providers-build.yml

name: Test OGX Build

run-name: Test ogx build and list-deps

on:
  push:
    branches:
      - main
    paths:
      - 'src/ogx/cli/stack/build.py'
      - 'src/ogx/cli/stack/_build.py'
      - 'src/ogx/cli/stack/list_deps.py'
      - 'src/ogx/cli/stack/_list_deps.py'
      - 'src/ogx/core/build.*'
      - 'src/ogx/core/*.sh'
      - '.github/workflows/providers-build.yml'
      - 'src/ogx/distributions/**'
      - 'src/ogx/templates/**'
      - 'pyproject.toml'
      - 'containers/Containerfile'
      - '.dockerignore'

  pull_request:
    paths:
      - 'src/ogx/cli/stack/build.py'
      - 'src/ogx/cli/stack/_build.py'
      - 'src/ogx/cli/stack/list_deps.py'
      - 'src/ogx/cli/stack/_list_deps.py'
      - 'src/ogx/core/build.*'
      - 'src/ogx/core/*.sh'
      - '.github/workflows/providers-build.yml'
      - 'src/ogx/distributions/**'
      - 'src/ogx/templates/**'
      - 'pyproject.toml'
      - 'containers/Containerfile'
      - '.dockerignore'
  merge_group:
    branches:
      - main
      - 'release-[0-9]+.[0-9]+.x'

  schedule:
    - cron: '0 0 * * 1'  # Weekly on Monday at 12 AM UTC

concurrency:
  group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && github.run_id || github.ref }}
  cancel-in-progress: true

jobs:
  generate-matrix:
    runs-on: ubuntu-latest
    outputs:
      distros: ${{ steps.set-matrix.outputs.distros }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Generate Distribution List
        id: set-matrix
        run: |
          distros=$(find src/ogx/distributions -mindepth 1 -maxdepth 1 -type d 2>/dev/null | \
            awk -F'/' '{print $NF}' | \
            grep -v '^__pycache__$' | \
            grep -v '^ci-tests$' | \
            jq -R -s -c 'split("\n") | map(select(length > 0))')
          echo "distros=$distros" >> "$GITHUB_OUTPUT"

  build:
    needs: generate-matrix
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      matrix:
        distro: ${{ fromJson(needs.generate-matrix.outputs.distros) }}
        # Only build venv on PRs to reduce runner contention; build both on push/schedule
        image-type: ${{ github.event_name == 'pull_request' && fromJSON('["venv"]') || fromJSON('["venv", "container"]') }}
      fail-fast: false # We want to run all jobs even if some fail

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install dependencies
        uses: ./.github/actions/setup-runner

      - name: Print dependencies
        run: |
          uv run ogx stack list-deps ${{ matrix.distro }}

      - name: Install distribution into venv via list-deps
        if: matrix.image-type == 'venv'
        run: |
          USE_COPY_NOT_MOUNT=true OGX_DIR=. uv run ogx stack list-deps ${{ matrix.distro }} | xargs -L1 uv pip install

      - name: Print installed packages
        if: matrix.image-type == 'venv'
        run: |
          uv pip list

      - name: Build container image
        if: matrix.image-type == 'container'
        run: |
          BUILD_ARGS=(--build-arg "INSTALL_MODE=editable" --build-arg "DISTRO_NAME=${{ matrix.distro }}")
          if [ -n "${UV_EXTRA_INDEX_URL:-}" ]; then
            BUILD_ARGS+=(--build-arg "UV_EXTRA_INDEX_URL=$UV_EXTRA_INDEX_URL")
          fi
          if [ -n "${UV_INDEX_STRATEGY:-}" ]; then
            BUILD_ARGS+=(--build-arg "UV_INDEX_STRATEGY=$UV_INDEX_STRATEGY")
          fi
          docker build . \
            -f containers/Containerfile \
            "${BUILD_ARGS[@]}" \
            --tag ogx:${{ matrix.distro }}-ci

  build-arm64:
    if: github.event_name == 'schedule'
    needs: generate-matrix
    runs-on: ubuntu-latest
    timeout-minutes: 45
    strategy:
      matrix:
        distro: ${{ fromJson(needs.generate-matrix.outputs.distros) }}
      fail-fast: false # We want to run all jobs even if some fail

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install dependencies
        uses: ./.github/actions/setup-runner

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5

      - name: Build ARM64 container image
        run: |
          BUILD_ARGS=(--build-arg "INSTALL_MODE=editable" --build-arg "DISTRO_NAME=${{ matrix.distro }}")
          if [ -n "${UV_EXTRA_INDEX_URL:-}" ]; then
            BUILD_ARGS+=(--build-arg "UV_EXTRA_INDEX_URL=$UV_EXTRA_INDEX_URL")
          fi
          if [ -n "${UV_INDEX_STRATEGY:-}" ]; then
            BUILD_ARGS+=(--build-arg "UV_INDEX_STRATEGY=$UV_INDEX_STRATEGY")
          fi
          docker buildx build --platform linux/arm64 --load . \
            -f containers/Containerfile \
            "${BUILD_ARGS[@]}" \
            --tag ogx:${{ matrix.distro }}-arm64-ci

  build-single-provider:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install dependencies
        uses: ./.github/actions/setup-runner

      - name: Show single provider dependencies
        run: |
          USE_COPY_NOT_MOUNT=true OGX_DIR=. uv run ogx stack list-deps --providers inference=remote::ollama

      - name: Build a single provider
        run: |
          uv pip install -e .
          uv run --no-sync ogx stack list-deps --providers inference=remote::ollama | xargs -L1 uv pip install

  list-deps-from-config:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install dependencies
        uses: ./.github/actions/setup-runner

      - name: List deps from config
        env:
          USE_COPY_NOT_MOUNT: "true"
          OGX_DIR: "."
        run: |
          uv run ogx stack list-deps src/ogx/distributions/ci-tests/config.yaml

  build-custom-container-distribution:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install dependencies
        uses: ./.github/actions/setup-runner

      - name: Build container image
        run: |
          BASE_IMAGE=$(yq -r '.distribution_spec.container_image // "python:3.12-slim"' src/ogx/distributions/ci-tests/config.yaml)
          BUILD_ARGS=(--build-arg "INSTALL_MODE=editable" --build-arg "DISTRO_NAME=ci-tests")
          BUILD_ARGS+=(--build-arg "BASE_IMAGE=$BASE_IMAGE")
          BUILD_ARGS+=(--build-arg "RUN_CONFIG_PATH=/workspace/src/ogx/distributions/ci-tests/config.yaml")
          if [ -n "${UV_EXTRA_INDEX_URL:-}" ]; then
            BUILD_ARGS+=(--build-arg "UV_EXTRA_INDEX_URL=$UV_EXTRA_INDEX_URL")
          fi
          if [ -n "${UV_INDEX_STRATEGY:-}" ]; then
            BUILD_ARGS+=(--build-arg "UV_INDEX_STRATEGY=$UV_INDEX_STRATEGY")
          fi
          docker build . \
            -f containers/Containerfile \
            "${BUILD_ARGS[@]}" \
            -t ogx:ci-tests

      - name: Inspect the container image entrypoint
        run: |
          IMAGE_ID=$(docker images --format "{{.Repository}}:{{.Tag}}" | head -n 1)
          if [ -z "$IMAGE_ID" ]; then
            echo "No image found"
            exit 1
          fi
          entrypoint=$(docker inspect --format '{{ .Config.Entrypoint }}' "$IMAGE_ID")
          echo "Entrypoint: $entrypoint"
          if [ "$entrypoint" != "[/usr/local/bin/ogx-entrypoint.sh]" ]; then
            echo "Entrypoint is not correct"
            exit 1
          fi

  build-ubi9-container-distribution:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install dependencies
        uses: ./.github/actions/setup-runner

      - name: Pin distribution to UBI9 base
        run: |
          yq -i '
            .distribution_spec.container_image = "registry.access.redhat.com/ubi9:latest"
          ' src/ogx/distributions/ci-tests/config.yaml

      - name: Create UBI9 pip constraints
        run: |
          # UBI9 ships glibc 2.34; semgrep >= 1.158 requires manylinux_2_35
          echo "semgrep<1.158" > ubi9-constraints.txt

      - name: Build UBI9 container image
        run: |
          BASE_IMAGE=$(yq -r '.distribution_spec.container_image // "registry.access.redhat.com/ubi9:latest"' src/ogx/distributions/ci-tests/config.yaml)
          BUILD_ARGS=(--build-arg "INSTALL_MODE=editable" --build-arg "DISTRO_NAME=ci-tests")
          BUILD_ARGS+=(--build-arg "BASE_IMAGE=$BASE_IMAGE")
          BUILD_ARGS+=(--build-arg "RUN_CONFIG_PATH=/workspace/src/ogx/distributions/ci-tests/config.yaml")
          BUILD_ARGS+=(--build-arg "PIP_CONSTRAINT_FILE=/workspace/ubi9-constraints.txt")
          if [ -n "${UV_EXTRA_INDEX_URL:-}" ]; then
            BUILD_ARGS+=(--build-arg "UV_EXTRA_INDEX_URL=$UV_EXTRA_INDEX_URL")
          fi
          if [ -n "${UV_INDEX_STRATEGY:-}" ]; then
            BUILD_ARGS+=(--build-arg "UV_INDEX_STRATEGY=$UV_INDEX_STRATEGY")
          fi
          docker build . \
            -f containers/Containerfile \
            "${BUILD_ARGS[@]}" \
            -t ogx:ci-tests-ubi9

      - name: Inspect UBI9 image
        run: |
          IMAGE_ID=$(docker images --format "{{.Repository}}:{{.Tag}}" | head -n 1)
          if [ -z "$IMAGE_ID" ]; then
            echo "No image found"
            exit 1
          fi
          entrypoint=$(docker inspect --format '{{ .Config.Entrypoint }}' "$IMAGE_ID")
          echo "Entrypoint: $entrypoint"
          if [ "$entrypoint" != "[/usr/local/bin/ogx-entrypoint.sh]" ]; then
            echo "Entrypoint is not correct"
            exit 1
          fi

          echo "Checking /etc/os-release in $IMAGE_ID"
          docker run --rm --entrypoint sh "$IMAGE_ID" -c \
              'source /etc/os-release && echo "$ID"' \
              | grep -qE '^(rhel|ubi)$' \
              || { echo "Base image is not UBI 9!"; exit 1; }

  build-starter-ubi9-arm64-container:
    if: github.event_name == 'schedule'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install dependencies
        uses: ./.github/actions/setup-runner

      - name: Set up QEMU for ARM64 emulation
        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5

      - name: Build starter distribution on UBI9 ARM64
        run: |
          BASE_IMAGE="registry.access.redhat.com/ubi9:latest"
          BUILD_ARGS=(--build-arg "INSTALL_MODE=editable" --build-arg "DISTRO_NAME=starter")
          BUILD_ARGS+=(--build-arg "BASE_IMAGE=$BASE_IMAGE")
          if [ -n "${UV_EXTRA_INDEX_URL:-}" ]; then
            BUILD_ARGS+=(--build-arg "UV_EXTRA_INDEX_URL=$UV_EXTRA_INDEX_URL")
          fi
          if [ -n "${UV_INDEX_STRATEGY:-}" ]; then
            BUILD_ARGS+=(--build-arg "UV_INDEX_STRATEGY=$UV_INDEX_STRATEGY")
          fi
          docker buildx build --platform linux/arm64 --load . \
            -f containers/Containerfile \
            "${BUILD_ARGS[@]}" \
            --tag ogx:starter-ubi9-arm64

      - name: Inspect starter UBI9 ARM64 image
        run: |
          IMAGE_ID=$(docker images --format "{{.Repository}}:{{.Tag}}" | head -n 1)
          if [ -z "$IMAGE_ID" ]; then
            echo "No image found"
            exit 1
          fi
          entrypoint=$(docker inspect --format '{{ .Config.Entrypoint }}' "$IMAGE_ID")
          echo "Entrypoint: $entrypoint"
          if [ "$entrypoint" != "[/usr/local/bin/ogx-entrypoint.sh]" ]; then
            echo "Entrypoint is not correct"
            exit 1
          fi

          echo "Checking /etc/os-release in $IMAGE_ID"
          docker run --rm --platform linux/arm64 --entrypoint sh "$IMAGE_ID" -c \
              'source /etc/os-release && echo "$ID"' \
              | grep -qE '^(rhel|ubi)$' \
              || { echo "Base image is not UBI 9!"; exit 1; }