Repository navigation
Fix two tests that failed only on amd64 #53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Builds the worker image and pushes it to the GitHub Container Registry. | |
| # | |
| # push to main (worker/ changed) :main :dev :sha-<short> | |
| # run manually the same, from whatever ref is chosen | |
| # tag vX.Y.Z :X.Y.Z :latest | |
| # tag vX.Y.Z-rc1 (a pre-release) :X.Y.Z-rc1 only; `latest` stays on the last real release | |
| # | |
| # `dev` is what a build that is not a release starts: `make local`, `make desktop` and anyone | |
| # running from source all stamp the version "dev", and emi-local turns that into this tag. It | |
| # follows main, so a contributor gets the worker their checkout expects without building a | |
| # 1.4 GB image first. | |
| # | |
| # The desktop app starts the image whose tag equals its own version, so every release tag must | |
| # produce that tag here -- the release workflow waits for nothing, but a release is not usable | |
| # until this job has pushed X.Y.Z. Which is why the decision to build is made in a job below | |
| # rather than by a `paths:` filter on the trigger: whether a path filter matches the push of a | |
| # tag is not something GitHub documents, and a release that silently ships with no worker image | |
| # is the worst failure this repository has. | |
| # | |
| # amd64 and arm64: the arm64 half is what makes a solve on Apple Silicon run natively instead of | |
| # under emulation. It builds under QEMU, which is fine now that nothing is compiled here: openEMS | |
| # comes prebuilt in the image the worker starts FROM (OPENEMS_IMAGE in worker/Dockerfile), | |
| # which openems-image.yml builds on native runners. That image is why a release must pin it by | |
| # digest: a tag could be rebuilt under a release after the fact. | |
| name: worker image | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ["v*"] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| env: | |
| IMAGE: ghcr.io/${{ github.repository_owner }}/emi-worker | |
| jobs: | |
| # Is there anything to build? A tag always is: see the note at the top. On main, only when | |
| # the worker or this file changed. The openEMS image's own directory does not count: a | |
| # change there reaches the worker only when worker/Dockerfile's pin moves. | |
| decide: | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| build: ${{ steps.check.outputs.build }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - id: check | |
| env: | |
| BEFORE: ${{ github.event.before }} | |
| REF_TYPE: ${{ github.ref_type }} | |
| EVENT: ${{ github.event_name }} | |
| SHA: ${{ github.sha }} | |
| run: | | |
| set -u | |
| reason="" | |
| if [ "$REF_TYPE" = "tag" ]; then | |
| reason="a tag needs an image carrying its own version" | |
| elif [ "$EVENT" = "workflow_dispatch" ]; then | |
| reason="asked for by hand" | |
| elif [ -z "$BEFORE" ] || [ "$BEFORE" = "0000000000000000000000000000000000000000" ]; then | |
| reason="there is no previous commit to compare with" | |
| elif ! git cat-file -e "$BEFORE^{commit}" 2>/dev/null; then | |
| reason="the previous commit is not in this checkout" | |
| elif ! git diff --quiet "$BEFORE" "$SHA" -- worker ':(exclude)worker/openems-image' .github/workflows/worker-image.yml; then | |
| reason="the worker changed" | |
| fi | |
| if [ -n "$reason" ]; then | |
| echo "build=true" >> "$GITHUB_OUTPUT" | |
| echo "building: $reason" | |
| else | |
| echo "build=false" >> "$GITHUB_OUTPUT" | |
| echo "nothing to do: the worker did not change" | |
| fi | |
| build: | |
| needs: decide | |
| if: needs.decide.outputs.build == 'true' | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 60 | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| # A release takes openEMS by digest, never by tag alone. See the note at the top. | |
| - name: openEMS image pinned by digest | |
| if: github.ref_type == 'tag' | |
| run: | | |
| grep -Eq '^ARG OPENEMS_IMAGE=[^ ]+@sha256:[0-9a-f]{64}$' worker/Dockerfile || { | |
| echo "worker/Dockerfile: OPENEMS_IMAGE has no @sha256 digest; pin the one openems-image.yml printed" | |
| exit 1 | |
| } | |
| - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 | |
| - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 | |
| - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - id: meta | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 | |
| with: | |
| images: ${{ env.IMAGE }} | |
| tags: | | |
| type=ref,event=branch | |
| type=sha,prefix=sha-,format=short | |
| type=semver,pattern={{version}} | |
| # Not for a pre-release (v1.2.3-rc1): `latest` is what someone gets without asking | |
| # for a version, and that should never be a release candidate. | |
| type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-') }} | |
| # What every build that is not a release starts. See the note at the top. | |
| type=raw,value=dev,enable=${{ !startsWith(github.ref, 'refs/tags/v') }} | |
| labels: | | |
| org.opencontainers.image.title=EMI Analyzer worker | |
| org.opencontainers.image.description=Board ingest, EMI/EMC rule checks, ngspice ESD transients and openEMS solves for the EMI Analyzer | |
| # The worker's code is Apache-2.0; the image also carries GPL programs it runs as | |
| # separate processes. worker/NOTICE, inside the image too, lists them. | |
| org.opencontainers.image.licenses=Apache-2.0 AND GPL-3.0-or-later AND LGPL-3.0-or-later AND GPL-2.0-or-later | |
| - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 | |
| with: | |
| context: worker | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| build-args: | | |
| EMI_WORKER_VERSION=${{ steps.meta.outputs.version }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max |