build-images.yml

name: Build images

on:
  workflow_call:
    inputs:
      targets:
        required: true
        type: string
      artifact_name:
        required: true
        type: string
      artifact_paths:
        required: true
        type: string
    outputs:
      stable_tags:
        description: Stable tags
        value: ${{ jobs.build.outputs.stable_tags }}
      stable_version:
        description: Stable version
        value: ${{ jobs.build.outputs.stable_version }}
      output_method:
        description: Output method
        value: ${{ jobs.build.outputs.output_method }}

jobs:
  build:
    runs-on: ubuntu-latest
    name: Build
    permissions:
      packages: write
    outputs:
      stable_tags: ${{ steps.bake-metadata.outputs.stable_tags }}
      stable_version: ${{ steps.bake-metadata.outputs.stable_version }}
      output_method: ${{ steps.bake-metadata.outputs.output_method }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.1
        with:
          persist-credentials: false

      - name: Make bake metadata
        id: bake-metadata
        env:
          GITHUB_CONTEXT: ${{ toJson(github) }}
        run: |
          set -euo pipefail
          echo ::group::Github context
          python3 -m json.tool <<< "${GITHUB_CONTEXT}"
          echo ::endgroup::

          echo ::group::Bake metadata
          .github/scripts/bake-metadata.py | tee bake-metadata.json
          echo ::endgroup::

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4.2.0
        with:
          buildkitd-flags: --debug

      - name: Login to ghcr.io
        uses: docker/login-action@v4.6.0
        with:
          registry: ghcr.io
          username: "$" # special user for authenticating as a gh actions worker
          password: ${{ secrets.GITHUB_TOKEN }}

      # This action happens to randomly fail, so we retry it 3 times.
      # Whitelisted messages are:
      #
      # - `failed to solve: failed to compute cache key`
      #   full message: `failed to solve: failed to compute cache key: failed to get state for index 0 on XXXXXX`
      #
      # - `httpReadSeeker: failed open:`
      #   full message: `ERROR: failed to solve: DeadlineExceeded: failed to compute cache key: failed to copy: httpReadSeeker: failed open: no active session for XXXXX: context deadline exceeded`
      - name: Build and push
        run: |
          set -euo pipefail

          # disable cache mounts as github cache is slow
          find \( -name Dockerfile -o -name "Dockerfile.*" \) -print0 | xargs -0 sed -Ei 's/--mount=type=cache,target=[^[:blank:]]+//g'

          TRANSIENT_FAILURES=(
            "failed to solve: failed to compute cache key"
            "httpReadSeeker: failed open:"
          )
          BAKEFILE="--file=docker/docker-bake.hcl"
          METADATA="--file=bake-metadata.json"
          TARGETS="${{ join(inputs.targets, ' ') }}"

          for i in $(seq 1 3); do
            echo "::group::Try $i"
            if docker buildx bake $BAKEFILE $METADATA $TARGETS 2>&1 | tee docker-build.log; then
              echo "::endgroup::"
              exit 0
            fi
            echo "::endgroup::"

            for failure_msg in "${TRANSIENT_FAILURES[@]}"; do
              if grep -q "$failure_msg" docker-build.log; then
                echo "Transient failure detected, retrying..."
                continue 2
              fi
            done

            echo "Build failed for non-transient cause, exiting."
            exit 1
          done
          echo "All retries failed, exiting."
          exit 1
      - name: Upload image tarballs as artifact
        uses: actions/upload-artifact@v7.0.1
        if: steps.bake-metadata.outputs.output_method == 'artifact'
        with:
          name: ${{ inputs.artifact_name }}
          path: ${{ inputs.artifact_paths }}
          if-no-files-found: error