tinycloud-node/.github/workflows/docker.yml at main · TinyCloudLabs/tinycloud-node · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
name: Docker Container

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  release:
    types: [published]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: tinycloudlabs/tinycloud-node

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        if: github.event_name == 'release' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels)
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=sha,prefix=
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: ${{ github.event_name == 'release' || (github.event_name == 'push' && github.ref == 'refs/heads/main') }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  build-dstack:
    runs-on: ubuntu-latest
    if: github.event_name == 'release' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels)
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}},suffix=-dstack
            type=semver,pattern={{major}}.{{minor}},suffix=-dstack
            type=semver,pattern={{major}},suffix=-dstack
            type=sha,prefix=dstack-
            type=raw,value=dstack,enable={{is_default_branch}}

      - name: Build and push dstack Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: CARGO_FEATURES=dstack
          cache-from: type=gha,scope=dstack
          cache-to: type=gha,mode=max,scope=dstack

  deploy-phala:
    runs-on: ubuntu-latest
    needs: [build, build-dstack]
    if: github.event_name == 'release'
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Phala CLI
        run: npm install -g phala

      - name: Update compose with release tag
        run: |
          TAG="${{ github.event.release.tag_name }}"
          # metadata-action emits {{version}} without the leading v (e.g. 1.3.0).
          # Strip a leading v from the tag to match the pushed image tag.
          VERSION="${TAG#v}"
          # The prod CVM uses the dstack-suffixed image. Replace the floating
          # ":dstack" tag in the checked-in compose with the versioned tag
          # built by the build-dstack job (e.g. ":1.3.0-dstack").
          sed -i "s|ghcr.io/tinycloudlabs/tinycloud-node:dstack|ghcr.io/tinycloudlabs/tinycloud-node:${VERSION}-dstack|g" docker-compose.dstack-postgres.yaml
          echo "Resolved image tag: ghcr.io/tinycloudlabs/tinycloud-node:${VERSION}-dstack"
          cat docker-compose.dstack-postgres.yaml

      - name: Deploy to Phala Cloud
        env:
          PHALA_CLOUD_API_KEY: ${{ secrets.PHALA_CLOUD_API_KEY }}
        # Update the existing prod CVM (name: tinycloud-node) in the
        # Tiny Cloud workspace. The PHALA_CLOUD_API_KEY secret is
        # workspace-scoped and must be issued from that workspace.
        run: phala deploy --cvm-id tinycloud-node -c docker-compose.dstack-postgres.yaml --wait