serge/.github/workflows/docker.yml at 4a6dd3fe737bb7e6ffe9c1e7a8c240f5632a9eef · huggingface/serge · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
name: Create and publish a Docker image

on:
  push:
    branches:
      - main
  # Allow building/pushing on demand (e.g. before the first deploy).
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-and-push-image:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=raw,value=latest,enable={{is_default_branch}}
            type=sha,prefix=sha-
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Build and push Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile
          push: true
          platforms: 'linux/amd64'
          build-args: |
            GIT_SHA=${{ github.sha }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-to: type=gha,mode=max
          cache-from: type=gha

  # The per-task runner image (docker/Dockerfile.task-runner): the target repo's
  # toolchain image (transformers-quality) with serge layered on top, run as one
  # pod per /tasks request when taskExecution.kubernetes is enabled. Published
  # separately from the thin serge app image above; point
  # taskExecution.kubernetes.image at ghcr.io/<repo>-task-runner:sha-<commit>.
  build-and-push-task-runner:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ghcr.io/${{ github.repository }}-task-runner
          tags: |
            type=raw,value=latest,enable={{is_default_branch}}
            type=sha,prefix=sha-
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Build and push task-runner image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/Dockerfile.task-runner
          push: true
          platforms: 'linux/amd64'
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-to: type=gha,mode=max
          cache-from: type=gha

  # The serge-egress forward proxy image (docker/Dockerfile.egress-proxy): a
  # self-built tinyproxy on the Debian base, used as the allowlisting egress
  # gateway for the per-task pods when taskExecution.kubernetes is enabled.
  # Built in-house to avoid depending on an unofficial Docker Hub image; point
  # taskExecution.kubernetes.egress.image at ghcr.io/<repo>-egress:sha-<commit>.
  build-and-push-egress-proxy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ghcr.io/${{ github.repository }}-egress
          tags: |
            type=raw,value=latest,enable={{is_default_branch}}
            type=sha,prefix=sha-
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Build and push egress-proxy image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/Dockerfile.egress-proxy
          push: true
          platforms: 'linux/amd64'
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-to: type=gha,mode=max
          cache-from: type=gha