qdrant/.github/workflows/docker-image.yml at master · ictrektech/qdrant · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
name: Build and deploy docker image

on:
  push:
    # Pattern matched against refs/tags
    tags:
      - '*'           # Push events to every tag not containing /

jobs:

  build:
    # Run build on our self-hosted runner, we had trouble with shared runners
    runs-on: [self-hosted, linux, x64]
    permissions:
      contents: read
      packages: write
      id-token: write # needed for cosign keyless signing with OIDC
    steps:
    - uses: actions/checkout@v5
    - uses: Swatinem/rust-cache@v2
    - name: Install cosign
      uses: sigstore/cosign-installer@v3.10.0
    - name: Get current tag
      id: vars
      run: echo "tag=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT
    - name: Get minor and major tags
      id: version
      run: |
        MAJOR_VERSION=$(echo "${{ steps.vars.outputs.tag }}" | cut -d '.' -f 1)
        MINOR_VERSION=$(echo "${{ steps.vars.outputs.tag }}" | cut -d '.' -f 1-2)
        echo "major_version=${MAJOR_VERSION}" >> $GITHUB_OUTPUT
        echo "minor_version=${MINOR_VERSION}" >> $GITHUB_OUTPUT
    - name: Build the Docker image
      env:
        RELEASE_VERSION: ${{ steps.vars.outputs.tag }}
        MAJOR_VERSION: ${{ steps.version.outputs.major_version }}
        MINOR_VERSION: ${{ steps.version.outputs.minor_version }}
      run: |
        # Create build container
        docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
        docker buildx create --use

        # Authenticate on registries
        echo "${{ secrets.DOCKERHUB_TOKEN }}" | docker login --username generall --password-stdin
        echo "${{ secrets.GITHUB_TOKEN }}" | docker login https://docker.pkg.github.com -u qdrant --password-stdin

        # Build regular image for Docker Hub
        DOCKERHUB_TAG="qdrant/qdrant:${{ github.ref_name }}"
        DOCKERHUB_TAG_LATEST="qdrant/qdrant:latest"
        DOCKERHUB_TAG_MINOR="qdrant/qdrant:${MINOR_VERSION}"
        DOCKERHUB_TAG_MAJOR="qdrant/qdrant:${MAJOR_VERSION}"
        TAGS="-t ${DOCKERHUB_TAG} -t ${DOCKERHUB_TAG_LATEST} -t ${DOCKERHUB_TAG_MINOR} -t ${DOCKERHUB_TAG_MAJOR}"
        GITHUB_TAG="docker.pkg.github.com/qdrant/qdrant/qdrant:${{ github.ref_name }}"

        # Pull, retag and push to GitHub packages
        docker buildx build --sbom=true --platform='linux/amd64,linux/arm64' --build-arg GIT_COMMIT_ID=${{ github.sha }} $TAGS --push --label "org.opencontainers.image.version"=$RELEASE_VERSION .
        docker pull $DOCKERHUB_TAG
        docker tag $DOCKERHUB_TAG $GITHUB_TAG
        docker push $GITHUB_TAG

        DIGEST=$(docker buildx imagetools inspect ${DOCKERHUB_TAG} --format '{{ json .Manifest.Digest }}' | cut -d '"' -f 2)
        cosign sign --yes "${DOCKERHUB_TAG}@${DIGEST}"

        # Build unprivileged image for Docker Hub
        DOCKERHUB_TAG_UNPRIVILEGED="qdrant/qdrant:${{ github.ref_name }}-unprivileged"
        DOCKERHUB_TAG_LATEST_UNPRIVILEGED="qdrant/qdrant:latest-unprivileged"
        DOCKERHUB_TAG_MINOR_UNPRIVILEGED="qdrant/qdrant:${MINOR_VERSION}-unprivileged"
        DOCKERHUB_TAG_MAJOR_UNPRIVILEGED="qdrant/qdrant:${MAJOR_VERSION}-unprivileged"
        TAGS_UNPRIVILEGED="-t ${DOCKERHUB_TAG_UNPRIVILEGED} -t ${DOCKERHUB_TAG_LATEST_UNPRIVILEGED} -t ${DOCKERHUB_TAG_MINOR_UNPRIVILEGED} -t ${DOCKERHUB_TAG_MAJOR_UNPRIVILEGED}"
        GITHUB_TAG_UNPRIVILEGED="docker.pkg.github.com/qdrant/qdrant/qdrant:${{ github.ref_name }}-unprivileged"

        # Pull, retag and push to GitHub packages
        docker buildx build --sbom=true --build-arg='USER_ID=1000' --platform='linux/amd64,linux/arm64' $TAGS_UNPRIVILEGED --push --label "org.opencontainers.image.version"=$RELEASE_VERSION .
        docker pull $DOCKERHUB_TAG_UNPRIVILEGED
        docker tag $DOCKERHUB_TAG_UNPRIVILEGED $GITHUB_TAG_UNPRIVILEGED
        docker push $GITHUB_TAG_UNPRIVILEGED

        DIGEST=$(docker buildx imagetools inspect ${DOCKERHUB_TAG_UNPRIVILEGED} --format '{{ json .Manifest.Digest }}' | cut -d '"' -f 2)
        cosign sign --yes "${DOCKERHUB_TAG_UNPRIVILEGED}@${DIGEST}"

  build-gpu:
    runs-on: [self-hosted, linux, x64]
    permissions:
      contents: read
      packages: write
      id-token: write # needed for cosign keyless signing with OIDC
    steps:
    - uses: actions/checkout@v5
    - uses: Swatinem/rust-cache@v2
    - name: Install cosign
      uses: sigstore/cosign-installer@v3.10.0
    - name: Get current tag
      id: vars
      run: echo "tag=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT
    - name: Get minor and major tags
      id: version
      run: |
        MAJOR_VERSION=$(echo "${{ steps.vars.outputs.tag }}" | cut -d '.' -f 1)
        MINOR_VERSION=$(echo "${{ steps.vars.outputs.tag }}" | cut -d '.' -f 1-2)
        echo "major_version=${MAJOR_VERSION}" >> $GITHUB_OUTPUT
        echo "minor_version=${MINOR_VERSION}" >> $GITHUB_OUTPUT
    - name: Build the Docker image
      env:
        RELEASE_VERSION: ${{ steps.vars.outputs.tag }}
        MAJOR_VERSION: ${{ steps.version.outputs.major_version }}
        MINOR_VERSION: ${{ steps.version.outputs.minor_version }}
      run: |
        # Create build container
        docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
        docker buildx create --use

        # Authenticate on registries
        echo "${{ secrets.DOCKERHUB_TOKEN }}" | docker login --username generall --password-stdin
        echo "${{ secrets.GITHUB_TOKEN }}" | docker login https://docker.pkg.github.com -u qdrant --password-stdin

        # Build GPU NVIDIA image for Docker Hub
        DOCKERHUB_TAG="qdrant/qdrant:${{ github.ref_name }}-gpu-nvidia"
        DOCKERHUB_TAG_LATEST="qdrant/qdrant:gpu-nvidia-latest"
        DOCKERHUB_TAG_MINOR="qdrant/qdrant:${MINOR_VERSION}-gpu-nvidia"
        DOCKERHUB_TAG_MAJOR="qdrant/qdrant:${MAJOR_VERSION}-gpu-nvidia"
        TAGS="-t ${DOCKERHUB_TAG} -t ${DOCKERHUB_TAG_LATEST} -t ${DOCKERHUB_TAG_MINOR} -t ${DOCKERHUB_TAG_MAJOR}"
        GITHUB_TAG="docker.pkg.github.com/qdrant/qdrant/qdrant:${{ github.ref_name }}-gpu-nvidia"

        # Pull, retag and push to GitHub packages
        docker buildx build --sbom=true --build-arg GPU=nvidia --platform='linux/amd64' --build-arg GIT_COMMIT_ID=${{ github.sha }} $TAGS --push --label "org.opencontainers.image.version"=$RELEASE_VERSION .
        docker pull $DOCKERHUB_TAG
        docker tag $DOCKERHUB_TAG $GITHUB_TAG
        docker push $GITHUB_TAG

        DIGEST=$(docker buildx imagetools inspect ${DOCKERHUB_TAG} --format '{{ json .Manifest.Digest }}' | cut -d '"' -f 2)
        cosign sign --yes "${DOCKERHUB_TAG}@${DIGEST}"

        # Build GPU AMD image for Docker Hub
        DOCKERHUB_TAG="qdrant/qdrant:${{ github.ref_name }}-gpu-amd"
        DOCKERHUB_TAG_LATEST="qdrant/qdrant:gpu-amd-latest"
        DOCKERHUB_TAG_MINOR="qdrant/qdrant:${MINOR_VERSION}-gpu-amd"
        DOCKERHUB_TAG_MAJOR="qdrant/qdrant:${MAJOR_VERSION}-gpu-amd"
        TAGS="-t ${DOCKERHUB_TAG} -t ${DOCKERHUB_TAG_LATEST} -t ${DOCKERHUB_TAG_MINOR} -t ${DOCKERHUB_TAG_MAJOR}"
        GITHUB_TAG="docker.pkg.github.com/qdrant/qdrant/qdrant:${{ github.ref_name }}-gpu-amd"

        # Pull, retag and push to GitHub packages
        docker buildx build --sbom=true --build-arg GPU=amd --platform='linux/amd64' --build-arg GIT_COMMIT_ID=${{ github.sha }} $TAGS --push --label "org.opencontainers.image.version"=$RELEASE_VERSION .
        docker pull $DOCKERHUB_TAG
        docker tag $DOCKERHUB_TAG $GITHUB_TAG
        docker push $GITHUB_TAG

        DIGEST=$(docker buildx imagetools inspect ${DOCKERHUB_TAG} --format '{{ json .Manifest.Digest }}' | cut -d '"' -f 2)
        cosign sign --yes "${DOCKERHUB_TAG}@${DIGEST}"