docker-services.yml

name: Docker Services

on:
  push:
    branches: [main, next]
    tags: ["infra-v*", "bento-v*", "prover-v*", "broker-v*"]
  workflow_dispatch:
    inputs:
      custom_tag:
        description: 'Optional custom image tag (e.g. "my-feature", "test-123")'
        required: false
        type: string

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  id-token: write
  contents: read
  packages: write

env:
  REGISTRY: ghcr.io
  IMAGE_PREFIX: ghcr.io/${{ github.repository }}

jobs:
  build-base:
    runs-on: [self-hosted, prod, Linux, cpu]
    outputs:
      image: ${{ steps.meta.outputs.tags }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_CI_USER }}
          password: ${{ secrets.DOCKERHUB_CI_PAT }}

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.IMAGE_PREFIX }}/builder-base
          tags: |
            type=raw,value=latest
            type=sha

      - name: Fetch BuildKit cache AWS creds
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: "us-west-2"
          role-duration-seconds: 14400
          role-to-assume: "arn:aws:iam::083632199359:role/gha_oidc_risc0_cache_shared_access"

      - name: Build and push builder-base
        uses: docker/build-push-action@v6
        with:
          context: .
          file: dockerfiles/builder-base.dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          secrets: |
            githubTokenSecret=${{ secrets.GITHUB_TOKEN }}
          cache-from: type=s3,name=builder-base-cache,manifests_prefix=shared/boundless/docker/manifests/,blobs_prefix=shared/boundless/docker/blobs/,region=us-west-2,bucket=risc0-ci-cache
          cache-to: type=s3,name=builder-base-cache,manifests_prefix=shared/boundless/docker/manifests/,blobs_prefix=shared/boundless/docker/blobs/,region=us-west-2,bucket=risc0-ci-cache,mode=max

  prepare-recipe:
    runs-on: [self-hosted, prod, Linux, cpu]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@6d653acede28d24f02e3cd41383119e8b1b35921
        with:
          toolchain: 1.89.0

      - name: Cache cargo-chef binary
        id: cache-chef
        uses: actions/cache@v4
        with:
          path: ~/.cargo/bin/cargo-chef
          key: cargo-chef-${{ runner.os }}-${{ runner.arch }}-v1

      - name: Install cargo-chef
        if: steps.cache-chef.outputs.cache-hit != 'true'
        run: cargo install cargo-chef --locked

      - name: Generate recipe
        run: cargo chef prepare --recipe-path recipe.json

      - name: Upload recipe
        uses: actions/upload-artifact@v4
        with:
          name: recipe
          path: recipe.json
          retention-days: 1

  build-and-push:
    needs: [build-base, prepare-recipe]
    strategy:
      fail-fast: false
      matrix:
        service:
          - name: slasher
            dockerfile: dockerfiles/slasher.dockerfile
            submodules: false
            runner: [self-hosted, prod, Linux, cpu]
          - name: order-stream
            dockerfile: dockerfiles/order_stream.dockerfile
            submodules: false
            runner: [self-hosted, prod, Linux, cpu]
          - name: indexer
            dockerfile: dockerfiles/indexer.dockerfile
            submodules: false
            runner: [self-hosted, prod, Linux, cpu]
          - name: distributor
            dockerfile: dockerfiles/distributor.dockerfile
            submodules: false
            runner: [self-hosted, prod, Linux, cpu]
          - name: order-generator
            dockerfile: dockerfiles/order_generator.dockerfile
            submodules: false
            runner: [self-hosted, prod, Linux, cpu]
          - name: broker
            dockerfile: dockerfiles/broker.dockerfile
            submodules: false
            runner: [self-hosted, prod, Linux, cpu]
          - name: bento-rest-api
            dockerfile: dockerfiles/rest_api.dockerfile
            submodules: false
            runner: [self-hosted, prod, Linux, cpu]
          - name: bento-cli
            dockerfile: dockerfiles/bento_cli.dockerfile
            submodules: false
            runner: [self-hosted, prod, Linux, cpu]
          - name: bento-agent
            dockerfile: dockerfiles/agent.dockerfile
            submodules: false
            runner: [self-hosted, Linux, X64, prod, cuda, g6.4xlarge]
          - name: bento-agent-cpu
            dockerfile: dockerfiles/agent.cpu.dockerfile
            submodules: false
            runner: [self-hosted, prod, Linux, cpu]
          # Prover (next-gen bento) services — tagged with prover- prefix
          - name: prover-rest-api
            dockerfile: dockerfiles/prover/rest_api.dockerfile
            submodules: false
            runner: [self-hosted, prod, Linux, cpu]
          - name: prover-cli
            dockerfile: dockerfiles/prover/prover_cli.dockerfile
            submodules: false
            runner: [self-hosted, prod, Linux, cpu]
          - name: prover-agent
            dockerfile: dockerfiles/prover/agent.dockerfile
            submodules: false
            runner: [self-hosted, Linux, X64, prod, cuda, g6.4xlarge]
          - name: prover-agent-cpu
            dockerfile: dockerfiles/prover/agent.cpu.dockerfile
            submodules: false
            runner: [self-hosted, prod, Linux, cpu]
    runs-on: ${{ matrix.service.runner }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          submodules: ${{ matrix.service.submodules }}

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_CI_USER }}
          password: ${{ secrets.DOCKERHUB_CI_PAT }}

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.IMAGE_PREFIX }}/${{ matrix.service.name }}
          tags: |
            type=sha,prefix=nightly-
            type=raw,value=nightly-latest,enable=${{ github.ref == 'refs/heads/main' }}
            type=raw,value=next-latest,enable=${{ github.ref == 'refs/heads/next' }}
            type=match,pattern=infra-v(.*),group=1
            type=ref,event=pr
            type=raw,value=${{ inputs.custom_tag }},enable=${{ inputs.custom_tag != '' }}

      - name: Download recipe
        uses: actions/download-artifact@v4
        with:
          name: recipe
          path: ./recipe-out

      - name: Prepare planner override
        run: mkdir -p /tmp/planner-ctx/src && cp ./recipe-out/recipe.json /tmp/planner-ctx/src/recipe.json

      - name: Fetch sccache AWS creds
        id: sccache-creds
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: "us-west-2"
          role-duration-seconds: 14400
          role-to-assume: "arn:aws:iam::033359631619:role/gha_oidc_boundless_cache_public_access"
          output-credentials: true

      - name: Create sccache creds file for Docker build
        run: |
          echo "[default]" > ./dockerfiles/ci-cache-creds.txt
          echo "aws_access_key_id=${{ steps.sccache-creds.outputs.aws-access-key-id }}" >> ./dockerfiles/ci-cache-creds.txt
          echo "aws_secret_access_key=${{ steps.sccache-creds.outputs.aws-secret-access-key }}" >> ./dockerfiles/ci-cache-creds.txt
          echo "aws_session_token=${{ steps.sccache-creds.outputs.aws-session-token }}" >> ./dockerfiles/ci-cache-creds.txt

      - name: Fetch BuildKit cache AWS creds
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: "us-west-2"
          role-duration-seconds: 14400
          role-to-assume: "arn:aws:iam::083632199359:role/gha_oidc_risc0_cache_shared_access"

      - name: Build and push ${{ matrix.service.name }}
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ matrix.service.dockerfile }}
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-contexts: |
            planner=/tmp/planner-ctx
          build-args: |
            BUILDER_BASE=${{ env.IMAGE_PREFIX }}/builder-base:latest
            S3_CACHE_BUCKET=boundless-ci-prod-cache
            S3_CACHE_PREFIX=public/boundless/rust-cache-docker-Linux-X64/sccache
            BLAKE3_GROTH16_ARTIFACTS_URL=https://staging-signal-artifacts.beboundless.xyz/v3/proving/blake3_groth16_artifacts.tar.xz
          cache-from: type=s3,name=${{ matrix.service.name }}-cache,manifests_prefix=shared/boundless/docker/manifests/,blobs_prefix=shared/boundless/docker/blobs/,region=us-west-2,bucket=risc0-ci-cache
          cache-to: type=s3,name=${{ matrix.service.name }}-cache,manifests_prefix=shared/boundless/docker/manifests/,blobs_prefix=shared/boundless/docker/blobs/,region=us-west-2,bucket=risc0-ci-cache,mode=max
          secrets: |
            githubTokenSecret=${{ secrets.GITHUB_TOKEN }}
          secret-files: |
            ci_cache_creds=./dockerfiles/ci-cache-creds.txt