v0.2.2 (sync from internal development)

.github/workflows/build.yml → .github/workflows/build-docker.yml

@@ -1,28 +1,31 @@
-name: Build and Push Docker Images
+# Generated by scitrera-repo-tools `generate-ci-gha`. Do not edit by hand;
+# re-run the generator after editing versions.yaml. Run
+# `generate-ci-gha` (no flags) to check for drift, `generate-ci-gha --force` to apply.
 
-concurrency:
-  group: docker-build-${{ github.ref }}
-  cancel-in-progress: true
+name: Build & push Docker images
 
 on:
   push:
-    #    branches: [ main ]
-    tags: [ 'v*.*.*' ]
+    tags:
+      - 'v*.*.*'
   workflow_dispatch:
     inputs:
       version:
-        description: 'Override version (e.g. 0.1.58 or v0.1.58). Leaving empty produces sha-only tags. Used when redeploying an existing release with rebuilt artifacts.'
+        description: 'Override version (e.g. 0.1.58 or v0.1.58). Empty produces sha-only tags.'
         required: false
         type: string
-#  pull_request:
-#    branches: [ main ]
 
-env:
-  GATEWAY_IMAGE: aether
-  LITE_IMAGE: aetherlite
+concurrency:
+  group: docker-build-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  packages: write
 
 jobs:
-  build-gateway:
+  build-aether:
+    name: Build aether (QEMU multi-arch)
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -37,47 +40,55 @@ jobs:
       - uses: docker/setup-buildx-action@v3
 
       - name: Login to GHCR
-        if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Login to DockerHub
-        if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Install uv
+        uses: astral-sh/setup-uv@v9.0.0
+
+      - name: Read image version from versions.yaml
+        id: imgver
+        run: |
+          VER=$(uvx --from 'scitrera-repo-tools==0.1.17' sync-versions --print-version aether-gateway)
+          echo "version=$VER" >> "$GITHUB_OUTPUT"
+          echo "major_minor=$(echo $VER | cut -d. -f1-2)" >> "$GITHUB_OUTPUT"
 
       - name: Compute workflow_dispatch version tags
         id: ver
         if: github.event_name == 'workflow_dispatch' && inputs.version != ''
         shell: bash
         run: |
           VER="${{ inputs.version }}"
-          VER="${VER#v}"  # strip optional leading 'v'
+          VER="${VER#v}"
           echo "version=$VER" >> "$GITHUB_OUTPUT"
-          echo "major_minor=$(echo "$VER" | cut -d. -f1-2)" >> "$GITHUB_OUTPUT"
+          echo "major_minor=$(echo $VER | cut -d. -f1-2)" >> "$GITHUB_OUTPUT"
 
       - name: Docker metadata
         id: meta
         uses: docker/metadata-action@v5
         with:
           images: |
-            ghcr.io/scitrera/${{ env.GATEWAY_IMAGE }}
-            scitrera/${{ env.GATEWAY_IMAGE }}
+            ghcr.io/scitrera/aether
+            scitrera/aether
           tags: |
             type=sha
             type=raw,value=latest,enable={{is_default_branch}}
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=${{ steps.imgver.outputs.version }},enable=${{ steps.imgver.outputs.version != '' }}
+            type=raw,value=${{ steps.imgver.outputs.major_minor }},enable=${{ steps.imgver.outputs.major_minor != '' }}
             type=raw,value=${{ steps.ver.outputs.version }},enable=${{ steps.ver.outputs.version != '' }}
             type=raw,value=${{ steps.ver.outputs.major_minor }},enable=${{ steps.ver.outputs.major_minor != '' }}
             type=raw,value=latest,enable=${{ steps.ver.outputs.version != '' }}
 
-      - name: Build and push gateway
+      - name: Build and push
         uses: docker/build-push-action@v6
         with:
           context: .
@@ -88,11 +99,10 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
-
   build-aetherlite:
+    name: Build aetherlite (QEMU multi-arch)
     runs-on: ubuntu-latest
-    needs: build-gateway
-    if: github.event_name != 'pull_request'
+    needs: [ build-aether ]
     permissions:
       contents: read
       packages: write
@@ -111,12 +121,20 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Login to DockerHub
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Install uv
+        uses: astral-sh/setup-uv@v9.0.0
+
+      - name: Read image version from versions.yaml
+        id: imgver
+        run: |
+          VER=$(uvx --from 'scitrera-repo-tools==0.1.17' sync-versions --print-version aether-gateway)
+          echo "version=$VER" >> "$GITHUB_OUTPUT"
+          echo "major_minor=$(echo $VER | cut -d. -f1-2)" >> "$GITHUB_OUTPUT"
 
       - name: Compute workflow_dispatch version tags
         id: ver
@@ -126,46 +144,48 @@ jobs:
           VER="${{ inputs.version }}"
           VER="${VER#v}"
           echo "version=$VER" >> "$GITHUB_OUTPUT"
-          echo "major_minor=$(echo "$VER" | cut -d. -f1-2)" >> "$GITHUB_OUTPUT"
+          echo "major_minor=$(echo $VER | cut -d. -f1-2)" >> "$GITHUB_OUTPUT"
 
       - name: Docker metadata
         id: meta
         uses: docker/metadata-action@v5
         with:
           images: |
-            ghcr.io/scitrera/${{ env.LITE_IMAGE }}
-            scitrera/${{ env.LITE_IMAGE }}
+            ghcr.io/scitrera/aetherlite
+            scitrera/aetherlite
           tags: |
             type=sha
             type=raw,value=latest,enable={{is_default_branch}}
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=${{ steps.imgver.outputs.version }},enable=${{ steps.imgver.outputs.version != '' }}
+            type=raw,value=${{ steps.imgver.outputs.major_minor }},enable=${{ steps.imgver.outputs.major_minor != '' }}
             type=raw,value=${{ steps.ver.outputs.version }},enable=${{ steps.ver.outputs.version != '' }}
             type=raw,value=${{ steps.ver.outputs.major_minor }},enable=${{ steps.ver.outputs.major_minor != '' }}
             type=raw,value=latest,enable=${{ steps.ver.outputs.version != '' }}
 
-      - name: Build and push aetherlite
+      - name: Build and push
         uses: docker/build-push-action@v6
         with:
           context: server
           file: server/Dockerfile.aetherlite-dev
           platforms: linux/amd64,linux/arm64
-          push: true
+          push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
-            BASE_IMAGE=ghcr.io/scitrera/${{ env.GATEWAY_IMAGE }}:${{ needs.build-gateway.outputs.base-tag }}
+            BASE_IMAGE=ghcr.io/scitrera/aether:${{ needs.build-aether.outputs.base-tag }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
-
-
   build-aetherlite-dev:
+    name: Build aetherlite-dev (QEMU multi-arch)
     runs-on: ubuntu-latest
-    needs: build-aetherlite
-    if: github.event_name != 'pull_request'
+    needs: [ build-aetherlite ]
     permissions:
       contents: read
       packages: write
+    outputs:
+      base-tag: ${{ steps.meta.outputs.version }}
     steps:
       - uses: actions/checkout@v6
 
@@ -179,12 +199,20 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Login to DockerHub
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Install uv
+        uses: astral-sh/setup-uv@v9.0.0
+
+      - name: Read image version from versions.yaml
+        id: imgver
+        run: |
+          VER=$(uvx --from 'scitrera-repo-tools==0.1.17' sync-versions --print-version aether-gateway)
+          echo "version=$VER" >> "$GITHUB_OUTPUT"
+          echo "major_minor=$(echo $VER | cut -d. -f1-2)" >> "$GITHUB_OUTPUT"
 
       - name: Compute workflow_dispatch version tags
         id: ver
@@ -194,45 +222,37 @@ jobs:
           VER="${{ inputs.version }}"
           VER="${VER#v}"
           echo "version=$VER" >> "$GITHUB_OUTPUT"
-          echo "major_minor=$(echo "$VER" | cut -d. -f1-2)" >> "$GITHUB_OUTPUT"
+          echo "major_minor=$(echo $VER | cut -d. -f1-2)" >> "$GITHUB_OUTPUT"
 
       - name: Docker metadata
         id: meta
         uses: docker/metadata-action@v5
         with:
           images: |
-            ghcr.io/scitrera/${{ env.LITE_IMAGE }}
-            scitrera/${{ env.LITE_IMAGE }}
-          # aetherlite is a development-only image (hardcodes AETHER_ALLOW_DEV_MODE=true
-          # and --insecure-admin); tag with a `dev-` prefix so it can never be mistaken
-          # for a production-grade release artifact.
-          #
-          # `flavor.latest=false` disables docker/metadata-action's default behavior
-          # of auto-injecting an UNPREFIXED `latest` tag on default-branch pushes /
-          # semver matches. Without this, the auto-`latest` from this dev build would
-          # overwrite the production aetherlite:latest produced by the build-aetherlite
-          # job above. The explicit `dev-latest` tags below cover the latest semantic
-          # for the dev image.
-          flavor: |
-            latest=false
+            ghcr.io/scitrera/aetherlite
+            scitrera/aetherlite
           tags: |
             type=sha,prefix=dev-
             type=raw,value=dev-latest
             type=semver,pattern={{version}},prefix=dev-
             type=semver,pattern={{major}}.{{minor}},prefix=dev-
+            type=raw,value=dev-${{ steps.imgver.outputs.version }},enable=${{ steps.imgver.outputs.version != '' }}
+            type=raw,value=dev-${{ steps.imgver.outputs.major_minor }},enable=${{ steps.imgver.outputs.major_minor != '' }}
             type=raw,value=dev-${{ steps.ver.outputs.version }},enable=${{ steps.ver.outputs.version != '' }}
             type=raw,value=dev-${{ steps.ver.outputs.major_minor }},enable=${{ steps.ver.outputs.major_minor != '' }}
+          flavor: |
+            latest=false
 
-      - name: Build and push aetherlite
+      - name: Build and push
         uses: docker/build-push-action@v6
         with:
           context: server
           file: server/Dockerfile.aetherlite-dev
           platforms: linux/amd64,linux/arm64
-          push: true
+          push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
-            BASE_IMAGE=ghcr.io/scitrera/${{ env.LITE_IMAGE }}:${{ needs.build-aetherlite.outputs.base-tag }}
+            BASE_IMAGE=ghcr.io/scitrera/aetherlite:${{ needs.build-aetherlite.outputs.base-tag }}
           cache-from: type=gha
           cache-to: type=gha,mode=max