docker-build.yml

---
name: Build Tutorial Container

on:
  push:
    branches:
      - main
    paths:
      - "Dockerfile"
      - "docker/**"
      - "binder/**"
      - "**/environment.yml"
      - ".github/workflows/docker-build.yml"
    tags:
      - "v*.*"
      - "v*.*.*"
  pull_request:
    paths:
      - "Dockerfile"
      - "docker/**"
      - "binder/**"
      - "**/environment.yml"
      - ".github/workflows/docker-build.yml"
  workflow_dispatch:

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    permissions:
      packages: write
    strategy:
      matrix:
        arch: [amd64, arm64]
        variant: [cpu, cuda]
      fail-fast: false
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=raw,value=${{ matrix.variant }}-${{ matrix.arch }},enable=${{ github.ref == 'refs/heads/main' }}
            type=raw,value=${{ matrix.variant }}-${{ matrix.arch }}-pr-${{ github.event.pull_request.number }},enable=${{ github.event_name == 'pull_request' }}
            type=raw,value=${{ matrix.variant }}-${{ matrix.arch }}-${{ github.ref_name }},enable=${{ startsWith(github.ref, 'refs/tags/') }}
            type=raw,value=${{ matrix.variant }}-${{ matrix.arch }}-sha-${{ github.sha }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/${{ matrix.arch }}
          push: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
          tags: ${{ steps.meta.outputs.tags }}
          provenance: false
          build-args: |
            PYTORCH_VARIANT=${{ matrix.variant }}

  create-manifests:
    needs: build-and-push
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    permissions:
      packages: write
    steps:
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            image=moby/buildkit:latest
            network=host

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create and push CPU manifest
        run: |
          # Determine the correct tag suffixes based on the event type
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            # PR build - use the commit SHA for more predictable references
            AMD64_TAG="cpu-amd64-sha-${{ github.sha }}"
            ARM64_TAG="cpu-arm64-sha-${{ github.sha }}"
            TARGET_TAG="cpu-sha-${{ github.sha }}"
          elif [[ "${{ startsWith(github.ref, 'refs/tags/') }}" == "true" ]]; then
            # Tag build - use tag version in the name
            AMD64_TAG="cpu-amd64-${{ github.ref_name }}"
            ARM64_TAG="cpu-arm64-${{ github.ref_name }}"
            TARGET_TAG="cpu-${{ github.ref_name }}"
          else
            # Main branch build - use simple arch tags
            AMD64_TAG="cpu-amd64"
            ARM64_TAG="cpu-arm64"
            TARGET_TAG="cpu"
          fi

          # Create the manifest with the correct tag names
          echo "Creating CPU manifest using $AMD64_TAG and $ARM64_TAG"
          docker buildx imagetools create --tag ghcr.io/${{ github.repository }}:${TARGET_TAG} \
            ghcr.io/${{ github.repository }}:${AMD64_TAG} \
            ghcr.io/${{ github.repository }}:${ARM64_TAG}

          # If on main branch, also tag as latest
          if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
            docker buildx imagetools create --tag ghcr.io/${{ github.repository }}:latest \
              ghcr.io/${{ github.repository }}:${AMD64_TAG} \
              ghcr.io/${{ github.repository }}:${ARM64_TAG}
          fi

      - name: Create and push CUDA manifest
        run: |
          # Determine the correct tag suffixes based on the event type
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            # PR build - use the commit SHA for more predictable references
            AMD64_TAG="cuda-amd64-sha-${{ github.sha }}"
            ARM64_TAG="cuda-arm64-sha-${{ github.sha }}"
            TARGET_TAG="cuda-sha-${{ github.sha }}"
          elif [[ "${{ startsWith(github.ref, 'refs/tags/') }}" == "true" ]]; then
            # Tag build - use tag version in the name
            AMD64_TAG="cuda-amd64-${{ github.ref_name }}"
            ARM64_TAG="cuda-arm64-${{ github.ref_name }}"
            TARGET_TAG="cuda-${{ github.ref_name }}"
          else
            # Main branch build - use simple arch tags
            AMD64_TAG="cuda-amd64"
            ARM64_TAG="cuda-arm64"
            TARGET_TAG="cuda"
          fi

          # Create the manifest with the correct tag names
          echo "Creating CUDA manifest using $AMD64_TAG and $ARM64_TAG"
          docker buildx imagetools create --tag ghcr.io/${{ github.repository }}:${TARGET_TAG} \
            ghcr.io/${{ github.repository }}:${AMD64_TAG} \
            ghcr.io/${{ github.repository }}:${ARM64_TAG}