }} | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: docker | |
| file: docker/Base.Dockerfile | |
| tags: ${{ steps.meta-base-image.outputs.tags }} | |
| labels: ${{ steps.meta-base-image.outputs.labels }} | |
| cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ github.repository_owner }}/ort-server-base-image:cache | |
| push: true | |
| build: | |
| name: Build ${{ matrix.docker.jibImage || matrix.docker.image }} Docker Image | |
| runs-on: ubuntu-24.04 | |
| needs: build-base-image | |
| env: | |
| ORT_SERVER_VERSION: ${{ needs.build-base-image.outputs.ort-server-version }} | |
| services: | |
| registry: | |
| image: registry:3 | |
| ports: | |
| - 5000:5000 | |
| permissions: | |
| packages: write | |
| strategy: | |
| matrix: | |
| # Define the Docker images to build. The common base image is built once by the "build-base-image" job and | |
| # reused here; this job makes it available in the local registry (unless skipWorkerBaseImage is set), then | |
| # builds an image using Docker and/or Jib on top of it. Both build steps are optional, e.g., not all Jib builds | |
| # need a Docker image, and the ui build does not need a Jib build. | |
| # | |
| # If the image is built with Docker: | |
| # preparationTask (optional): Gradle task to run before building the image. | |
| # image: Name of the image, used for the Docker image name. | |
| # context: Path to the Docker context directory. | |
| # dockerfile: Path of the Dockerfile to use, relative to context. | |
| # | |
| # If the image is built with Jib: | |
| # jibImage: Name of the image built by Jib. | |
| # task: Gradle task to build the image. | |
| # | |
| # Optional properties: | |
| # freeDiskSpace: Whether to free disk space before building the image. | |
| # skipWorkerBaseImage: Whether to skip providing the common base image (set for images not based on it). | |
| docker: | |
| - jibImage: core | |
| task: :core:tinyJibDocker | |
| - jibImage: orchestrator | |
| task: :orchestrator:tinyJibDocker | |
| - jibImage: maintenance-tasks | |
| task: :tasks:tinyJibDocker | |
| - jibImage: advisor-worker | |
| task: :workers:advisor:tinyJibDocker | |
| - image: analyzer-worker-base-image | |
| context: workers/analyzer/docker | |
| dockerfile: Analyzer.Dockerfile | |
| jibImage: analyzer-worker | |
| task: :workers:analyzer:tinyJibDocker | |
| freeDiskSpace: true | |
| - jibImage: config-worker | |
| task: :workers:config:tinyJibDocker | |
| - jibImage: evaluator-worker | |
| task: :workers:evaluator:tinyJibDocker | |
| - jibImage: notifier-worker | |
| task: :workers:notifier:tinyJibDocker | |
| - image: reporter-worker-base-image | |
| context: workers/reporter/docker | |
| dockerfile: Reporter.Dockerfile | |
| jibImage: reporter-worker | |
| task: :workers:reporter:tinyJibDocker | |
| - image: scanner-worker-base-image | |
| context: workers/scanner/docker | |
| dockerfile: Scanner.Dockerfile | |
| jibImage: scanner-worker | |
| task: :workers:scanner:tinyJibDocker | |
| - preparationTask: :core:generateOpenApiSpec | |
| image: ui | |
| context: ui | |
| dockerfile: docker/UI.Dockerfile | |
| skipWorkerBaseImage: true | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| - name: Free Disk Space | |
| if: ${{ matrix.docker.freeDiskSpace }} | |
| uses: ./.github/actions/free-disk-space | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| with: | |
| driver-opts: network=host | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Setup Gradle | |
| uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 | |
| - name: Run Preparation Task ${{ matrix.docker.preparationTask }} | |
| if: ${{ matrix.docker.preparationTask != '' }} | |
| run: ./gradlew ${{ matrix.docker.preparationTask }} | |
| - name: Extract Docker Metadata for ${{ matrix.docker.image }} Image | |
| if: ${{ matrix.docker.dockerfile != '' }} | |
| id: meta-base | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/ort-server-${{ matrix.docker.image }} | |
| tags: | | |
| type=raw,value=${{ env.ORT_SERVER_VERSION }} | |
| type=ref,event=branch | |
| type=sha | |
| type=raw,value=latest,enable=${{ env.IS_RELEASE }} | |
| - name: Set cache-to | |
| run: | | |
| # Only write to the registry cache if the workflow is not running for a PR. | |
| echo "CACHE_TO=$([[ ${{ env.IS_PR }} == 'false' ]] && echo 'type=registry,ref=${{ env.REGISTRY }}/${{ github.repository_owner }}/ort-server-${{ matrix.docker.image }}:cache,mode=max' || echo '')" >> $GITHUB_ENV | |
| # Load the image to the Docker daemon if it is required as a base image for the Jib build. | |
| echo "LOAD_IMAGE=$([[ '${{ matrix.docker.task }}' != '' ]] && echo 'true' || echo 'false')" >> $GITHUB_ENV | |
| # Push the image to the registry if it is not a PR and no Jib build is configured. | |
| echo "PUSH_IMAGE=$([[ ${{ env.IS_PR }} == 'false' ]] && echo 'true' || echo 'false')" >> $GITHUB_ENV | |
| # Reuse the base image built once by the "build-base-image" job and make it available in this job's local registry, | |
| # so that it can be used as the base image for the Docker and Jib builds below. | |
| - name: Download worker base image | |
| if: ${{ !matrix.docker.skipWorkerBaseImage }} | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: ort-server-base-image | |
| path: /tmp | |
| - name: Provide worker base image | |
| if: ${{ !matrix.docker.skipWorkerBaseImage }} | |
| run: | | |
| docker load --input /tmp/ort-server-base-image.tar | |
| docker push localhost:5000/ort-server-base-image:${{ env.ORT_SERVER_VERSION }} | |
| - name: Build ${{ matrix.docker.image }} Image | |
| if: ${{ matrix.docker.dockerfile != '' }} | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: ${{ matrix.docker.context }} | |
| file: ${{ matrix.docker.context }}/${{ matrix.docker.dockerfile }} | |
| push: ${{ env.PUSH_IMAGE }} | |
| load: ${{ env.LOAD_IMAGE }} | |
| tags: ${{ steps.meta-base.outputs.tags }} | |
| labels: ${{ steps.meta-base.outputs.labels }} | |
| cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ github.repository_owner }}/ort-server-${{ matrix.docker.image }}:cache | |
| cache-to: ${{ env.CACHE_TO }} | |
| build-args: | | |
| BASE_REGISTRY=localhost:5000/ | |
| BASE_IMAGE_TAG=${{ env.ORT_SERVER_VERSION }} | |
| - name: Extract Docker Metadata for ${{ matrix.docker.jibImage }} Image | |
| if: ${{ matrix.docker.task != '' }} | |
| id: meta | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 | |
| with: | |
| tags: | | |
| type=raw,value=${{ env.ORT_SERVER_VERSION }} | |
| type=ref,event=branch | |
| type=sha | |
| type=raw,value=latest,enable=${{ env.IS_RELEASE }} | |
| - name: Prepare Jib Cache Directories | |
| if: ${{ matrix.docker.task != '' }} | |
| run: | | |
| sudo mkdir -p /mnt/jib-app-cache /mnt/jib-base-cache /mnt/tmp | |
| sudo chown $USER /mnt/jib-app-cache /mnt/jib-base-cache /mnt/tmp | |
| - name: Determine Jib base image | |
| id: jib-base-image | |
| if: ${{ matrix.docker.task != '' }} | |
| run: | | |
| if [[ -n "${{ matrix.docker.dockerfile }}" ]]; then | |
| baseImagePrefix="docker://${{ env.REGISTRY }}/${{ github.repository_owner }}" | |
| else | |
| baseImagePrefix="localhost:5000" | |
| fi | |
| baseImageTag="${{ env.ORT_SERVER_VERSION }}" | |
| echo "baseImagePrefix=$baseImagePrefix" >> $GITHUB_OUTPUT | |
| echo "baseImageTag=$baseImageTag" >> $GITHUB_OUTPUT | |
| - name: Build ${{ matrix.docker.jibImage }} Image | |
| if: ${{ matrix.docker.task != '' }} | |
| run: | | |
| ./gradlew \ | |
| -PdockerBaseImagePrefix=${{ steps.jib-base-image.outputs.baseImagePrefix }}/ \ | |
| -PdockerBaseImageTag=${{ steps.jib-base-image.outputs.baseImageTag }} \ | |
| -PdockerImagePrefix=${{ env.REGISTRY }}/${{ github.repository_owner }}/ \ | |
| -PdockerImageTag=${{ env.ORT_SERVER_VERSION }} \ | |
| ${{ matrix.docker.task }} \ | |
| -Djib.applicationCache=/mnt/jib-app-cache \ | |
| -Djib.baseImageCache=/mnt/jib-base-cache \ | |
| -Djib.allowInsecureRegistries=true \ | |
| -Djava.io.tmpdir=/mnt/tmp \ | |
| -Djib.container.labels="$(echo "${{ steps.meta.outputs.labels }}" | tr '\n' ',' | sed 's/,$//')" \ | |
| -Djib.to.tags="$(echo "${{ steps.meta.outputs.tags }}" | tr '\n' ',' | sed 's/,$//')" | |
| if [ "${{ env.IS_PR }}" = "false" ]; then | |
| docker push ${{ env.REGISTRY }}/${{ github.repository_owner }}/ort-server-${{ matrix.docker.jibImage }} --all-tags | |
| fi |