docker.yml

name: docker

on:
  release:
    types: [published]
  push:
    branches:
      - main
    paths:
      - vllm.Dockerfile
      - sglang.Dockerfile
      - .github/workflows/docker.yml
      - uv.lock
  pull_request:
    branches:
      - main
      - f/sglang-support
    paths:
      - vllm.Dockerfile
      - sglang.Dockerfile
      - .github/workflows/docker.yml
      - uv.lock

# Required for Workload Identity Federation to GCP.
# `id-token: write` lets the runner mint an OIDC token that GCP exchanges for
# short-lived credentials. `contents: read` is needed for actions/checkout.
permissions:
  contents: read
  id-token: write

jobs:
  push_to_registry:
    name: Build and push Docker images
    # Dependabot PRs never receive repository secrets (GitHub withholds them
    # from dependabot-triggered runs), so GCP auth always fails here. Skip
    # the job for those PRs instead of reporting a false CI failure; the
    # real image build/push still runs on merge to main and on release.
    if: github.event_name != 'pull_request' || github.actor != 'dependabot[bot]'
    runs-on:
      - ubuntu-latest
    strategy:
      matrix:
        backend: [vllm, sglang]
    env:
      # These are read from GitHub Actions repository variables (Settings ->
      # Secrets and variables -> Actions -> Variables). Set them once for the
      # repo and they apply to every workflow run.
      #
      #   GCP_AR_REGION       e.g. us-central1, northamerica-northeast1
      #   GCP_PROJECT_ID      e.g. my-gcp-project-123456
      #   GCP_AR_REPOSITORY   e.g. vector-inference   (must already exist in GAR)
      GCP_AR_REGION: ${{ vars.GCP_AR_REGION }}
      GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}
      GCP_AR_REPOSITORY: ${{ vars.GCP_AR_REPOSITORY }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7.0.1

      - name: Extract backend version
        id: backend-version
        run: |
          VERSION=$(grep -A 1 "name = \"${{ matrix.backend }}\"" uv.lock | grep version | cut -d '"' -f 2)
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Compute image base path
        id: image
        run: |
          BASE="${GCP_AR_REGION}-docker.pkg.dev/${GCP_PROJECT_ID}/${GCP_AR_REPOSITORY}/vector-inference-${{ matrix.backend }}"
          echo "base=${BASE}" >> $GITHUB_OUTPUT

      - name: Maximize build space
        run: |
          echo "Disk space before cleanup:"
          df -h
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf /usr/local/lib/android
          sudo rm -rf /opt/ghc
          sudo rm -rf /opt/hostedtoolcache/CodeQL
          sudo rm -rf /usr/local/share/boost
          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
          sudo apt-get clean
          docker rmi $(docker image ls -aq) >/dev/null 2>&1 || true
          echo "Disk space after cleanup:"
          df -h

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      # Authenticate to Google Cloud using Workload Identity Federation.
      # No long-lived service-account JSON key is stored in GitHub.
      #
      # Required secrets:
      #   GCP_WIF_PROVIDER         Full resource name of the Workload Identity
      #                            Provider, e.g.
      #                            projects/123456789/locations/global/workloadIdentityPools/github-pool/providers/github-provider
      #   GCP_WIF_SERVICE_ACCOUNT  Email of the service account to impersonate,
      #                            e.g. gh-actions-pusher@my-project.iam.gserviceaccount.com
      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ secrets.GCP_WIF_PROVIDER }}
          service_account: ${{ secrets.GCP_WIF_SERVICE_ACCOUNT }}

      - uses: google-github-actions/setup-gcloud@v3

      - name: Configure Docker for Artifact Registry
        run: gcloud auth configure-docker ${{ env.GCP_AR_REGION }}-docker.pkg.dev --quiet

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302
        with:
          images: ${{ steps.image.outputs.base }}

      - name: Build and push Docker image
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
        with:
          context: .
          file: ./${{ matrix.backend }}.Dockerfile
          push: true
          # A pull_request publishes only the metadata-action tag
          # (pr-<number>), so the PR image is pullable for testing but cannot
          # overwrite :latest or :<version>. Merges to main and releases
          # publish all three tags.
          tags: |
            ${{ steps.meta.outputs.tags }}
            ${{ github.event_name != 'pull_request' && format('{0}:{1}', steps.image.outputs.base, steps.backend-version.outputs.version) || '' }}
            ${{ github.event_name != 'pull_request' && format('{0}:latest', steps.image.outputs.base) || '' }}
          labels: ${{ steps.meta.outputs.labels }}
          provenance: false