chore(deps): bump the all-docker group across 1 directory with 2 updates #1708
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Development Build | |
| on: | |
| pull_request: | |
| branches: [ main ] | |
| push: | |
| branches: [ main ] | |
| paths-ignore: | |
| - '**.md' | |
| - 'docs/**' | |
| - 'notebooks/**' | |
| - '.github/workflows/claude*.yml' | |
| workflow_dispatch: | |
| inputs: | |
| platform: | |
| description: 'Platform to build' | |
| required: true | |
| default: 'linux/amd64' | |
| type: choice | |
| options: | |
| - linux/amd64 | |
| - linux/arm64 | |
| - linux/amd64,linux/arm64 | |
| permissions: | |
| contents: read | |
| packages: write | |
| env: | |
| GHCR_IMAGE: ghcr.io/lfnovo/open-notebook | |
| DOCKERHUB_IMAGE: lfnovo/open_notebook | |
| jobs: | |
| extract-version: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| version: ${{ steps.version.outputs.version }} | |
| has_dockerhub_secrets: ${{ steps.check.outputs.has_dockerhub_secrets }} | |
| is_push_to_main: ${{ steps.check.outputs.is_push_to_main }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Extract version from pyproject.toml | |
| id: version | |
| run: | | |
| VERSION=$(grep -m1 '^version = ' pyproject.toml | cut -d'"' -f2) | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| echo "Extracted version: $VERSION" | |
| - name: Check environment | |
| id: check | |
| env: | |
| SECRET_DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }} | |
| SECRET_DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }} | |
| run: | | |
| # Check for Docker Hub credentials | |
| if [[ -n "$SECRET_DOCKER_USERNAME" && -n "$SECRET_DOCKER_PASSWORD" ]]; then | |
| echo "has_dockerhub_secrets=true" >> $GITHUB_OUTPUT | |
| echo "Docker Hub credentials available" | |
| else | |
| echo "has_dockerhub_secrets=false" >> $GITHUB_OUTPUT | |
| echo "Docker Hub credentials not available" | |
| fi | |
| # Check if this is a push to main (not a PR) | |
| if [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" == "refs/heads/main" ]]; then | |
| echo "is_push_to_main=true" >> $GITHUB_OUTPUT | |
| echo "This is a push to main - will publish v1-dev tags" | |
| else | |
| echo "is_push_to_main=false" >> $GITHUB_OUTPUT | |
| echo "This is a PR or manual run - test build only" | |
| fi | |
| # Detect whether this PR touches anything that ends up in the Docker image. | |
| # build-regular is a required status check, so it must always REPORT — the | |
| # expensive build steps below are gated on this output instead of filtering | |
| # the workflow trigger (a path-filtered required check never reports and | |
| # deadlocks merge, even for admins). On push to main the build always runs. | |
| changes: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pull-requests: read | |
| outputs: | |
| image: ${{ steps.filter.outputs.image }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Detect image-affecting changes | |
| uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad # v3 | |
| id: filter | |
| with: | |
| filters: | | |
| image: | |
| - 'Dockerfile*' | |
| - 'pyproject.toml' | |
| - 'uv.lock' | |
| - 'open_notebook/**' | |
| - 'api/**' | |
| - 'commands/**' | |
| - 'frontend/**' | |
| - '.github/workflows/build-dev.yml' | |
| # The job always runs (so the required `build-regular` check always reports), | |
| # but every build step is gated on: push to main OR the PR touched an | |
| # image-affecting path (needs.changes.outputs.image). Uses needs.* directly in | |
| # each step `if:` (fully supported) rather than a job-level env indirection. | |
| build-regular: | |
| needs: [extract-version, changes] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Skip notice | |
| if: needs.extract-version.outputs.is_push_to_main != 'true' && needs.changes.outputs.image != 'true' | |
| run: echo "No image-affecting paths changed — skipping the Docker build. Reporting success." | |
| - name: Free up disk space | |
| if: needs.extract-version.outputs.is_push_to_main == 'true' | |
| run: | | |
| sudo rm -rf /usr/share/dotnet | |
| sudo rm -rf /usr/local/lib/android | |
| sudo rm -rf /opt/ghc | |
| sudo rm -rf /opt/hostedtoolcache/CodeQL | |
| sudo docker image prune --all --force | |
| df -h | |
| - name: Set up Docker Buildx | |
| if: needs.extract-version.outputs.is_push_to_main == 'true' || needs.changes.outputs.image == 'true' | |
| uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 | |
| - name: Login to GitHub Container Registry | |
| if: needs.extract-version.outputs.is_push_to_main == 'true' | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Login to Docker Hub | |
| if: needs.extract-version.outputs.is_push_to_main == 'true' && needs.extract-version.outputs.has_dockerhub_secrets == 'true' | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 | |
| with: | |
| username: ${{ secrets.DOCKER_USERNAME }} | |
| password: ${{ secrets.DOCKER_PASSWORD }} | |
| - name: Cache Docker layers | |
| if: needs.extract-version.outputs.is_push_to_main == 'true' || needs.changes.outputs.image == 'true' | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: /tmp/.buildx-cache-dev | |
| key: ${{ runner.os }}-buildx-dev-${{ github.sha }} | |
| restore-keys: | | |
| ${{ runner.os }}-buildx-dev- | |
| - name: Prepare Docker tags | |
| id: tags | |
| if: needs.extract-version.outputs.is_push_to_main == 'true' || needs.changes.outputs.image == 'true' | |
| run: | | |
| if [[ "${{ needs.extract-version.outputs.is_push_to_main }}" == "true" ]]; then | |
| # Push to main: build and push v1-dev tags | |
| TAGS="${{ env.GHCR_IMAGE }}:v1-dev" | |
| if [[ "${{ needs.extract-version.outputs.has_dockerhub_secrets }}" == "true" ]]; then | |
| TAGS="${TAGS},${{ env.DOCKERHUB_IMAGE }}:v1-dev" | |
| fi | |
| echo "tags=${TAGS}" >> $GITHUB_OUTPUT | |
| echo "push=true" >> $GITHUB_OUTPUT | |
| echo "platforms=linux/amd64,linux/arm64" >> $GITHUB_OUTPUT | |
| else | |
| # PR or manual: test build only | |
| echo "tags=${{ env.DOCKERHUB_IMAGE }}:${{ needs.extract-version.outputs.version }}-dev" >> $GITHUB_OUTPUT | |
| echo "push=false" >> $GITHUB_OUTPUT | |
| echo "platforms=${{ github.event.inputs.platform || 'linux/amd64' }}" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Build and push regular image | |
| if: needs.extract-version.outputs.is_push_to_main == 'true' || needs.changes.outputs.image == 'true' | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| target: runtime | |
| platforms: ${{ steps.tags.outputs.platforms }} | |
| push: ${{ steps.tags.outputs.push }} | |
| tags: ${{ steps.tags.outputs.tags }} | |
| cache-from: type=local,src=/tmp/.buildx-cache-dev | |
| cache-to: type=local,dest=/tmp/.buildx-cache-dev-new,mode=max | |
| - name: Move cache | |
| if: needs.extract-version.outputs.is_push_to_main == 'true' || needs.changes.outputs.image == 'true' | |
| run: | | |
| rm -rf /tmp/.buildx-cache-dev | |
| mv /tmp/.buildx-cache-dev-new /tmp/.buildx-cache-dev | |
| build-single: | |
| needs: extract-version | |
| # Only build single image on push to main | |
| if: needs.extract-version.outputs.is_push_to_main == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Free up disk space | |
| run: | | |
| sudo rm -rf /usr/share/dotnet | |
| sudo rm -rf /usr/local/lib/android | |
| sudo rm -rf /opt/ghc | |
| sudo rm -rf /opt/hostedtoolcache/CodeQL | |
| sudo docker image prune --all --force | |
| df -h | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Login to Docker Hub | |
| if: needs.extract-version.outputs.has_dockerhub_secrets == 'true' | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 | |
| with: | |
| username: ${{ secrets.DOCKER_USERNAME }} | |
| password: ${{ secrets.DOCKER_PASSWORD }} | |
| - name: Cache Docker layers | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: /tmp/.buildx-cache-dev-single | |
| key: ${{ runner.os }}-buildx-dev-single-${{ github.sha }} | |
| restore-keys: | | |
| ${{ runner.os }}-buildx-dev-single- | |
| - name: Prepare Docker tags | |
| id: tags | |
| run: | | |
| TAGS="${{ env.GHCR_IMAGE }}:v1-dev-single" | |
| if [[ "${{ needs.extract-version.outputs.has_dockerhub_secrets }}" == "true" ]]; then | |
| TAGS="${TAGS},${{ env.DOCKERHUB_IMAGE }}:v1-dev-single" | |
| fi | |
| echo "tags=${TAGS}" >> $GITHUB_OUTPUT | |
| - name: Build and push single-container image | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| target: single | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.tags.outputs.tags }} | |
| cache-from: type=local,src=/tmp/.buildx-cache-dev-single | |
| cache-to: type=local,dest=/tmp/.buildx-cache-dev-single-new,mode=max | |
| - name: Move cache | |
| run: | | |
| rm -rf /tmp/.buildx-cache-dev-single | |
| mv /tmp/.buildx-cache-dev-single-new /tmp/.buildx-cache-dev-single | |
| summary: | |
| needs: [extract-version, build-regular, build-single] | |
| runs-on: ubuntu-latest | |
| if: always() | |
| steps: | |
| - name: Development Build Summary | |
| run: | | |
| echo "## Development Build Summary" >> $GITHUB_STEP_SUMMARY | |
| echo "**Version:** ${{ needs.extract-version.outputs.version }}" >> $GITHUB_STEP_SUMMARY | |
| echo "**Event:** ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY | |
| echo "**Push to Main:** ${{ needs.extract-version.outputs.is_push_to_main }}" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| if [[ "${{ needs.extract-version.outputs.is_push_to_main }}" == "true" ]]; then | |
| echo "### Published Tags:" >> $GITHUB_STEP_SUMMARY | |
| if [[ "${{ needs.build-regular.result }}" == "success" ]]; then | |
| echo "✅ **Regular:** \`${{ env.GHCR_IMAGE }}:v1-dev\`" >> $GITHUB_STEP_SUMMARY | |
| if [[ "${{ needs.extract-version.outputs.has_dockerhub_secrets }}" == "true" ]]; then | |
| echo "✅ **Regular (Docker Hub):** \`${{ env.DOCKERHUB_IMAGE }}:v1-dev\`" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| else | |
| echo "❌ **Regular:** Build failed" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| if [[ "${{ needs.build-single.result }}" == "success" ]]; then | |
| echo "✅ **Single:** \`${{ env.GHCR_IMAGE }}:v1-dev-single\`" >> $GITHUB_STEP_SUMMARY | |
| if [[ "${{ needs.extract-version.outputs.has_dockerhub_secrets }}" == "true" ]]; then | |
| echo "✅ **Single (Docker Hub):** \`${{ env.DOCKERHUB_IMAGE }}:v1-dev-single\`" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| elif [[ "${{ needs.build-single.result }}" == "skipped" ]]; then | |
| echo "⏭️ **Single:** Skipped" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "❌ **Single:** Build failed" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Platforms:" >> $GITHUB_STEP_SUMMARY | |
| echo "- linux/amd64" >> $GITHUB_STEP_SUMMARY | |
| echo "- linux/arm64" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "### Test Build Results:" >> $GITHUB_STEP_SUMMARY | |
| if [[ "${{ needs.build-regular.result }}" == "success" ]]; then | |
| echo "✅ **Dockerfile:** Build successful" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "❌ **Dockerfile:** Build failed" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Notes:" >> $GITHUB_STEP_SUMMARY | |
| echo "- This is a test build (no images pushed to registry)" >> $GITHUB_STEP_SUMMARY | |
| echo "- Merge to main to publish \`v1-dev\` tags" >> $GITHUB_STEP_SUMMARY | |
| echo "- For stable releases, use the 'Build and Release' workflow" >> $GITHUB_STEP_SUMMARY | |
| fi |