openfold-3/.github/workflows/docker.yml at main · rizsp/openfold-3 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
name: Publish Docker image

on:
  workflow_dispatch:  # Allow manual creation of docker images
    inputs:
      version:
        description: 'Version tag (e.g., 1.0.0)'
        required: true
        type: string
      additional_tags:
        description: 'Additional tags (comma-separated, e.g., latest,stable)'
        required: false
        type: string
        default: ''
  release:
    types: [published]

jobs:
  start-aws-runner:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    outputs:
      mapping: ${{ steps.aws-start.outputs.mapping }}
      instances: ${{ steps.aws-start.outputs.instances }}
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::203627415330:role/of-gha-runner
          aws-region: us-east-1
      - name: Create cloud runner
        id: aws-start
        uses: omsf/start-aws-gha-runner@v1.2.0
        with:
          aws_image_id: ami-0754c6e75b3b97dcd  # Deep Learning AMI Neuron (Ubuntu 22.04)
          aws_instance_type: trn1.2xlarge
          aws_home_dir: /home/ubuntu
          aws_root_device_size: 200
        env:
          GH_PAT: ${{ secrets.GH_PAT }}

  push-to-registry:
    name: Push Docker images to registries
    runs-on: ${{ fromJSON(needs.start-aws-runner.outputs.instances) }}
    needs:
      - start-aws-runner
    permissions:
      packages: write
      contents: read
      attestations: write
      id-token: write
    steps:
      - name: Check out the repo
        uses: actions/checkout@v7

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@9fe7774c8f8ebfade96f0a62aa10f3882309d517
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log in to Docker Hub
        if: github.repository == 'aqlaboratory/openfold-3'
        uses: docker/login-action@9fe7774c8f8ebfade96f0a62aa10f3882309d517
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      # --- Conda image ---

      - name: Extract metadata for conda image
        id: meta-conda
        uses: docker/metadata-action@020b7354dd55a28effcab0f3b19639fe24d3f58b
        with:
          images: |
            name=ghcr.io/${{ github.repository }}/openfold3-docker
            name=openfoldconsortium/openfold3,enable=${{ github.repository == 'aqlaboratory/openfold-3' }}
          tags: |
            type=raw,value=${{ inputs.version }}-conda,enable=${{ github.event_name == 'workflow_dispatch' }}
            type=raw,value=${{ inputs.additional_tags }}-conda,enable=${{ inputs.additional_tags != '' && github.event_name == 'workflow_dispatch' }}
            type=semver,pattern={{major}}.{{minor}}-conda

      - name: Build and push conda image
        id: push-conda
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
        with:
          context: .
          file: docker/Dockerfile.conda
          target: devel
          push: true
          tags: ${{ steps.meta-conda.outputs.tags }}
          labels: ${{ steps.meta-conda.outputs.labels }}

      - name: Generate artifact attestation (conda)
        if: github.repository == 'aqlaboratory/openfold-3'
        uses: actions/attest-build-provenance@v4
        with:
          subject-name: index.docker.io/openfoldconsortium/openfold3
          subject-digest: ${{ steps.push-conda.outputs.digest }}
          push-to-registry: true

      # --- Pixi image ---

      - name: Extract metadata for pixi image
        id: meta-pixi
        uses: docker/metadata-action@020b7354dd55a28effcab0f3b19639fe24d3f58b
        with:
          images: |
            name=ghcr.io/${{ github.repository }}/openfold3-docker
            name=openfoldconsortium/openfold3,enable=${{ github.repository == 'aqlaboratory/openfold-3' }}
          tags: |
            type=raw,value=${{ inputs.version }}-pixi,enable=${{ github.event_name == 'workflow_dispatch' }}
            type=raw,value=${{ inputs.additional_tags }}-pixi,enable=${{ inputs.additional_tags != '' && github.event_name == 'workflow_dispatch' }}
            type=semver,pattern={{major}}.{{minor}}-pixi

      - name: Build and push pixi image
        id: push-pixi
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
        with:
          context: .
          file: docker/Dockerfile.pixi
          target: devel
          push: true
          tags: ${{ steps.meta-pixi.outputs.tags }}
          labels: ${{ steps.meta-pixi.outputs.labels }}

      - name: Generate artifact attestation (pixi)
        if: github.repository == 'aqlaboratory/openfold-3'
        uses: actions/attest-build-provenance@v4
        with:
          subject-name: index.docker.io/openfoldconsortium/openfold3
          subject-digest: ${{ steps.push-pixi.outputs.digest }}
          push-to-registry: true

  stop-aws-runner:
    runs-on: ubuntu-latest
    permissions:
        id-token: write
        contents: read
    needs:
      - start-aws-runner
      - push-to-registry
    if: ${{ always() }}
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::203627415330:role/of-gha-runner
          aws-region: us-east-1
      - name: Stop instances
        uses: omsf/stop-aws-gha-runner@v1.0.0
        with:
          instance_mapping: ${{ needs.start-aws-runner.outputs.mapping }}
        env:
          GH_PAT: ${{ secrets.GH_PAT }}