mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-11-01 11:36:29 +00:00
083be12ddc
* 🛰️ ci: Publish Every Image Through One Native-ARM Workflow #15441 removed QEMU from the dev-branch image build and #15444 fixed the prefix-glob bug it shipped with. Both changes lived in one of five workflows that build images the same way; the other four still emulate arm64 with no layer cache and take 20-40 minutes. Rather than paste the pattern four more times, the build/merge logic moves to a reusable `docker-publish.yml` that every image workflow calls. #15444 is the argument for this: one wrong artifact-name expression would otherwise have needed correcting in five files, and the same prefix hazard exists in all of them (`librechat`/`librechat-api`, `librechat-dev`/`librechat-dev-api`, `lc-dev-staging`/`lc-dev-staging-api`). The shared implementation is the dev-branch one that already ran green, generalised only where callers differ. Callers pass what actually varies: - `images` — the target/file/image_name triples - `tag_suffixes` — newline-separated tags applied in both registries - `checkout_ref` / `build_branch` — main-image-workflow builds `main`, not the dispatch ref `main-image-workflow` and `tag-images` resolve their tags from git history, so each grew a small `resolve-tag(s)` job whose output feeds the publish. That also removes a duplicated `git fetch --tags` that previously ran once per matrix leg. Two details worth noting: - The digest-count assertion now derives its expected value from the `arches` input rather than a hard-coded 2, so the architecture list has a single source of truth shared by the build matrix and the merge guard. - Nothing is interpolated into a `run:` block any more; `build_branch` and the build digest arrive through `env`, so a ref name cannot reach a shell. Net 135 lines lighter, and QEMU no longer appears anywhere in .github/workflows. Workflow names are unchanged, so retry-docker-builds.yml still matches all five. * 🔗 fix: Pin Release Builds to One Commit and Survive Full Re-runs Review findings on the reusable publish workflow. **P1 — every build leg could resolve `main` separately.** `main-image-workflow` passed the symbolic ref `main` as `checkout_ref`, so the four build jobs each resolved it at whatever moment they were scheduled. If `main` advanced in between, the amd64 and arm64 halves of a release — or the API and application images — could be built from different commits and published under the same release and `latest` tags. `resolve-tag` now exports the commit it resolved the tag from, and the publish pins to that SHA. The single-job workflow this replaced checked out once, so this was a regression introduced by the split. `docker-publish` likewise now falls back to `github.sha` rather than passing an empty `ref` to `actions/checkout`, so callers that omit `checkout_ref` also get an immutable commit instead of relying on checkout's empty-ref handling. **P2 — digest artifacts on a full re-run.** `upload-artifact@v4` will not upload over an existing artifact name, and a full re-run keeps the run id, so a retry would fail before the merge could run. The suggested fix was to qualify the artifact name with `run_attempt`, but `retry-docker-builds` picks its endpoint by conclusion: `rerun` only when a job was cancelled, and `rerun-failed-jobs` otherwise. Under the latter the merge re-runs alone and must still find digests uploaded by the *previous* attempt's build legs, which a run_attempt-qualified name would hide — precisely the shape of the #15444 failure, where the builds passed and only the merge failed. `overwrite: true` resolves the conflict while keeping names stable across attempts. **Unreachable error branch.** `LATEST_TAG=$(git tag ... | grep ... | head -1)` under `set -euo pipefail` exits on grep's non-match, so the "No stable v<semver> tag found" message could never print. Added `|| true`, matching what `tag-images` already does. Pre-existing, carried over verbatim in the split.
59 lines
2.1 KiB
YAML
59 lines
2.1 KiB
YAML
name: Docker Compose Build Latest Main Image Tag (Manual Dispatch)
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
jobs:
|
|
# Resolved once here rather than per build leg: the tag is an input to the
|
|
# publish, and the merge job needs it too.
|
|
resolve-tag:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
outputs:
|
|
latest_tag: ${{ steps.tag.outputs.latest_tag }}
|
|
sha: ${{ steps.tag.outputs.sha }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v5
|
|
with:
|
|
ref: main
|
|
fetch-depth: 0
|
|
|
|
- name: Fetch tags and set the latest tag
|
|
id: tag
|
|
run: |
|
|
set -euo pipefail
|
|
git fetch --tags --force
|
|
# `|| true` keeps pipefail from killing the step when grep matches
|
|
# nothing, so the explicit error below is reachable.
|
|
LATEST_TAG=$(git tag --list 'v[0-9]*' --sort=-v:refname | grep -E '^v[0-9]+[.][0-9]+[.][0-9]+$' | head -n 1 || true)
|
|
if [ -z "$LATEST_TAG" ]; then
|
|
echo "::error::No stable v<semver> tag found"
|
|
exit 1
|
|
fi
|
|
printf 'latest_tag=%s\n' "$LATEST_TAG" >> "$GITHUB_OUTPUT"
|
|
# Pin the publish to the commit this job resolved the tag from. `main`
|
|
# is a moving ref: were each build leg to resolve it independently, the
|
|
# amd64 and arm64 halves of one release could come from different
|
|
# commits and still be published under the same tags.
|
|
printf 'sha=%s\n' "$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
|
|
|
|
publish:
|
|
needs: resolve-tag
|
|
uses: ./.github/workflows/docker-publish.yml
|
|
with:
|
|
images: >-
|
|
[{"target":"api-build","file":"Dockerfile.multi","image_name":"librechat-api"},
|
|
{"target":"node","file":"Dockerfile","image_name":"librechat"}]
|
|
tag_suffixes: |
|
|
${{ needs.resolve-tag.outputs.latest_tag }}
|
|
latest
|
|
checkout_ref: ${{ needs.resolve-tag.outputs.sha }}
|
|
build_branch: main
|
|
secrets:
|
|
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
|