artcraft/.github/workflows/docker-publish-cpu.yml

# Adapted from
# https://github.com/actions/starter-workflows/ci/docker-publish.yml
# If using base images, don't forget to add READ access, eg. from a package settings page like:
# https://github.com/orgs/storytold/packages/container/docker-base-images-rust-ssl/settings/actions_access
name: "[CPU] Build GHCR Docker artifact"
on:
  push:
    branches:
      # NB: Default-branch doesn't work, despite Github's documentation.
      #- $default-branch
      - main
      - test
    # Only build when files that affect the Docker image change.
    # This avoids expensive 15-25 min builds for docs-only or config-only changes.
    paths:
      # Individual files
      - '.github/workflows/docker-publish-cpu.yml'
      - 'Cargo.lock'
      - 'Cargo.toml'
      - 'build/service_cpu.Dockerfile'
      # Directories
      - '.sqlx/**'
      - '_database/**'
      - 'crates/**'
      - 'includes/**'
      - 'test_data/**'
env:
  IMAGE_NAME: storyteller-rust

jobs:
  # Push image to GitHub Packages.
  # See also https://docs.docker.com/docker-hub/builds/
  # See also https://depot.dev/blog/docker-layer-caching-in-github-actions
  # See also https://evilmartians.com/chronicles/build-images-on-github-actions-with-docker-layer-caching
  build-docker-image:
    name: "Build Docker Image"
    #runs-on: ubuntu-22.04 # runs-on: ubuntu-latest
    #runs-on: github-ubuntu-16core # NB: Premium GitHub runner with more cores
    runs-on: github-ubuntu-64core # NB: Premium GitHub runner with more cores
    if: github.event_name == 'push'
    permissions:
      packages: write
      contents: read

    steps:
      - uses: actions/checkout@v4

      # Free up disk on the runner before BuildKit fills it up. The cargo
      # release build inside the Dockerfile produces multi-GB target dirs
      # for 8 binaries; the GHA runner ships with ~14 GB pre-installed
      # tooling (Android SDK, .NET, etc.) that we don't need.
      - name: Free disk space
        run: |
          set -x
          df -h /
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc \
            /opt/hostedtoolcache/CodeQL || true
          sudo docker system prune -af --volumes || true
          df -h /

      # BuildKit is required for the `cache-from`/`cache-to` options on
      # docker/build-push-action.
      - uses: docker/setup-buildx-action@v3
        name: Set up Docker Buildx

      - uses: docker/login-action@v3
        name: Login to GitHub Container Registry
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Match the previous workflow's 12-char short-SHA convention exactly,
      # since some downstream consumers may pin to it. metadata-action's
      # built-in `type=sha,format=short` only gives a 7-char prefix.
      - id: vars
        name: Calculate short SHA
        run: |
          echo "sha_short=$(echo ${{ github.sha }} | cut -c1-12)" >> $GITHUB_OUTPUT

      - id: meta
        name: Compute Docker tags
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/storytold/storyteller-rust
          tags: |
            type=raw,value=latest
            type=raw,value=${{ github.sha }}
            type=raw,value=${{ steps.vars.outputs.sha_short }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./build/service_cpu.Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            GIT_SHA=${{ github.sha }}
          # GitHub Actions cache backend for BuildKit. `mode=max` saves
          # all intermediate layers, not just the final image — critical
          # for our multi-stage Cargo builds.
          cache-from: type=gha
          cache-to: type=gha,mode=max
          # The runner has plenty of memory; this prevents BuildKit from
          # OOM-killing the cargo linker on a 16+ GB workspace build.
          provenance: false

      - name: Cleanup / Debug
        # This job will run even on failures to help with debugging.
        if: always()
        run: |
          echo "Report at final github action step:"
          echo "Disk usage:"
          pwd
          du -hsc * 2>/dev/null | sort -hr || true
          df -h /