docker-build.yml

name: Docker Build

on:
  merge_group:
    types: [ checks_requested ]
  pull_request:
    branches:
      - main
  push:
    branches:
      - main
    tags:
      - "[0-9]+.[0-9]+.[0-9]+"
      - "[0-9]+.[0-9]+.[0-9]+-RC[0-9]+"
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  IS_PR: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
  IS_RELEASE: ${{ startsWith(github.ref, 'refs/tags/') && !contains(github.ref, '-RC') }}

jobs:
  build-base-image:
    name: Build Base Image
    runs-on: ubuntu-24.04
    permissions:
      packages: write
    outputs:
      ort-server-version: ${{ steps.version.outputs.version }}
    steps:
    - name: Checkout Repository
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        fetch-depth: 0

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

    - name: Login to GitHub Container Registry
      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Setup Gradle
      uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0

    - name: Get ORT-Server Version
      id: version
      run: |
        ORT_SERVER_VERSION=$(./gradlew -q printVersion)
        echo "ORT_SERVER_VERSION=${ORT_SERVER_VERSION}" >> $GITHUB_ENV
        echo "version=${ORT_SERVER_VERSION}" >> $GITHUB_OUTPUT

    - name: Extract Docker Metadata for base image
      id: meta-base-image
      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
      with:
        images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/ort-server-base-image
        tags: |
          type=raw,value=${{ env.ORT_SERVER_VERSION }}
          type=ref,event=branch
          type=sha
          type=raw,value=latest,enable=${{ env.IS_RELEASE }}

    - name: Set cache-to
      run: |
        # Only write to the registry cache of the base image if the workflow is not running for a PR.
        echo "BASE_CACHE_TO=$([[ ${{ env.IS_PR }} == 'false' ]] && echo 'type=registry,ref=${{ env.REGISTRY }}/${{ github.repository_owner }}/ort-server-base-image:cache,mode=max' || echo '')" >> $GITHUB_ENV

    # Build the base image exactly once and export it as a tarball, so that all matrix jobs of the "build" job can reuse
    # the identical image (and therefore the cache layers built on top of it) without rebuilding it in parallel.
    - name: Build base image
      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
      with:
        context: docker
        file: docker/Base.Dockerfile
        tags: localhost:5000/ort-server-base-image:${{ env.ORT_SERVER_VERSION }}
        labels: ${{ steps.meta-base-image.outputs.labels }}
        outputs: type=docker,dest=/tmp/ort-server-base-image.tar
        cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ github.repository_owner }}/ort-server-base-image:cache
        cache-to: ${{ env.BASE_CACHE_TO }}

    - name: Upload base image artifact
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: ort-server-base-image
        path: /tmp/ort-server-base-image.tar
        retention-days: 1

    # Publish the base image to the registry for non-PR builds. This reuses the cache written above, so it is a cache
    # hit that produces the identical image and only pushes it to the registry.
    - name: Publish base image to registry
      if: ${{ env.IS_PR == 'false' }}
      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
      with:
        context: docker
        file: docker/Base.Dockerfile
        tags: ${{ steps.meta-base-image.outputs.tags }}
        labels: ${{ steps.meta-base-image.outputs.labels }}
        cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ github.repository_owner }}/ort-server-base-image:cache
        push: true

  build:
    name: Build ${{ matrix.docker.jibImage || matrix.docker.image }} Docker Image
    runs-on: ubuntu-24.04
    needs: build-base-image
    env:
      ORT_SERVER_VERSION: ${{ needs.build-base-image.outputs.ort-server-version }}
    services:
      registry:
        image: registry:3
        ports:
          - 5000:5000
    permissions:
      packages: write
    strategy:
      matrix:
        # Define the Docker images to build. The common base image is built once by the "build-base-image" job and
        # reused here; this job makes it available in the local registry (unless skipWorkerBaseImage is set), then
        # builds an image using Docker and/or Jib on top of it. Both build steps are optional, e.g., not all Jib builds
        # need a Docker image, and the ui build does not need a Jib build.
        #
        # If the image is built with Docker:
        # preparationTask (optional): Gradle task to run before building the image.
        # image: Name of the image, used for the Docker image name.
        # context: Path to the Docker context directory.
        # dockerfile: Path of the Dockerfile to use, relative to context.
        #
        # If the image is built with Jib:
        # jibImage: Name of the image built by Jib.
        # task: Gradle task to build the image.
        #
        # Optional properties:
        # freeDiskSpace: Whether to free disk space before building the image.
        # skipWorkerBaseImage: Whether to skip providing the common base image (set for images not based on it).
        docker:
        - jibImage: core
          task: :core:tinyJibDocker
        - jibImage: orchestrator
          task: :orchestrator:tinyJibDocker
        - jibImage: maintenance-tasks
          task: :tasks:tinyJibDocker
        - jibImage: advisor-worker
          task: :workers:advisor:tinyJibDocker
        - image: analyzer-worker-base-image
          context: workers/analyzer/docker
          dockerfile: Analyzer.Dockerfile
          jibImage: analyzer-worker
          task: :workers:analyzer:tinyJibDocker
          freeDiskSpace: true
        - jibImage: config-worker
          task: :workers:config:tinyJibDocker
        - jibImage: evaluator-worker
          task: :workers:evaluator:tinyJibDocker
        - jibImage: notifier-worker
          task: :workers:notifier:tinyJibDocker
        - image: reporter-worker-base-image
          context: workers/reporter/docker
          dockerfile: Reporter.Dockerfile
          jibImage: reporter-worker
          task: :workers:reporter:tinyJibDocker
        - image: scanner-worker-base-image
          context: workers/scanner/docker
          dockerfile: Scanner.Dockerfile
          jibImage: scanner-worker
          task: :workers:scanner:tinyJibDocker
        - preparationTask: :core:generateOpenApiSpec
          image: ui
          context: ui
          dockerfile: docker/UI.Dockerfile
          skipWorkerBaseImage: true

    steps:
    - name: Checkout Repository
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        fetch-depth: 0

    - name: Free Disk Space
      if: ${{ matrix.docker.freeDiskSpace }}
      uses: ./.github/actions/free-disk-space

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      with:
        driver-opts: network=host

    - name: Login to GitHub Container Registry
      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Setup Gradle
      uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0

    - name: Run Preparation Task ${{ matrix.docker.preparationTask }}
      if: ${{ matrix.docker.preparationTask != '' }}
      run: ./gradlew ${{ matrix.docker.preparationTask }}

    - name: Extract Docker Metadata for ${{ matrix.docker.image }} Image
      if: ${{ matrix.docker.dockerfile != '' }}
      id: meta-base
      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
      with:
        images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/ort-server-${{ matrix.docker.image }}
        tags: |
          type=raw,value=${{ env.ORT_SERVER_VERSION }}
          type=ref,event=branch
          type=sha
          type=raw,value=latest,enable=${{ env.IS_RELEASE }}

    - name: Set cache-to
      run: |
        # Only write to the registry cache if the workflow is not running for a PR.
        echo "CACHE_TO=$([[ ${{ env.IS_PR }} == 'false' ]] && echo 'type=registry,ref=${{ env.REGISTRY }}/${{ github.repository_owner }}/ort-server-${{ matrix.docker.image }}:cache,mode=max' || echo '')" >> $GITHUB_ENV
        # Load the image to the Docker daemon if it is required as a base image for the Jib build.
        echo "LOAD_IMAGE=$([[ '${{ matrix.docker.task }}' != '' ]] && echo 'true' || echo 'false')" >> $GITHUB_ENV
        # Push the image to the registry if it is not a PR and no Jib build is configured.
        echo "PUSH_IMAGE=$([[ ${{ env.IS_PR }} == 'false' ]] && echo 'true' || echo 'false')" >> $GITHUB_ENV

    # Reuse the base image built once by the "build-base-image" job and make it available in this job's local registry,
    # so that it can be used as the base image for the Docker and Jib builds below.
    - name: Download worker base image
      if: ${{ !matrix.docker.skipWorkerBaseImage }}
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: ort-server-base-image
        path: /tmp

    - name: Provide worker base image
      if: ${{ !matrix.docker.skipWorkerBaseImage }}
      run: |
        docker load --input /tmp/ort-server-base-image.tar
        docker push localhost:5000/ort-server-base-image:${{ env.ORT_SERVER_VERSION }}

    - name: Build ${{ matrix.docker.image }} Image
      if: ${{ matrix.docker.dockerfile != '' }}
      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
      with:
        context: ${{ matrix.docker.context }}
        file: ${{ matrix.docker.context }}/${{ matrix.docker.dockerfile }}
        push: ${{ env.PUSH_IMAGE }}
        load: ${{ env.LOAD_IMAGE }}
        tags: ${{ steps.meta-base.outputs.tags }}
        labels: ${{ steps.meta-base.outputs.labels }}
        cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ github.repository_owner }}/ort-server-${{ matrix.docker.image }}:cache
        cache-to: ${{ env.CACHE_TO }}
        build-args: |
          BASE_REGISTRY=localhost:5000/
          BASE_IMAGE_TAG=${{ env.ORT_SERVER_VERSION }}

    - name: Extract Docker Metadata for ${{ matrix.docker.jibImage }} Image
      if: ${{ matrix.docker.task != '' }}
      id: meta
      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
      with:
        tags: |
          type=raw,value=${{ env.ORT_SERVER_VERSION }}
          type=ref,event=branch
          type=sha
          type=raw,value=latest,enable=${{ env.IS_RELEASE }}

    - name: Prepare Jib Cache Directories
      if: ${{ matrix.docker.task != '' }}
      run: |
        sudo mkdir -p /mnt/jib-app-cache /mnt/jib-base-cache /mnt/tmp
        sudo chown $USER /mnt/jib-app-cache /mnt/jib-base-cache /mnt/tmp

    - name: Determine Jib base image
      id: jib-base-image
      if: ${{ matrix.docker.task != '' }}
      run: |
        if [[ -n "${{ matrix.docker.dockerfile }}" ]]; then
          baseImagePrefix="docker://${{ env.REGISTRY }}/${{ github.repository_owner }}"
        else
          baseImagePrefix="localhost:5000"
        fi
        baseImageTag="${{ env.ORT_SERVER_VERSION }}"
        echo "baseImagePrefix=$baseImagePrefix" >> $GITHUB_OUTPUT
        echo "baseImageTag=$baseImageTag" >> $GITHUB_OUTPUT

    - name: Build ${{ matrix.docker.jibImage }} Image
      if: ${{ matrix.docker.task != '' }}
      run: |
        ./gradlew \
          -PdockerBaseImagePrefix=${{ steps.jib-base-image.outputs.baseImagePrefix }}/ \
          -PdockerBaseImageTag=${{ steps.jib-base-image.outputs.baseImageTag }} \
          -PdockerImagePrefix=${{ env.REGISTRY }}/${{ github.repository_owner }}/ \
          -PdockerImageTag=${{ env.ORT_SERVER_VERSION }} \
          ${{ matrix.docker.task }} \
          -Djib.applicationCache=/mnt/jib-app-cache \
          -Djib.baseImageCache=/mnt/jib-base-cache \
          -Djib.allowInsecureRegistries=true \
          -Djava.io.tmpdir=/mnt/tmp \
          -Djib.container.labels="$(echo "${{ steps.meta.outputs.labels }}" | tr '\n' ',' | sed 's/,$//')" \
          -Djib.to.tags="$(echo "${{ steps.meta.outputs.tags }}" | tr '\n' ',' | sed 's/,$//')"
        if [ "${{ env.IS_PR }}" = "false" ]; then
          docker push ${{ env.REGISTRY }}/${{ github.repository_owner }}/ort-server-${{ matrix.docker.jibImage }} --all-tags
        fi