docker-build-variants.yml

name: Docker Build All Variants

on:
  workflow_dispatch:
    inputs:
      push_images:
        description: 'Push images to registry'
        required: false
        default: false
        type: boolean
      rocm_version:
        description: 'ROCm version (6.0, 6.1, 6.2)'
        required: false
        default: '6.0'
        type: string
      cuda_version:
        description: 'CUDA version (12.1, 11.8)'
        required: false
        default: '12.1'
        type: string

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: onnwee/transcript-create

jobs:
  build-rocm:
    name: Build ROCm Variant
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      security-events: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        if: ${{ inputs.push_images }}
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build ROCm image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64
          push: ${{ inputs.push_images }}
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:rocm${{ inputs.rocm_version }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:rocm
          build-args: |
            ROCM_WHEEL_INDEX=https://download.pytorch.org/whl/rocm${{ inputs.rocm_version }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          outputs: type=docker,dest=/tmp/rocm-image.tar

      - name: Load image for scanning
        run: docker load --input /tmp/rocm-image.tar

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:rocm
          format: 'sarif'
          output: 'trivy-rocm-results.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: 'trivy-rocm-results.sarif'
          category: 'trivy-rocm'

      - name: Get image size
        run: |
          SIZE=$(docker images "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:rocm" --format "{{.Size}}")
          echo "Image size: ${SIZE}"
          echo "### ROCm Variant :rocket:" >> $GITHUB_STEP_SUMMARY
          echo "**Size:** ${SIZE}" >> $GITHUB_STEP_SUMMARY
          echo "**Target:** <2.5GB" >> $GITHUB_STEP_SUMMARY

  build-cpu:
    name: Build CPU Variant
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      security-events: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        if: ${{ inputs.push_images }}
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build CPU image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile.cpu
          platforms: linux/amd64
          push: ${{ inputs.push_images }}
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:cpu
          cache-from: type=gha
          cache-to: type=gha,mode=max
          outputs: type=docker,dest=/tmp/cpu-image.tar

      - name: Load image for scanning
        run: docker load --input /tmp/cpu-image.tar

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:cpu
          format: 'sarif'
          output: 'trivy-cpu-results.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: 'trivy-cpu-results.sarif'
          category: 'trivy-cpu'

      - name: Get image size
        run: |
          SIZE=$(docker images "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:cpu" --format "{{.Size}}")
          echo "Image size: ${SIZE}"
          echo "### CPU Variant :rocket:" >> $GITHUB_STEP_SUMMARY
          echo "**Size:** ${SIZE}" >> $GITHUB_STEP_SUMMARY
          echo "**Target:** <1GB" >> $GITHUB_STEP_SUMMARY

  build-cuda:
    name: Build CUDA Variant
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      security-events: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        if: ${{ inputs.push_images }}
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Determine CUDA wheel index
        id: cuda
        run: |
          case "${{ inputs.cuda_version }}" in
            12.1)
              echo "wheel_index=https://download.pytorch.org/whl/cu121" >> $GITHUB_OUTPUT
              ;;
            11.8)
              echo "wheel_index=https://download.pytorch.org/whl/cu118" >> $GITHUB_OUTPUT
              ;;
            *)
              echo "wheel_index=https://download.pytorch.org/whl/cu121" >> $GITHUB_OUTPUT
              ;;
          esac

      - name: Build CUDA image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile.cuda
          platforms: linux/amd64
          push: ${{ inputs.push_images }}
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:cuda${{ inputs.cuda_version }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:cuda
          build-args: |
            CUDA_WHEEL_INDEX=${{ steps.cuda.outputs.wheel_index }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          outputs: type=docker,dest=/tmp/cuda-image.tar

      - name: Load image for scanning
        run: docker load --input /tmp/cuda-image.tar

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:cuda
          format: 'sarif'
          output: 'trivy-cuda-results.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: 'trivy-cuda-results.sarif'
          category: 'trivy-cuda'

      - name: Get image size
        run: |
          SIZE=$(docker images "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:cuda" --format "{{.Size}}")
          echo "Image size: ${SIZE}"
          echo "### CUDA Variant :rocket:" >> $GITHUB_STEP_SUMMARY
          echo "**Size:** ${SIZE}" >> $GITHUB_STEP_SUMMARY
          echo "**Target:** <2.5GB" >> $GITHUB_STEP_SUMMARY

  summary:
    name: Build Summary
    runs-on: ubuntu-latest
    needs: [build-rocm, build-cpu, build-cuda]
    if: always()
    permissions:
      contents: read

    steps:
      - name: Generate summary
        run: |
          echo "## Docker Build Variants Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "All variants built successfully! ✅" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Variants Built:" >> $GITHUB_STEP_SUMMARY
          echo "- ROCm ${{ inputs.rocm_version }}" >> $GITHUB_STEP_SUMMARY
          echo "- CPU-only" >> $GITHUB_STEP_SUMMARY
          echo "- CUDA ${{ inputs.cuda_version }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Security Scans:" >> $GITHUB_STEP_SUMMARY
          echo "Trivy vulnerability scans completed for all variants." >> $GITHUB_STEP_SUMMARY
          echo "Check the Security tab for detailed results." >> $GITHUB_STEP_SUMMARY