Merge pull request #33 from chekdata/codex/responses-agent-message-re… #32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Internal Image | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.sha }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| packages: write | |
| jobs: | |
| publish: | |
| name: Build and publish CHEK image | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c | |
| - name: Log in to GHCR | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Refuse to overwrite immutable tag | |
| env: | |
| IMAGE_REF: ghcr.io/${{ github.repository }}:sha-${{ github.sha }} | |
| run: | | |
| if docker buildx imagetools inspect "${IMAGE_REF}" >/dev/null 2>inspect-error.log; then | |
| echo "::error::Immutable image tag already exists: ${IMAGE_REF}" | |
| exit 1 | |
| fi | |
| if ! grep -Eiq 'manifest unknown|name unknown|not found' inspect-error.log; then | |
| cat inspect-error.log >&2 | |
| echo "::error::Unable to prove immutable image tag is absent" | |
| exit 1 | |
| fi | |
| - name: Extract image metadata | |
| id: meta | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 | |
| with: | |
| images: ghcr.io/${{ github.repository }} | |
| tags: | | |
| type=sha,prefix=sha-,format=long | |
| - name: Build and push image | |
| id: build | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a | |
| with: | |
| context: . | |
| file: Dockerfile | |
| push: true | |
| platforms: linux/amd64,linux/arm64 | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha,scope=codex-lb-internal | |
| cache-to: type=gha,mode=max,scope=codex-lb-internal | |
| - name: Verify immutable image receipt | |
| id: receipt | |
| env: | |
| IMAGE_REF: ghcr.io/${{ github.repository }}:sha-${{ github.sha }} | |
| EXPECTED_DIGEST: ${{ steps.build.outputs.digest }} | |
| run: | | |
| set -euo pipefail | |
| [[ "${EXPECTED_DIGEST}" =~ ^sha256:[0-9a-f]{64}$ ]] | |
| manifest=$(docker buildx imagetools inspect "${IMAGE_REF}") | |
| actual_digest=$(awk '$1 == "Digest:" {print $2; exit}' <<<"${manifest}") | |
| [[ "${actual_digest}" == "${EXPECTED_DIGEST}" ]] | |
| grep -q 'Platform:[[:space:]]*linux/amd64' <<<"${manifest}" | |
| grep -q 'Platform:[[:space:]]*linux/arm64' <<<"${manifest}" | |
| receipt_path="${RUNNER_TEMP}/codex-lb-image-receipt.json" | |
| python3 - "${receipt_path}" <<'PY' | |
| import json | |
| import os | |
| import sys | |
| with open(sys.argv[1], "w", encoding="utf-8") as handle: | |
| json.dump( | |
| { | |
| "schema": "qk_codex_lb_internal_image_receipt_v1", | |
| "repository": os.environ["GITHUB_REPOSITORY"], | |
| "source_sha": os.environ["GITHUB_SHA"], | |
| "image_ref": os.environ["IMAGE_REF"], | |
| "digest": os.environ["EXPECTED_DIGEST"], | |
| "platforms": ["linux/amd64", "linux/arm64"], | |
| }, | |
| handle, | |
| separators=(",", ":"), | |
| sort_keys=True, | |
| ) | |
| handle.write("\n") | |
| PY | |
| receipt_sha256=$(shasum -a 256 "${receipt_path}" | awk '{print $1}') | |
| { | |
| echo "source_digest=${actual_digest}" | |
| echo "receipt_path=${receipt_path}" | |
| echo "receipt_sha256=${receipt_sha256}" | |
| } >> "${GITHUB_OUTPUT}" | |
| - name: Upload immutable image receipt | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 | |
| with: | |
| name: codex-lb-image-receipt-${{ github.sha }} | |
| path: ${{ steps.receipt.outputs.receipt_path }} | |
| if-no-files-found: error | |
| retention-days: 30 | |
| - name: Dispatch exact image to ops-bootstrap | |
| uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 | |
| with: | |
| token: ${{ secrets.GH_PAT }} | |
| repository: chekdata/ops-bootstrap | |
| event-type: codex-lb-image-published | |
| client-payload: >- | |
| {"source_sha":"${{ github.sha }}","source_digest":"${{ steps.build.outputs.digest }}","receipt_sha256":"${{ steps.receipt.outputs.receipt_sha256 }}"} |