subtensor/.github/workflows/check-docker.yml at main · RaoFoundation/subtensor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
name: Docker Build Check

# Path-filtered: `docker build` is not a required merge check, so a
# workflow-level `paths:` filter is safe. If it is ever made required, this
# filter MUST move to job-level `if:` gating (a required check whose workflow
# never triggers is stuck "Expected" and blocks the merge).
on:
  pull_request:
    paths:
      # Anything the Dockerfile's cargo build consumes.
      - "common/**"
      - "node/**"
      - "pallets/**"
      - "precompiles/**"
      - "primitives/**"
      - "runtime/**"
      - "support/**"
      - "chain-extensions/**"
      - "src/**"
      - "vendor/**"
      # The bittensor-core SDK crates are not in node-subtensor's dependency
      # graph. Their shared dependency movement still enters through Cargo.lock.
      - "Cargo.toml"
      - "Cargo.lock"
      - "build.rs"
      - "rust-toolchain.toml"
      - ".cargo/**"
      - ".dockerignore"
      - "*.json"
      - "chainspecs/**"
      - "scripts/docker_entrypoint.sh"
      - "Dockerfile"
      - "Dockerfile.prebuilt"
      - "Cross.toml"
      - ".github/actions/build-production-binary/**"
      - ".github/actions/rust-setup/**"
      - ".github/actions/sccache-setup/**"
      - ".github/scripts/rust-setup-preflight.sh"
      - ".github/scripts/install-rust-toolchain.sh"
      - ".github/scripts/sccache-configure.sh"
      - ".github/scripts/sccache-config.py"
      - ".github/scripts/sccache-report.sh"
      - ".github/workflows/check-docker.yml"
      # These modules are compiled only by Rust tests. Check Rust owns them;
      # they cannot change the production binary copied into the image.
      - "!pallets/*/src/tests/**"
      - "!pallets/*/src/tests.rs"
      - "!pallets/*/src/mock.rs"
      - "!chain-extensions/src/tests.rs"
      - "!chain-extensions/src/mock.rs"
      - "!precompiles/src/mock.rs"
      - "!node/tests/**"
      - "!runtime/tests/**"
      - "!support/*/tests/**"
      - "!support/procedural-fork/src/pallet/parse/tests/**"

concurrency:
  group: check-docker-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  image:
    name: production binary + docker image (amd64, no push)
    # Job-level gating is evaluated before a self-hosted runner is assigned.
    # Keep untrusted fork code off persistent organization infrastructure
    # without serializing the production build behind a hosted guard job.
    if: github.event.pull_request.head.repo.fork == false
    runs-on: [self-hosted, fireactions-turbo-16]
    environment:
      name: sccache-writer
      deployment: false
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@v4

      - uses: ./.github/actions/build-production-binary
        with:
          arch: amd64
          target: x86_64-unknown-linux-gnu
          cache-key: docker-production-amd64
          sccache-credential-mode: auto
          sccache-writer-access-key-id: ${{ secrets.SCCACHE_R2_WRITE_ACCESS_KEY_ID }}
          sccache-writer-secret-access-key: ${{ secrets.SCCACHE_R2_WRITE_SECRET_ACCESS_KEY }}

      - name: Build Docker image without publishing
        # Buildx is part of the pinned Fireactions image contract. Using its
        # default local Docker builder avoids a second runner plus artifact
        # handoff and does not need a per-job builder installation.
        run: |
          docker buildx version
          docker buildx build \
            --file Dockerfile.prebuilt \
            --platform linux/amd64 \
            --tag subtensor-ci:amd64 \
            --load \
            .

      - name: Verify image architecture and executable
        shell: bash
        run: |
          set -euo pipefail
          actual=$(docker image inspect subtensor-ci:amd64 --format '{{.Architecture}}')
          test "$actual" = amd64
          docker run --rm --platform linux/amd64 subtensor-ci:amd64 --help > /dev/null