ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:

# Ensure only one workflow instance runs at a time. For branches other than the
# default branch, cancel the pending jobs in the group. For the default branch,
# queue them up. This avoids cancelling jobs that are in the middle of deploying
# to production.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != format('refs/heads/{0}', github.event.repository.default_branch) }}

jobs:
  check:
    name: Check
    runs-on: ubuntu-latest-4-cores
    env:
      R8_CUDA_PREFIX: ${{ secrets.R8_CUDA_PREFIX }}
      R8_CUDNN_PREFIX: ${{ secrets.R8_CUDNN_PREFIX }}
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v3
      - run: ./script/check

  test:
    name: Test
    runs-on: ubuntu-latest-4-cores
    env:
      R8_CUDA_PREFIX: ${{ secrets.R8_CUDA_PREFIX }}
      R8_CUDNN_PREFIX: ${{ secrets.R8_CUDNN_PREFIX }}
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v3
      - run: ./script/build
      - run: ./script/build-runtime
      - run: ./script/test

  test-mini:
    name: Test Mini
    runs-on: ubuntu-latest-4-cores
    env:
      R8_CUDA_PREFIX: ${{ secrets.R8_CUDA_PREFIX }}
      R8_CUDNN_PREFIX: ${{ secrets.R8_CUDNN_PREFIX }}
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v3
      - run: ./script/build
      - run: ./script/test-mini

  build-release:
    name: Build + release ${{ matrix.image.name }} image
    needs:
      - check
      - test
      - test-mini
    permissions:
      contents: read
      id-token: write
    strategy:
      matrix:
        image:
          - name: monobase
          - name: monobase-runtime
            file: runtime.Dockerfile
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0
    - name: Set Docker metadata
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: |
          us-docker.pkg.dev/replicate-production/replicate-us/${{ matrix.image.name }}
        tags: |
          type=sha
          type=raw,value=latest,enable={{is_default_branch}},priority=0
        labels: |
          org.opencontainers.image.title=${{ matrix.image.name }}
    - name: Set up Buildx
      uses: docker/setup-buildx-action@v3
      with:
        platforms: linux/amd64,linux/arm64
    - name: Authenticate to Google Cloud
      id: auth
      uses: google-github-actions/auth@v2
      with:
        workload_identity_provider: projects/1025538909507/locations/global/workloadIdentityPools/github/providers/github-actions
        service_account: builder@replicate-production.iam.gserviceaccount.com
        token_format: access_token
    - name: Log into US Artifact Registry
      uses: docker/login-action@v3
      with:
        registry: us-docker.pkg.dev
        username: oauth2accesstoken
        password: ${{ steps.auth.outputs.access_token }}
    - name: Build and push
      uses: docker/build-push-action@v6
      with:
        context: '{{defaultContext}}'
        file: ${{ matrix.image.file || '' }}
        push: ${{ github.event_name != 'pull_request' }}
        platforms: linux/amd64,linux/arm64
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        cache-from: type=gha,scope=${{ matrix.image.name }}
        cache-to: type=gha,scope=${{ matrix.image.name }},mode=max
        build-args: |
          COMMIT_SHA=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
          BUILDKIT_CONTEXT_KEEP_GIT_DIR=1