concrete/.github/workflows/compiler_publish_docker_images.yml

# Build and publish Docker images for different applications using AWS EC2.
name: Compiler - Docker images build & publish

on:
  workflow_dispatch:
    inputs:
      instance_id:
        description: 'Instance ID'
        type: string
      instance_image_id:
        description: 'Instance AMI ID'
        type: string
      instance_type:
        description: 'Instance product type'
        type: string
      runner_name:
        description: 'Action runner name'
        type: string
      request_id:
        description: 'Slab request ID'
        type: string
      matrix_item:
        description: 'Build matrix item'
        type: string

# concurrency:
#   group: compiler_publish_docker_images-${{ github.ref }}
#   cancel-in-progress: true

env:
  THIS_FILE: .github/workflows/compiler_publish_docker_images.yml

jobs:
  BuildAndPushDockerImages:
    needs: [BuildAndPublishHPXDockerImage, BuildAndPublishCUDADockerImage]
    name: Build & Publish Docker Images
    runs-on: ${{ github.event.inputs.runner_name }}
    strategy:
      matrix:
        include:
          - name: test-env
            image: ghcr.io/zama-ai/concrete-compiler
            dockerfile: docker/Dockerfile.concrete-compiler-env

    steps:
      - name: Instance configuration used
        run: |
          echo "IDs: ${{ inputs.instance_id }}"
          echo "AMI: ${{ inputs.instance_image_id }}"
          echo "Type: ${{ inputs.instance_type }}"
          echo "Request ID: ${{ inputs.request_id }}"
      # SSH private key is required as some dependencies are from private repos
      - uses: webfactory/ssh-agent@v0.7.0
        with:
          ssh-private-key: ${{ secrets.CONCRETE_CI_SSH_PRIVATE }}

      - uses: actions/checkout@v3
        with:
          submodules: recursive
          token: ${{ secrets.CONCRETE_ACTIONS_TOKEN }}

      - name: Login to Registry
        run: echo "${{ secrets.GHCR_PASSWORD }}" | docker login -u ${{ secrets.GHCR_LOGIN }} --password-stdin ghcr.io

      # label was initially a need from the frontend CI
      - name: Build Image
        run: |
          DOCKER_BUILDKIT=1 docker build --no-cache \
            --ssh default=${{ env.SSH_AUTH_SOCK }} \
            --label "commit-sha=${{ github.sha }}" -t ${{ matrix.image }} -f ${{ matrix.dockerfile }} .

      - name: Tag and Publish Image
        run: |
          docker image tag ${{ matrix.image }} ${{ matrix.image }}:${{ github.sha }}
          docker image push ${{ matrix.image }}:latest
          docker image push ${{ matrix.image }}:${{ github.sha }}

      - name: Tag and Publish Release Image
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          docker image tag ${{ matrix.image }} ${{ matrix.image }}:${{ github.ref_name }}
          docker image push ${{ matrix.image }}:${{ github.ref_name }}

  BuildAndPublishHPXDockerImage:
    name: Build & Publish HPX Docker Image
    runs-on: ${{ github.event.inputs.runner_name }}
    env:
      IMAGE: ghcr.io/zama-ai/hpx

    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Set up env
        run: |
          echo "HOME=/home/ubuntu" >> "${GITHUB_ENV}"

      - name: Get changed files
        id: changed-files
        uses: tj-actions/changed-files@v32

      - name: Login
        id: login
        if: contains(steps.changed-files.outputs.modified_files, 'docker/Dockerfile.hpx-env') || contains(steps.changed-files.outputs.modified_files, env.THIS_FILE)
        run: echo "${{ secrets.GHCR_PASSWORD }}" | docker login -u ${{ secrets.GHCR_LOGIN }} --password-stdin ghcr.io

      - name: Build Tag and Publish
        if: ${{ steps.login.conclusion != 'skipped' }}
        run: |
          docker build -t "${IMAGE}" -f docker/Dockerfile.hpx-env .
          docker push "${IMAGE}:latest"

  BuildAndPublishCUDADockerImage:
    name: Build & Publish CUDA Docker Image
    runs-on: ${{ github.event.inputs.runner_name }}
    env:
      IMAGE: ghcr.io/zama-ai/cuda
      TAG: "11-7"

    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Set up env
        run: |
          echo "HOME=/home/ubuntu" >> "${GITHUB_ENV}"

      - name: Get changed files
        id: changed-files
        uses: tj-actions/changed-files@v32

      - name: Login
        id: login
        if: contains(steps.changed-files.outputs.modified_files, 'docker/Dockerfile.cuda-env') || contains(steps.changed-files.outputs.modified_files, env.THIS_FILE)
        run: echo "${{ secrets.GHCR_PASSWORD }}" | docker login -u ${{ secrets.GHCR_LOGIN }} --password-stdin ghcr.io

      - name: Build Tag and Publish
        if: ${{ steps.login.conclusion != 'skipped' }}
        run: |
          docker build -t "${IMAGE}" -f docker/Dockerfile.cuda-env .
          docker image tag "${IMAGE}" "${IMAGE}:${TAG}"
          docker push "${IMAGE}:latest"
          docker push "${IMAGE}:${TAG}"