deploy-runner.yml

# SPDX-License-Identifier: MIT
name: Build and Deploy Runner

on:
  push:
    branches:
      - main
    paths:
      - 'runner/**'
      - '.github/workflows/deploy-runner.yml'
  pull_request:
    branches:
      - main
    paths:
      - 'runner/**'
      - '.github/workflows/deploy-runner.yml'
  schedule:
    - cron: '0 6 * * 2'
  workflow_dispatch:

permissions:
  contents: write
  packages: write

env:
  KUBERNETES_VERSION: v1.35.9

jobs:
  setup:
    runs-on: ubuntu-latest
    outputs:
      push-images: ${{ steps.variables.outputs.push-images }}
    steps:
      - name: Setup variables
        id: variables
        run: |
          set -eux -o pipefail

          # Whether we want to push the images or just make sure they build
          echo "push-images=${{ github.event_name != 'pull_request' || github.repository == github.event.pull_request.head.repo.full_name }}" >> $GITHUB_OUTPUT

  build-images:
    strategy:
      matrix:
        include:
        - os: ubuntu
          os-version: "24.04"
        - os: ubuntu
          os-version: "26.04"
      fail-fast: false
    runs-on: ubuntu-latest
    needs: [setup]
    permissions:
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Login to Container Registry
        if: ${{ needs.setup.outputs.push-images == 'true' }}
        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Setup QEMU
        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # 4.4.0

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
        with:
          buildkitd-config-inline: |
            [worker.oci]
              max-parallelism = 2

      - name: Extract metadata for Docker
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0

      - name: Build ${{ matrix.os }}-${{ matrix.os-version }} runner image
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        env:
          SOURCE_DATE_EPOCH: 0 # No timestamps in layers
        with:
          context: runner/images
          file: runner/images/Dockerfile.${{ matrix.os }}
          platforms: linux/riscv64
          build-args: |
            OS_VERSION=${{ matrix.os-version }}
          tags: |
            ghcr.io/${{ github.repository }}/runner/${{ matrix.os }}-${{ matrix.os-version }}:sha-${{ github.sha }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: |
            ${{ format('type=registry,ref=ghcr.io/{0}/runner/{1}-{2}:buildcache', github.repository, matrix.os, matrix.os-version) }}
          cache-to: |
            ${{ github.ref_name == github.event.repository.default_branch && format('type=registry,ref=ghcr.io/{0}/runner/{1}-{2}:buildcache,mode=max', github.repository, matrix.os, matrix.os-version) || '' }}
          push: ${{ needs.setup.outputs.push-images == 'true' }}
          pull: ${{ github.ref_name == github.event.repository.default_branch }}

  build-kube-proxy:
    runs-on: ubuntu-latest
    needs: [setup]
    permissions:
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Login to Container Registry
        if: ${{ needs.setup.outputs.push-images == 'true' }}
        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Setup QEMU
        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # 4.4.0

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Extract metadata for Docker
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0

      - name: Build kube-proxy image
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        env:
          SOURCE_DATE_EPOCH: 0
        with:
          context: runner/images
          file: runner/images/Dockerfile.kube-proxy
          platforms: linux/amd64,linux/arm64,linux/riscv64
          build-args: |
            KUBERNETES_VERSION=${{ env.KUBERNETES_VERSION }}
          tags: ghcr.io/${{ github.repository }}/kube-proxy:${{ env.KUBERNETES_VERSION }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: |
            ${{ format('type=registry,ref=ghcr.io/{0}/kube-proxy:buildcache', github.repository) }}
          cache-to: |
            ${{ github.ref_name == github.event.repository.default_branch && format('type=registry,ref=ghcr.io/{0}/kube-proxy:buildcache,mode=max', github.repository) || '' }}
          push: ${{ needs.setup.outputs.push-images == 'true' }}
          pull: ${{ github.ref_name == github.event.repository.default_branch }}

  build-pause:
    runs-on: ubuntu-latest
    needs: [setup]
    permissions:
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Login to Container Registry
        if: ${{ needs.setup.outputs.push-images == 'true' }}
        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Setup QEMU
        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # 4.4.0

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Extract metadata for Docker
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0

      - name: Build pause image
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        env:
          SOURCE_DATE_EPOCH: 0
        with:
          context: runner/images
          file: runner/images/Dockerfile.pause
          platforms: linux/amd64,linux/arm64,linux/riscv64
          build-args: |
            KUBERNETES_VERSION=${{ env.KUBERNETES_VERSION }}
          tags: ghcr.io/${{ github.repository }}/pause:3.10
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: |
            ${{ format('type=registry,ref=ghcr.io/{0}/pause:buildcache', github.repository) }}
          cache-to: |
            ${{ github.ref_name == github.event.repository.default_branch && format('type=registry,ref=ghcr.io/{0}/pause:buildcache,mode=max', github.repository) || '' }}
          push: ${{ needs.setup.outputs.push-images == 'true' }}
          pull: ${{ github.ref_name == github.event.repository.default_branch }}

  test-device-plugin:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: runner/device-plugin
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: runner/device-plugin/go.mod
          cache-dependency-path: runner/device-plugin/go.sum

      - name: go vet
        run: go vet ./...
      - name: gofmt check
        run: |
          out=$(gofmt -l .)
          if [ -n "$out" ]; then
            echo "::error::gofmt diff:"
            echo "$out"
            exit 1
          fi
      - name: go test
        run: go test -race ./...

  build-device-plugin:
    runs-on: ubuntu-latest
    needs: [setup, test-device-plugin]
    permissions:
      packages: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup QEMU
        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Login to Container Registry
        if: ${{ needs.setup.outputs.push-images == 'true' }}
        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Extract metadata for Docker
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0

      - name: Build device-plugin image
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          platforms: linux/riscv64
          context: runner/device-plugin
          file: runner/device-plugin/Dockerfile
          tags: |
            ghcr.io/${{ github.repository }}/device-plugin:sha-${{ github.sha }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: |
            ${{ format('type=registry,ref=ghcr.io/{0}/device-plugin:buildcache', github.repository) }}
          cache-to: |
            ${{ github.ref_name == github.event.repository.default_branch && format('type=registry,ref=ghcr.io/{0}/device-plugin:buildcache', github.repository) || '' }}
          push: ${{ needs.setup.outputs.push-images == 'true' }}
          pull: ${{ github.ref_name == github.event.repository.default_branch }}

  deploy-staging:
    if: github.repository_owner == 'riseproject-dev' && github.ref_name == github.event.repository.default_branch
    name: "deploy to staging"
    needs: [setup, build-images, build-kube-proxy, build-pause, build-device-plugin]
    runs-on: ubuntu-latest
    environment: staging
    concurrency:
      group: ${{ github.workflow_ref }}-deploy-staging
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Login to Container Registry
        if: ${{ needs.setup.outputs.push-images == 'true' }}
        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Tag ubuntu-24.04 image for staging
        run: >-
          docker buildx imagetools create \
            -t ghcr.io/${{ github.repository }}/runner/ubuntu-24.04:staging \
            ghcr.io/${{ github.repository }}/runner/ubuntu-24.04:sha-${{ github.sha }}

      - name: Tag ubuntu-26.04 image for staging
        run: >-
          docker buildx imagetools create \
            -t ghcr.io/${{ github.repository }}/runner/ubuntu-26.04:staging \
            ghcr.io/${{ github.repository }}/runner/ubuntu-26.04:sha-${{ github.sha }}

      - name: Tag device-plugin image for staging
        run: >-
          docker buildx imagetools create \
            -t ghcr.io/${{ github.repository }}/device-plugin:staging \
            ghcr.io/${{ github.repository }}/device-plugin:sha-${{ github.sha }}

      - name: Set up kubeconfig
        run: |
          mkdir -p ~/.kube
          echo "${{ secrets.K8S_KUBECONFIG_GH_DEPLOY }}" > ~/.kube/config
          chmod 600 ~/.kube/config

      - name: Apply device-plugin DaemonSet
        env:
          TAG: staging
        run: |
          envsubst < runner/device-plugin/k8s-ds-device-plugin.yaml | kubectl apply -f -
          kubectl rollout restart daemonset/rise-riscv-runner-device-plugin -n kube-system

      - name: Rollout Restart
        run: |
          while ! kubectl rollout status daemonset/rise-riscv-runner-device-plugin -n kube-system --timeout=5m 2>/dev/null; do
            kubectl get pods -o wide -n kube-system \
              -l app.kubernetes.io/name=riscv-runner-device-plugin \
              -l app.kubernetes.io/component=device-plugin \
              -L riseproject.dev/provider -L riseproject.dev/board \
              --sort-by=.spec.nodeName 2>/dev/null
          done

      - name: Trigger sample workflow
        env:
          GH_TOKEN: ${{ secrets.RISCV_RUNNER_SAMPLE_STAGING_ACCESS_TOKEN }}
          GH_REPO: riseproject-staging/riscv-runner-sample
          GH_WORKFLOW: hello.yml
        run: |
          gh workflow run ${GH_WORKFLOW} --repo ${GH_REPO}
          sleep 5
          gh run watch $(gh run list --repo ${GH_REPO} --workflow ${GH_WORKFLOW} --limit 1 --json databaseId --jq '.[0].databaseId') --repo ${GH_REPO} --interval 15 --exit-status

  deploy-prod:
    if: github.repository_owner == 'riseproject-dev' && github.ref_name == github.event.repository.default_branch
    name: "deploy to prod"
    needs: [setup, build-images, build-kube-proxy, build-pause, build-device-plugin]
    runs-on: ubuntu-latest
    environment: prod
    concurrency:
      group: ${{ github.workflow_ref }}-deploy-prod
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Login to Container Registry
        if: ${{ needs.setup.outputs.push-images == 'true' }}
        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Tag ubuntu-24.04 image for prod
        run: >-
          docker buildx imagetools create \
            -t ghcr.io/${{ github.repository }}/runner/ubuntu-24.04:prod \
            ghcr.io/${{ github.repository }}/runner/ubuntu-24.04:sha-${{ github.sha }}

      - name: Tag ubuntu-26.04 image for prod
        run: >-
          docker buildx imagetools create \
            -t ghcr.io/${{ github.repository }}/runner/ubuntu-26.04:prod \
            ghcr.io/${{ github.repository }}/runner/ubuntu-26.04:sha-${{ github.sha }}

      - name: Tag device-plugin image for prod
        run: >-
          docker buildx imagetools create \
            -t ghcr.io/${{ github.repository }}/device-plugin:prod \
            ghcr.io/${{ github.repository }}/device-plugin:sha-${{ github.sha }}

      - name: Set up kubeconfig
        run: |
          mkdir -p ~/.kube
          echo "${{ secrets.K8S_KUBECONFIG_GH_DEPLOY }}" > ~/.kube/config
          chmod 600 ~/.kube/config

      - name: Apply device-plugin DaemonSet
        env:
          TAG: prod
        run: |
          envsubst < runner/device-plugin/k8s-ds-device-plugin.yaml | kubectl apply -f -
          kubectl rollout restart daemonset/rise-riscv-runner-device-plugin -n kube-system

      - name: Rollout Restart
        run: |
          while ! kubectl rollout status daemonset/rise-riscv-runner-device-plugin -n kube-system --timeout=5m 2>/dev/null; do
            kubectl get pods -o wide -n kube-system \
              -l app.kubernetes.io/name=riscv-runner-device-plugin \
              -l app.kubernetes.io/component=device-plugin \
              -L riseproject.dev/provider -L riseproject.dev/board \
              --sort-by=.spec.nodeName 2>/dev/null
          done

      - name: Trigger sample workflow
        env:
          GH_TOKEN: ${{ secrets.RISCV_RUNNER_SAMPLE_ACCESS_TOKEN }}
          GH_REPO: riseproject-dev/riscv-runner-sample
          GH_WORKFLOW: hello.yml
        run: |
          gh workflow run ${GH_WORKFLOW} --repo ${GH_REPO}
          sleep 5
          gh run watch $(gh run list --repo ${GH_REPO} --workflow ${GH_WORKFLOW} --limit 1 --json databaseId --jq '.[0].databaseId') --repo ${GH_REPO} --interval 15 --exit-status