feat(stages)!: staged builds for full images

.github/workflows/build_push.yaml

@@ -29,31 +29,10 @@ on:
   push:
     branches:
       - 'master'
-  pull_request:
-    types:
-      - 'opened'
-      - 'synchronize'
-      - 'reopened'
 env:
   SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
 
 jobs:
-  # Any checks that run pre-build
-  pre-build-checks:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@master
-
-    - name: Assert committed ./output folder matches `make generate-dockerfiles` output
-      run: |
-        sudo apt-get install --yes make
-        make clean
-        make generate-dockerfiles
-        if ! git diff --quiet output/; then
-            echo 'output folder and docker-bits/resources out of sync!'
-            exit 1
-        fi
-
   build-push:
     env:
       REGISTRY_NAME: k8scc01covidacr
@@ -81,7 +60,6 @@ jobs:
           - jupyterlab-pytorch 
           # - jupyterlab-tensorflow removed from build. https://jirab.statcan.ca/browse/BTIS-421
           - remote-desktop 
-    needs: pre-build-checks
     runs-on: ubuntu-latest
     services:
       registry:

.github/workflows/check-diff.yaml

@@ -0,0 +1,39 @@
+name: Check for changes in subdirectory
+
+on:
+  workflow_call:
+    inputs:
+      image:
+        description: Image name
+        required: true
+        type: string
+    outputs:
+      is-diff:
+        description: Is there a difference between the master branch and the current branch
+        value: ${{ jobs.check-diff.outputs.is-diff }}
+
+jobs:
+  check-diff:
+    runs-on: ubuntu-latest
+    outputs:
+      is-diff: ${{ steps.check-changes.outputs.is-diff }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Fetch master branch
+        run: |
+          git fetch origin staged-builds:staged-builds # TODO staged-builds:staged-builds to master:master
+
+      - name: Check for changes
+        id: check-changes
+        run: | # Check for changes excluding README.md
+          CHANGES=$(git diff --name-only origin/staged-builds HEAD -- "images/${{ inputs.image }}" | grep -v "README.md" || true) # TODO staged-builds to master for live
+
+          if [ -n "$CHANGES" ]; then
+            echo "Changes detected (excluding README.md)"
+            echo "is-diff=true" >> $GITHUB_OUTPUT
+          else
+            echo "No changes detected"
+            echo "is-diff=false" >> $GITHUB_OUTPUT
+          fi

.github/workflows/docker-build-upload.yaml

@@ -0,0 +1,103 @@
+name: Download a parent image, build a new one, and test it; then upload the image, tags, and manifests to GitHub artifacts
+
+env:
+  HADOLINT_VERSION: "2.12.0"
+
+on:
+  workflow_call:
+    inputs:
+      parent-image:
+        description: Parent image name
+        required: true
+        type: string
+      directory:
+        description: The directory of the image files
+        required: true
+        type: string
+      image:
+        description: Image name
+        required: true
+        type: string
+      base-image:
+        description: The base image to build from if not located on our own repo
+        required: false
+        type: string
+      registry-name:
+        description: url of the registry <registy-name>.azurecr.io
+        required: true
+        type: string
+    secrets:
+      REGISTRY_USERNAME:
+        description: The username for the container registry
+        required: true
+      REGISTRY_PASSWORD:
+        description: The password for the container registry
+        required: true
+
+jobs:
+  build-upload:
+    runs-on: ubuntu-latest
+    services:
+      registry:
+        image: registry:2
+        ports:
+          - 5000:5000
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run Hadolint
+        run: |
+          sudo curl -L https://github.com/hadolint/hadolint/releases/download/v${{ env.HADOLINT_VERSION }}/hadolint-Linux-x86_64 --output hadolint
+          sudo chmod +x hadolint
+          ./hadolint images/${{ inputs.directory }}/Dockerfile --no-fail
+
+      - name: Echo disk usage before clean up
+        run: ./.github/scripts/echo_usage.sh
+
+      - name: Free up all available disk space before building
+        run: ./.github/scripts/cleanup_runner.sh
+
+      - name: Echo disk usage before build start
+        run: ./.github/scripts/echo_usage.sh
+
+      # Connect to Azure Container registry (ACR)
+      - uses: azure/docker-login@v1
+        with:
+          login-server: ${{ inputs.registry-name }}.azurecr.io
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Pull parent image
+        id: pull-parent
+        if: inputs.parent-image != ''
+        run: make pull/${{ inputs.parent-image }} REPO=${{ inputs.registry-name }}.azurecr.io
+
+      - name: Set BASE_IMAGE variable
+        run: |
+          if [ "${{ inputs.base-image }}" == "" ]; then
+            echo "BASE_IMAGE=${{ steps.pull-parent.outputs.image_name }}" >> $GITHUB_ENV
+          else
+            echo "BASE_IMAGE=${{ inputs.base-image }}" >> $GITHUB_ENV
+          fi
+
+      - name: Set FROM and as in Docerfile
+        run: |
+          sed -i '1i FROM ${{ env.BASE_IMAGE}} as ${{ inputs.image }}' ./images/${{ inputs.directory }}/Dockerfile
+
+      # make build emits full_image_name, image_tag, and image_repo outputs
+      - name: Build image
+        id: build-image
+        run: make build/${{ inputs.image }} REPO=${{ inputs.registry-name }}.azurecr.io DIRECTORY=${{ inputs.directory }}
+
+      - name: Echo disk usage after build completion
+        run: ./.github/scripts/echo_usage.sh
+
+      - name: Add standard tag names (short sha, sha, and branch) and any other post-build activity
+        run: make post-build/${{ inputs.image }} REPO=${{ inputs.registry-name }}.azurecr.io
+
+      - name: Push image to registry (default pushes all tags)
+        run: make push/${{ inputs.image }} REPO=${{ inputs.registry-name }}.azurecr.io
+
+      # Free up space from build process (containerscan action will run out of space if we don't)
+      - run: ./.github/scripts/cleanup_runner.sh

.github/workflows/docker-pull-upload.yaml

@@ -0,0 +1,59 @@
+name: Download a parent image, build a new one, and test it; then upload the image, tags, and manifests to GitHub artifacts
+
+env:
+  HADOLINT_VERSION: "2.12.0"
+
+on:
+  workflow_call:
+    inputs:
+      image:
+        description: Image name
+        required: true
+        type: string
+      registry-name:
+        description: url of the registry <registy-name>.azurecr.io
+        required: true
+        type: string
+    secrets:
+      REGISTRY_USERNAME:
+        description: The username for the container registry
+        required: true
+      REGISTRY_PASSWORD:
+        description: The password for the container registry
+        required: true
+
+jobs:
+  pull-upload:
+    runs-on: ubuntu-latest
+    services:
+      registry:
+        image: registry:2
+        ports:
+          - 5000:5000
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Free up all available disk space before building
+        run: ./.github/scripts/cleanup_runner.sh
+
+      # Connect to Azure Container registry (ACR)
+      - uses: azure/docker-login@v1
+        with:
+          login-server: ${{ inputs.registry-name }}.azurecr.io
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Pull existing image
+        id: pull-existing
+        run: make pull/${{ inputs.image }} REPO=${{ inputs.registry-name }}.azurecr.io TAG=staged-builds
+        # TODO replace TAG with master
+
+      - name: Retag existing image
+        run: make post-build/${{ inputs.image }} REPO=${{ inputs.registry-name }}.azurecr.io SOURCE_FULL_IMAGE_NAME=${{ steps.pull-existing.outputs.image_name }}
+
+      - name: Push image to registry (default pushes all tags)
+        run: make push/${{ inputs.image }} REPO=${{ inputs.registry-name }}.azurecr.io
+
+      # Free up space from build process (containerscan action will run out of space if we don't)
+      - run: ./.github/scripts/cleanup_runner.sh

.github/workflows/docker-steps.yaml

@@ -0,0 +1,81 @@
+name: Build, test, and push Docker Images
+
+on:
+  workflow_call:
+    inputs:
+      image:
+        description: Image name
+        required: true
+        type: string
+      directory:
+        description: The directory of the image files
+        required: true
+        type: string
+      parent-image:
+        description: Parent image name
+        required: false
+        type: string
+      parent-image-is-diff:
+        description: Parent image has been changed?
+        required: false
+        type: string
+        default: "false"
+      base-image:
+        description: The base image to build from if not located on our own repo
+        required: false
+        type: string
+      registry-name:
+        description: url of the registry <registy-name>.azurecr.io
+        required: true
+        type: string
+    secrets:
+      REGISTRY_USERNAME:
+        description: The username for the container registry
+        required: true
+      REGISTRY_PASSWORD:
+        description: The password for the container registry
+        required: true
+    outputs:
+      is-diff:
+        description: Is there a difference between the master branch and the current branch
+        value: ${{ jobs.check-diff.outputs.is-diff }}
+
+jobs:
+  check-diff:
+    uses: ./.github/workflows/check-diff.yaml
+    with: 
+      image: ${{ inputs.image }}
+
+  print-variables:
+    needs: [check-diff]
+    runs-on: ubuntu-latest
+    steps:
+      - name: print inputs
+        run: echo "${{ toJSON(inputs) }}"
+      - name: print check-diff
+        run: echo "${{ toJSON(needs.check-diff) }}"
+
+  build-upload:
+    needs: [check-diff]
+    if: ${{ needs.check-diff.outputs.is-diff || (inputs.parent-image-is-diff == 'true') }}
+    uses: ./.github/workflows/docker-build-upload.yaml
+    with:
+      parent-image: ${{ inputs.parent-image }}
+      directory: ${{ inputs.directory }}
+      image: ${{ inputs.image }}
+      base-image: ${{ inputs.base-image }}
+      registry-name: ${{ inputs.registry-name }}
+    secrets:
+      REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+
+  pull-upload:
+    needs: [check-diff]
+    if: ${{ !needs.check-diff.outputs.is-diff && (inputs.parent-image-is-diff == 'false') }}
+    uses: ./.github/workflows/docker-pull-upload.yaml
+    with:
+      image: ${{ inputs.image }}
+      registry-name: ${{ inputs.registry-name }}
+    secrets:
+      REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}