Fix docker image tag (#274)

.github/workflows/test-zkvm.yml

@@ -18,12 +18,47 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
-  build_image:
-    name: Build image
+  create_semver_image_tag:
+    name: Tag image with SemVer
+    if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
+    steps:
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Add SemVer tag to images
+        run: |
+          GIT_SHA="${{ github.sha }}"
+          GIT_SHA_TAG="${GIT_SHA:0:7}"
+
+          GIT_TAG="${{ github.ref_name }}"
+          SEMVER_TAG="${GIT_TAG#v}"
+
+          IMAGE_REGISTRY="ghcr.io/${{ github.repository }}"
+
+          for IMAGE in \
+            "ere-base" \
+            "ere-base-${{ inputs.zkvm }}" \
+            "ere-compiler-${{ inputs.zkvm }}" \
+            "ere-server-${{ inputs.zkvm }}"
+          do
+            echo "Tagging $IMAGE_REGISTRY/$IMAGE:$GIT_SHA_TAG as $SEMVER_TAG"
+            docker buildx imagetools create \
+              "$IMAGE_REGISTRY/$IMAGE:$GIT_SHA_TAG" \
+              --tag "$IMAGE_REGISTRY/$IMAGE:$SEMVER_TAG"
+          done
+
+  image_meta:
+    name: Get image metadata
+    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/master')
+    runs-on: ubuntu-latest
     outputs:
       image_registry: ${{ steps.image_meta.outputs.image_registry }}
       image_tag: ${{ steps.image_meta.outputs.image_tag }}
@@ -36,16 +71,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Free up disk space
-        run: bash .github/scripts/free-up-disk-space.sh
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Check Dockerfile changes
         id: changed_files
         uses: tj-actions/changed-files@v46
@@ -57,14 +82,8 @@ jobs:
       - name: Get image metadata
         id: image_meta
         run: |
-          TAG="${{ github.ref_name }}"
-          SHA="${{ github.sha }}"
-
-          if [ "${{ github.ref_type }}" == "tag" ]; then
-            IMAGE_TAG="${TAG#v}"
-          else
-            IMAGE_TAG="${SHA:0:7}"
-          fi
+          GIT_SHA="${{ github.sha }}"
+          IMAGE_TAG="${GIT_SHA:0:7}"
 
           CACHED_IMAGE_TAG=""
           if [ "${{ github.event_name }}" == "pull_request" ] && [ "${{ steps.changed_files.outputs.any_changed }}" == "false" ]; then
@@ -86,40 +105,59 @@ jobs:
           echo "compiler_zkvm_image=$COMPILER_ZKVM_IMAGE" >> $GITHUB_OUTPUT
           echo "server_zkvm_image=$SERVER_ZKVM_IMAGE" >> $GITHUB_OUTPUT
 
+  build_image:
+    name: Build image
+    needs: image_meta
+    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Free up disk space
+        run: bash .github/scripts/free-up-disk-space.sh
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Build and push ere-base and ere-base-${{ inputs.zkvm }} images
-        if: github.event_name == 'push'
         run: |
           bash .github/scripts/build-image.sh \
             --zkvm ${{ inputs.zkvm }} \
-            --registry ${{ steps.image_meta.outputs.image_registry }} \
-            --tag ${{ steps.image_meta.outputs.image_tag }} \
+            --registry ${{ needs.image_meta.outputs.image_registry }} \
+            --tag ${{ needs.image_meta.outputs.image_tag }} \
             --base
-          docker push ${{ steps.image_meta.outputs.base_image }}
-          docker push ${{ steps.image_meta.outputs.base_zkvm_image }}
+          docker push ${{ needs.image_meta.outputs.base_image }}
+          docker push ${{ needs.image_meta.outputs.base_zkvm_image }}
 
       - name: Build and push ere-compiler-${{ inputs.zkvm }} image
-        if: github.event_name == 'push'
         run: |
           bash .github/scripts/build-image.sh \
             --zkvm ${{ inputs.zkvm }} \
-            --registry ${{ steps.image_meta.outputs.image_registry }} \
-            --tag ${{ steps.image_meta.outputs.image_tag }} \
+            --registry ${{ needs.image_meta.outputs.image_registry }} \
+            --tag ${{ needs.image_meta.outputs.image_tag }} \
             --compiler
-          docker push ${{ steps.image_meta.outputs.compiler_zkvm_image }}
+          docker push ${{ needs.image_meta.outputs.compiler_zkvm_image }}
 
       - name: Build and push ere-server-${{ inputs.zkvm }} image
-        if: github.event_name == 'push'
         run: |
           bash .github/scripts/build-image.sh \
             --zkvm ${{ inputs.zkvm }} \
-            --registry ${{ steps.image_meta.outputs.image_registry }} \
-            --tag ${{ steps.image_meta.outputs.image_tag }} \
+            --registry ${{ needs.image_meta.outputs.image_registry }} \
+            --tag ${{ needs.image_meta.outputs.image_tag }} \
             --server
-          docker push ${{ steps.image_meta.outputs.server_zkvm_image }}
+          docker push ${{ needs.image_meta.outputs.server_zkvm_image }}
 
   clippy_via_docker:
     name: Clippy via Docker
-    needs: build_image
+    needs: image_meta
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -138,13 +176,13 @@ jobs:
         run: |
           bash .github/scripts/pull-or-build-base-zkvm-image.sh \
             --zkvm ${{ inputs.zkvm }} \
-            --registry ${{ needs.build_image.outputs.image_registry }} \
-            --tag ${{ needs.build_image.outputs.image_tag }} \
-            --cached-tag "${{ needs.build_image.outputs.cached_image_tag }}"
+            --registry ${{ needs.image_meta.outputs.image_registry }} \
+            --tag ${{ needs.image_meta.outputs.image_tag }} \
+            --cached-tag "${{ needs.image_meta.outputs.cached_image_tag }}"
 
       - name: Pull base zkvm image
         if: github.event_name == 'push'
-        run: docker pull ${{ needs.build_image.outputs.base_zkvm_image }}
+        run: docker pull ${{ needs.image_meta.outputs.base_zkvm_image }}
 
       - name: Run cargo clippy for ere-${{ inputs.zkvm }} via Docker
         run: |
@@ -155,7 +193,7 @@ jobs:
             --volume $HOME/.cargo/registry:/usr/local/cargo/registry \
             --volume $HOME/.cargo/git:/usr/local/cargo/git \
             --workdir /ere \
-            ${{ needs.build_image.outputs.base_zkvm_image }} \
+            ${{ needs.image_meta.outputs.base_zkvm_image }} \
             /bin/bash"
 
           cat <<EOF | $DOCKER_CMD
@@ -173,7 +211,7 @@ jobs:
 
   test_via_docker:
     name: Test via Docker
-    needs: build_image
+    needs: image_meta
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -192,13 +230,13 @@ jobs:
         run: |
           bash .github/scripts/pull-or-build-base-zkvm-image.sh \
             --zkvm ${{ inputs.zkvm }} \
-            --registry ${{ needs.build_image.outputs.image_registry }} \
-            --tag ${{ needs.build_image.outputs.image_tag }} \
-            --cached-tag "${{ needs.build_image.outputs.cached_image_tag }}"
+            --registry ${{ needs.image_meta.outputs.image_registry }} \
+            --tag ${{ needs.image_meta.outputs.image_tag }} \
+            --cached-tag "${{ needs.image_meta.outputs.cached_image_tag }}"
 
       - name: Pull base zkvm image
         if: github.event_name == 'push'
-        run: docker pull ${{ needs.build_image.outputs.base_zkvm_image }}
+        run: docker pull ${{ needs.image_meta.outputs.base_zkvm_image }}
 
       - name: Run cargo test for ere-${{ inputs.zkvm }} via Docker
         run: |
@@ -209,7 +247,7 @@ jobs:
             --volume $HOME/.cargo/registry:/usr/local/cargo/registry \
             --volume $HOME/.cargo/git:/usr/local/cargo/git \
             --workdir /ere \
-            ${{ needs.build_image.outputs.base_zkvm_image }} \
+            ${{ needs.image_meta.outputs.base_zkvm_image }} \
             /bin/bash"
 
           cat <<EOF | $DOCKER_CMD
@@ -225,7 +263,7 @@ jobs:
 
   test_ere_dockerized:
     name: Test ere-dockerized with the selected zkVM
-    needs: build_image
+    needs: image_meta
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -249,27 +287,27 @@ jobs:
         run: |
           bash .github/scripts/pull-or-build-base-zkvm-image.sh \
             --zkvm ${{ inputs.zkvm }} \
-            --registry ${{ needs.build_image.outputs.image_registry }} \
-            --tag ${{ needs.build_image.outputs.image_tag }} \
-            --cached-tag "${{ needs.build_image.outputs.cached_image_tag }}"
+            --registry ${{ needs.image_meta.outputs.image_registry }} \
+            --tag ${{ needs.image_meta.outputs.image_tag }} \
+            --cached-tag "${{ needs.image_meta.outputs.cached_image_tag }}"
 
           # Build ere-compiler-${{ inputs.zkvm }} and ere-server-${{ inputs.zkvm }}
           bash .github/scripts/build-image.sh \
             --zkvm ${{ inputs.zkvm }} \
-            --registry ${{ needs.build_image.outputs.image_registry }} \
-            --tag ${{ needs.build_image.outputs.image_tag }} \
+            --registry ${{ needs.image_meta.outputs.image_registry }} \
+            --tag ${{ needs.image_meta.outputs.image_tag }} \
             --compiler \
             --server
 
       - name: Pull ere-compiler-${{ inputs.zkvm }} and ere-server-${{ inputs.zkvm }} images
         if: github.event_name == 'push'
         run: |
-          docker pull ${{ needs.build_image.outputs.compiler_zkvm_image }}
-          docker pull ${{ needs.build_image.outputs.server_zkvm_image }}
+          docker pull ${{ needs.image_meta.outputs.compiler_zkvm_image }}
+          docker pull ${{ needs.image_meta.outputs.server_zkvm_image }}
 
       - name: Run cargo test for ere-${{ inputs.zkvm }} via ere-dockerized
         env:
-          ERE_IMAGE_REGISTRY: ${{ needs.build_image.outputs.image_registry }}
+          ERE_IMAGE_REGISTRY: ${{ needs.image_meta.outputs.image_registry }}
         run: |
           cargo test --release --package ere-dockerized \
             -- ${{ inputs.zkvm }} ${{ inputs.skip_prove_test && '--skip prove' || ''  }} --test-threads=1

crates/build-utils/src/lib.rs

@@ -2,23 +2,38 @@
 
 use cargo_metadata::MetadataCommand;
 use std::{
-    env, fs, io,
+    env, fs,
     path::{Path, PathBuf},
 };
 
-/// Returns path of `Cargo.lock` from the `CARGO_MANIFEST_DIR` of caller, which
-/// is `depth` far from the workspace.
-pub fn cargo_lock_path(depth: usize) -> io::Result<PathBuf> {
-    let mut manifest_dir = PathBuf::from(env::var("CARGO_MANIFEST_DIR").unwrap());
-    for _ in 0..depth {
-        manifest_dir.pop();
+/// Returns path to the closest workspace that contains `Cargo.lock` from `CARGO_MANIFEST_DIR`,
+/// returns `None` if not found.
+pub fn workspace() -> Option<PathBuf> {
+    let mut dir = PathBuf::from(env::var("CARGO_MANIFEST_DIR").unwrap())
+        .canonicalize()
+        .ok()?;
+    loop {
+        if dir.join("Cargo.lock").exists() {
+            return Some(dir);
+        }
+        if !dir.pop() {
+            return None;
+        }
     }
-    manifest_dir.join("Cargo.lock").canonicalize()
+}
+
+/// Returns path to the closest `Cargo.lock` from `CARGO_MANIFEST_DIR`, returns `None` if not found.
+pub fn cargo_lock_path() -> Option<PathBuf> {
+    workspace().map(|workspace| workspace.join("Cargo.lock"))
 }
 
 // Detect and generate a Rust source file that contains the name and version of the SDK.
 pub fn detect_and_generate_name_and_sdk_version(name: &str, sdk_dep_name: &str) {
     gen_name_and_sdk_version(name, &detect_sdk_version(sdk_dep_name));
+
+    if let Some(cargo_lock) = cargo_lock_path() {
+        println!("cargo:rerun-if-changed={}", cargo_lock.display());
+    }
 }
 
 // Detect version of the SDK.
@@ -47,31 +62,13 @@ pub fn gen_name_and_sdk_version(name: &str, version: &str) {
     .unwrap();
 }
 
-/// Generate tag for Docker image.
+/// Returns tag for Docker image.
 ///
 /// Returns:
-/// - Git tag in SemVer if current commit has a tag (e.g., `v0.1.0` -> `0.1.0`)
-/// - Short git revision (7 digits) if no tag found
+/// - Short git revision (7 digits)
 /// - Crate version from Cargo.toml as fallback if git is not available
 pub fn get_docker_image_tag() -> String {
-    // Try to get a tag pointing to the current commit
-    let tag_output = std::process::Command::new("git")
-        .args(["describe", "--tags", "--exact-match", "HEAD"])
-        .output();
-
-    match tag_output {
-        Ok(output) if output.status.success() => {
-            let tag = String::from_utf8_lossy(&output.stdout).trim().to_string();
-            // Remove 'v' prefix if present
-            let semver_or_tag = tag.strip_prefix('v').unwrap_or(&tag);
-            if !semver_or_tag.is_empty() {
-                return semver_or_tag.to_string();
-            }
-        }
-        _ => {}
-    }
-
-    // No tag found, try to get short revision
+    // Get short git revision
     let rev_output = std::process::Command::new("git")
         .args(["rev-parse", "--short=7", "HEAD"])
         .output();

crates/dockerized/common/build.rs

@@ -1,8 +1,5 @@
-use ere_build_utils::{detect_sdk_version, get_docker_image_tag};
-use std::{
-    env, fs,
-    path::{Path, PathBuf},
-};
+use ere_build_utils::{cargo_lock_path, detect_sdk_version, get_docker_image_tag, workspace};
+use std::{env, fs, path::Path};
 
 fn main() {
     generate_docker_image_tag();
@@ -19,7 +16,9 @@ fn generate_docker_image_tag() {
     let dst = Path::new(&out_dir).join("docker_image_tag.rs");
     fs::write(dst, docker_image_tag).unwrap();
 
-    if let Ok(dot_git) = workspace().join(".git").canonicalize() {
+    if let Some(dot_git) =
+        workspace().and_then(|workspace| workspace.join(".git").canonicalize().ok())
+    {
         for dir in ["HEAD", "refs", "packed-refs"] {
             if dot_git.join(dir).exists() {
                 println!("cargo:rerun-if-changed={}", dot_git.join(dir).display());
@@ -77,15 +76,7 @@ fn generate_zkvm_sdk_version_impl() {
     let dst = Path::new(&out_dir).join("zkvm_sdk_version_impl.rs");
     fs::write(dst, zkvm_sdk_version_impl).unwrap();
 
-    if let Ok(cargo_lock) = workspace().join("Cargo.lock").canonicalize() {
+    if let Some(cargo_lock) = cargo_lock_path() {
         println!("cargo:rerun-if-changed={}", cargo_lock.display());
     }
 }
-
-fn workspace() -> PathBuf {
-    let mut manifest_dir = PathBuf::from(env::var("CARGO_MANIFEST_DIR").unwrap());
-    manifest_dir.pop();
-    manifest_dir.pop();
-    manifest_dir.pop();
-    manifest_dir
-}

crates/zkvm/airbender/build.rs

@@ -1,9 +1,5 @@
-use ere_build_utils::{cargo_lock_path, detect_and_generate_name_and_sdk_version};
+use ere_build_utils::detect_and_generate_name_and_sdk_version;
 
 fn main() {
     detect_and_generate_name_and_sdk_version("airbender", "execution_utils");
-
-    if let Ok(cargo_lock) = cargo_lock_path(3) {
-        println!("cargo:rerun-if-changed={}", cargo_lock.display());
-    }
 }

crates/zkvm/jolt/build.rs

@@ -1,9 +1,5 @@
-use ere_build_utils::{cargo_lock_path, detect_and_generate_name_and_sdk_version};
+use ere_build_utils::detect_and_generate_name_and_sdk_version;
 
 fn main() {
     detect_and_generate_name_and_sdk_version("jolt", "jolt-sdk");
-
-    if let Ok(cargo_lock) = cargo_lock_path(3) {
-        println!("cargo:rerun-if-changed={}", cargo_lock.display());
-    }
 }

crates/zkvm/miden/build.rs

@@ -1,9 +1,5 @@
-use ere_build_utils::{cargo_lock_path, detect_and_generate_name_and_sdk_version};
+use ere_build_utils::detect_and_generate_name_and_sdk_version;
 
 fn main() {
     detect_and_generate_name_and_sdk_version("miden", "miden-core");
-
-    if let Ok(cargo_lock) = cargo_lock_path(3) {
-        println!("cargo:rerun-if-changed={}", cargo_lock.display());
-    }
 }

crates/zkvm/nexus/build.rs

@@ -1,9 +1,5 @@
-use ere_build_utils::{cargo_lock_path, detect_and_generate_name_and_sdk_version};
+use ere_build_utils::detect_and_generate_name_and_sdk_version;
 
 fn main() {
     detect_and_generate_name_and_sdk_version("nexus", "nexus-sdk");
-
-    if let Ok(cargo_lock) = cargo_lock_path(3) {
-        println!("cargo:rerun-if-changed={}", cargo_lock.display());
-    }
 }

crates/zkvm/openvm/build.rs

@@ -1,9 +1,5 @@
-use ere_build_utils::{cargo_lock_path, detect_and_generate_name_and_sdk_version};
+use ere_build_utils::detect_and_generate_name_and_sdk_version;
 
 fn main() {
     detect_and_generate_name_and_sdk_version("openvm", "openvm-sdk");
-
-    if let Ok(cargo_lock) = cargo_lock_path(3) {
-        println!("cargo:rerun-if-changed={}", cargo_lock.display());
-    }
 }

crates/zkvm/pico/build.rs

@@ -1,9 +1,5 @@
-use ere_build_utils::{cargo_lock_path, detect_and_generate_name_and_sdk_version};
+use ere_build_utils::detect_and_generate_name_and_sdk_version;
 
 fn main() {
     detect_and_generate_name_and_sdk_version("pico", "pico-vm");
-
-    if let Ok(cargo_lock) = cargo_lock_path(3) {
-        println!("cargo:rerun-if-changed={}", cargo_lock.display());
-    }
 }

crates/zkvm/risc0/build.rs

@@ -1,9 +1,5 @@
-use ere_build_utils::{cargo_lock_path, detect_and_generate_name_and_sdk_version};
+use ere_build_utils::detect_and_generate_name_and_sdk_version;
 
 fn main() {
     detect_and_generate_name_and_sdk_version("risc0", "risc0-zkvm");
-
-    if let Ok(cargo_lock) = cargo_lock_path(3) {
-        println!("cargo:rerun-if-changed={}", cargo_lock.display());
-    }
 }

crates/zkvm/sp1/build.rs

@@ -1,9 +1,5 @@
-use ere_build_utils::{cargo_lock_path, detect_and_generate_name_and_sdk_version};
+use ere_build_utils::detect_and_generate_name_and_sdk_version;
 
 fn main() {
     detect_and_generate_name_and_sdk_version("sp1", "sp1-sdk");
-
-    if let Ok(cargo_lock) = cargo_lock_path(3) {
-        println!("cargo:rerun-if-changed={}", cargo_lock.display());
-    }
 }

crates/zkvm/ziren/build.rs

@@ -1,9 +1,5 @@
-use ere_build_utils::{cargo_lock_path, detect_and_generate_name_and_sdk_version};
+use ere_build_utils::detect_and_generate_name_and_sdk_version;
 
 fn main() {
     detect_and_generate_name_and_sdk_version("ziren", "zkm-sdk");
-
-    if let Ok(cargo_lock) = cargo_lock_path(3) {
-        println!("cargo:rerun-if-changed={}", cargo_lock.display());
-    }
 }

crates/zkvm/zisk/build.rs

@@ -1,9 +1,5 @@
-use ere_build_utils::{cargo_lock_path, detect_and_generate_name_and_sdk_version};
+use ere_build_utils::detect_and_generate_name_and_sdk_version;
 
 fn main() {
     detect_and_generate_name_and_sdk_version("zisk", "ziskos");
-
-    if let Ok(cargo_lock) = cargo_lock_path(3) {
-        println!("cargo:rerun-if-changed={}", cargo_lock.display());
-    }
 }