Update docker CI to run arm64 build on a dedicated runner - #21
IamCoder18 merged 2 commits into
Conversation
Each platform now builds on its own runner (ubuntu-latest for amd64, ubuntu-24.04-arm for arm64) and pushes its manifest to GHCR by digest; a merge job combines the two into a single multi-arch manifest list with the computed tags. This replaces the QEMU-emulated arm64 build, which dominated the workflow's ~3 minute runtime.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (1)
🔇 Additional comments (3)
📝 WalkthroughWalkthroughChangesDocker CI workflows
Priority: ➖ Normal Estimated code review effort: 4 (Complex) | ~45 minutes Change: Refactor · Severity of issue fixed: Medium Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant NativeRunners
participant GHCR
participant MergeJob
GitHubActions->>NativeRunners: Build amd64 and arm64 images
NativeRunners->>GHCR: Push images by digest
NativeRunners-->>MergeJob: Provide image digests
MergeJob->>GHCR: Create multi-architecture manifest
MergeJob->>GHCR: Inspect merged image
Merge Risk: ⚪ Minimal · up to The workflow preserves pull-request image validation and publishes release manifests from both native platform images with no confirmed merge-blocking issue. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | ||
| VERSION: ${{ steps.meta.outputs.version }} | ||
| run: | | ||
| docker buildx imagetools inspect "$IMAGE:$VERSION" |
There was a problem hiding this comment.
WARNING: steps.meta.outputs.version is empty on plain branch pushes (no semver tag), so this inspect runs against an empty tag and fails the merge job.
docker/metadata-action's version output is only set when a semver pattern matches — i.e. on v* tag pushes. On a regular push to main (the workflow's other push: trigger), version is empty, so the command becomes effectively docker buildx imagetools inspect "ghcr.io/IamCoder18/synapse-website:", which fails. Fall back to a tag that is always present for the configured triggers (e.g. latest, which is enabled for the default branch and present on every push: branches: [main] run):
| docker buildx imagetools inspect "$IMAGE:$VERSION" | |
| docker buildx imagetools inspect "${IMAGE}:${VERSION:-latest}" |
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
There was a problem hiding this comment.
False positive — the version output is not empty on branch pushes. docker/metadata-action sets version from the first matching tag rule, and type=ref,event=branch always matches on the push: branches: [main] trigger. Verified against the real run on main (run 34765339776), where the extract-metadata step logs:
org.opencontainers.image.version=main
So on a main push this inspects ghcr.io/iamcoder18/synapse-website:main (which the merge job just pushed), and on a v* tag push version is the semver. It can only be empty if none of the tag rules matched, which cannot happen for this workflow's triggers (type=ref,event=branch covers main, type=semver covers tags, type=raw,value=latest is unconditional on the default branch).
Still, since an empty version would silently inspect the wrong ref, the step now fails loudly in that case instead:
docker buildx imagetools inspect "${IMAGE}:${VERSION:?metadata-action produced no version tag}"
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (3 files)
Previous Review Summary (commit 3415b85)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit 3415b85)Status: 1 Issue Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (2 files)
Reviewed by minimax-m3 · Input: 0 · Output: 0 · Cached: 0 |
Push/tag publishing (build + digest push + manifest merge) stays in docker.yml; PR validation builds move to docker-pr.yml. Each file only triggers for its own event, so check lists no longer contain skipped jobs.
1 participant
Fixes #20
What
The Docker image workflow no longer builds
linux/arm64under QEMU on an amd64 runner. Each platform now builds natively on its own runner and the results are combined into one multi-arch image:build-amd64(ubuntu-latest) andbuild-arm64(GitHub's freeubuntu-24.04-armrunner) each build thesynapse-websitebake target for their platform and push the manifest to GHCR by digest (push-by-digest, bare repo name as the exporter name).mergerunsdocker buildx imagetools createwith both digests and attaches all the computed tags (main/v*semver/latest/sha) to the resulting multi-arch manifest list.build-pr-amd64/build-pr-arm64on thesynapse-website-prtarget) so PR checks also drop QEMU.website/docker-bake.hclis unchanged functionally — it still declares both platforms for single-node local builds; CI just overridesplatformper runner via--set.Why
The QEMU-emulated arm64 build dominated the workflow (~3 minutes total). Native per-runner builds should drop it to well under a minute (#20).
How
imagetools createmerge.push-by-digestrejects tagged refs (verified — buildx errors withcan't push tagged ref ... by digestotherwise). Tags are applied once, atomically, by the merge job.metadataoutput), so no artifacts are needed.Test
push-by-digest(labels applied, metadata captured), thenimagetools createmerged both digests —imagetools inspectshows a correct OCI index withlinux/amd64,linux/arm64, and provenance attestations.push-by-digestrequires clearing metadata tags and that--set "*.tags=<name>"wins over the metadata bake file.actionlintandzizmorpass clean on the workflow;bake --printconfirms the resolved per-platform target config.Checklist
./gradlew testunaffectedCHANGELOG.md— not user-facing (follows at next release)