build_images.yaml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Build and push image variant

on:
  workflow_call:
    inputs:
      ARCHES:
        required: true
        type: string
      CUDA_VER:
        required: true
        type: string
      CUOPT_VER:
        required: true
        type: string
      IMAGE_TAG_PREFIX:
        required: true
        type: string
      LINUX_VER:
        required: true
        type: string
      PYTHON_VER:
        required: true
        type: string
      sha:
        description: "sha: full git commit SHA to check out"
        required: true
        type: string

jobs:
  build:
    strategy:
      matrix:
        ARCH: ["${{ inputs.ARCHES }}"]
        CUDA_VER: ["${{ inputs.CUDA_VER }}"]
        PYTHON_VER: ["${{ inputs.PYTHON_VER }}"]
        LINUX_VER: ["${{ inputs.LINUX_VER }}"]
      fail-fast: false
    runs-on: "linux-${{ matrix.ARCH }}-cpu4"
    steps:
      - name: Checkout code repo
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 0
          ref: ${{ inputs.sha }}
          persist-credentials: false
      - name: Login to DockerHub
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.CUOPT_DOCKERHUB_USERNAME }}
          password: ${{ secrets.CUOPT_DOCKERHUB_TOKEN }}
      - name: Copy License and Version files
        run: |
          cp ./LICENSE ./ci/docker/context/LICENSE
          cp ./VERSION ./ci/docker/context/VERSION
          cp ./thirdparty/THIRD_PARTY_LICENSES ./ci/docker/context/THIRD_PARTY_LICENSES
          cp ./ci/docker/entrypoint.sh ./ci/docker/context/entrypoint.sh
      - name: Copy Commit SHA and commit time
        run: |
          git rev-parse HEAD > ./ci/docker/context/COMMIT_SHA
          git log -n1 --pretty='%ct' > ./ci/docker/context/COMMIT_TIME
      - name: Login to NGC
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: "nvcr.io"
          username: "$oauthtoken"
          password: ${{ secrets.CUOPT_NGC_DOCKER_KEY }}
      - name: Set up Docker Context for Buildx
        id: buildx-context
        run: |
          docker context create builders
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
        with:
          driver: docker
          endpoint: ./ci/docker/context
      - name: Trim CUDA and Python versions
        id: trim
        env:
          CUDA_VER: ${{ inputs.CUDA_VER }}
          PYTHON_VER: ${{ inputs.PYTHON_VER }}
        run: |
          echo "CUDA_SHORT=$(echo "$CUDA_VER" | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_OUTPUT
          echo "PYTHON_SHORT=$(echo "$PYTHON_VER" | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_OUTPUT
      - name: Build image and push to DockerHub and NGC
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
          context: ./ci/docker/context
          file: ./ci/docker/Dockerfile
          push: true
          pull: true
          # Disable provenance and sbom to push single-arch images instead of manifest lists
          # This is required for create_multiarch_manifest.sh to work correctly
          provenance: false
          sbom: false
          build-args: |
            CUDA_VER=${{ inputs.CUDA_VER }}
            PYTHON_SHORT_VER=${{ steps.trim.outputs.PYTHON_SHORT }}
            CUOPT_VER=${{ inputs.CUOPT_VER }}
            LINUX_VER=${{ inputs.LINUX_VER }}
          tags: nvidia/cuopt:${{ inputs.IMAGE_TAG_PREFIX }}-cuda${{ steps.trim.outputs.CUDA_SHORT }}-py${{ steps.trim.outputs.PYTHON_SHORT }}-${{ matrix.ARCH }}

      - name: Push image to NGC
        env:
          IMAGE_TAG_PREFIX: ${{ inputs.IMAGE_TAG_PREFIX }}
          ARCH: ${{ matrix.ARCH }}
          CUDA_SHORT: ${{ steps.trim.outputs.CUDA_SHORT }}
          PYTHON_SHORT: ${{ steps.trim.outputs.PYTHON_SHORT }}
        run: |
          docker tag "nvidia/cuopt:${IMAGE_TAG_PREFIX}-cuda${CUDA_SHORT}-py${PYTHON_SHORT}-${ARCH}" "nvcr.io/nvstaging/nvaie/cuopt:${IMAGE_TAG_PREFIX}-cuda${CUDA_SHORT}-py${PYTHON_SHORT}-${ARCH}"
          docker push "nvcr.io/nvstaging/nvaie/cuopt:${IMAGE_TAG_PREFIX}-cuda${CUDA_SHORT}-py${PYTHON_SHORT}-${ARCH}"

      - name: Build UBI10 image and push to DockerHub and NGC
        if: ${{ startsWith(inputs.CUDA_VER, '13.') }}
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
          context: ./ci/docker/context
          file: ./ci/docker/Dockerfile.ubi
          push: true
          pull: true
          provenance: false
          sbom: false
          build-args: |
            CUDA_VER=${{ inputs.CUDA_VER }}
            CUOPT_VER=${{ inputs.CUOPT_VER }}
          tags: nvidia/cuopt:${{ inputs.IMAGE_TAG_PREFIX }}-cuda${{ steps.trim.outputs.CUDA_SHORT }}-ubi10-${{ matrix.ARCH }}

      - name: Push UBI10 image to NGC
        if: ${{ startsWith(inputs.CUDA_VER, '13.') }}
        env:
          IMAGE_TAG_PREFIX: ${{ inputs.IMAGE_TAG_PREFIX }}
          ARCH: ${{ matrix.ARCH }}
          CUDA_SHORT: ${{ steps.trim.outputs.CUDA_SHORT }}
        run: |
          docker tag "nvidia/cuopt:${IMAGE_TAG_PREFIX}-cuda${CUDA_SHORT}-ubi10-${ARCH}" "nvcr.io/nvstaging/nvaie/cuopt:${IMAGE_TAG_PREFIX}-cuda${CUDA_SHORT}-ubi10-${ARCH}"
          docker push "nvcr.io/nvstaging/nvaie/cuopt:${IMAGE_TAG_PREFIX}-cuda${CUDA_SHORT}-ubi10-${ARCH}"