docs: eval image contract, and refresh the stale pins #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: publish-eval-image | |
| # Publishes ghcr.io/cortexlm/relearn-eval and prints the pushed sha256 digest. | |
| # That digest is what the control plane pins in `config/relearn-pin.toml` as | |
| # `eval_image_digest`; a tag is never the pin. | |
| # | |
| # Two images per build, from the same Dockerfile: | |
| # | |
| # :<sha> the scoring image — torch / transformers runtime. Pin this. | |
| # :<sha>-contract contract only, no CUDA wheels. Fast, and cannot score. | |
| # | |
| # The contract image publishes first and independently, so a runtime build that | |
| # runs out of runner disk cannot take the whole publish down with it. | |
| on: | |
| push: | |
| branches: ["main", "cursor/**"] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| packages: write | |
| concurrency: | |
| group: publish-${{ github.ref }} | |
| cancel-in-progress: false | |
| env: | |
| IMAGE: ghcr.io/${{ github.repository_owner }}/relearn-eval | |
| jobs: | |
| contract: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| digest: ${{ steps.push.outputs.digest }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-buildx-action@v3 | |
| - uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: build and push the contract image | |
| id: push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: eval/Dockerfile | |
| push: true | |
| provenance: false | |
| tags: | | |
| ${{ env.IMAGE }}:${{ github.sha }}-contract | |
| build-args: | | |
| WITH_RUNTIME=0 | |
| RELEARN_GIT_SHA=${{ github.sha }} | |
| cache-from: type=gha,scope=contract | |
| cache-to: type=gha,mode=max,scope=contract | |
| - name: report | |
| run: | | |
| { | |
| echo "### relearn-eval (contract only)" | |
| echo | |
| echo '```' | |
| echo "image = \"${IMAGE}\"" | |
| echo "digest = \"${{ steps.push.outputs.digest }}\"" | |
| echo '```' | |
| echo | |
| echo "Contract layer only: no model runtime, so it refuses to score." | |
| } >> "${GITHUB_STEP_SUMMARY}" | |
| runtime: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| digest: ${{ steps.push.outputs.digest }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: free disk for the runtime wheels | |
| run: | | |
| sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc \ | |
| /opt/hostedtoolcache/CodeQL /usr/local/share/boost || true | |
| df -h / | |
| - uses: docker/setup-buildx-action@v3 | |
| - uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: build and push the scoring image | |
| id: push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: eval/Dockerfile | |
| push: true | |
| provenance: false | |
| tags: | | |
| ${{ env.IMAGE }}:${{ github.sha }} | |
| build-args: | | |
| WITH_RUNTIME=1 | |
| RELEARN_GIT_SHA=${{ github.sha }} | |
| cache-from: type=gha,scope=runtime | |
| cache-to: type=gha,mode=max,scope=runtime | |
| - name: report the digest to pin | |
| run: | | |
| digest='${{ steps.push.outputs.digest }}' | |
| case "${digest}" in | |
| sha256:*) ;; | |
| *) echo "no sha256 digest was published"; exit 1 ;; | |
| esac | |
| { | |
| echo "### relearn-eval (scoring image)" | |
| echo | |
| echo "Paste into the control plane's \`config/relearn-pin.toml\`:" | |
| echo | |
| echo '```toml' | |
| echo "eval_image = \"${IMAGE}\"" | |
| echo "eval_image_digest = \"${digest}\"" | |
| echo "relearn_git_sha = \"${GITHUB_SHA}\"" | |
| echo '```' | |
| } >> "${GITHUB_STEP_SUMMARY}" | |
| echo "eval_image_digest = \"${digest}\"" |