docker-build-check.yml

# SPDX-FileCopyrightText: © 2025 Phala Network <dstack@phala.network>
#
# SPDX-License-Identifier: Apache-2.0

name: Docker Build Check

# Not a required status check, so a workflow-level filter is safe here: a pull
# request that skips it is not left waiting on a check that never arrives. What
# it verifies -- that the builder images still build and that their pinned
# package lists still match -- cannot change unless something under `dstack/`
# does.
on:
  push:
    branches: [ next, 'release/**' ]
    paths:
      - 'dstack/**'
      - 'rust-toolchain.toml'
      - '.github/workflows/docker-build-check.yml'
      - '.github/workflows/kms-release.yml'
      - '.github/workflows/gateway-release.yml'
      - '.github/workflows/verifier-release.yml'
  pull_request:
    branches: [ next, 'release/**' ]
    paths:
      - 'dstack/**'
      - 'rust-toolchain.toml'
      - '.github/workflows/docker-build-check.yml'
      - '.github/workflows/kms-release.yml'
      - '.github/workflows/gateway-release.yml'
      - '.github/workflows/verifier-release.yml'

env:
  DSTACK_REV: ${{ github.event.pull_request.head.sha || github.sha }}
  DSTACK_SRC_URL: ${{ github.event.pull_request.head.repo.clone_url || format('{0}/{1}', github.server_url, github.repository) }}

# Builds go through the `docker` driver, i.e. the daemon's own BuildKit, rather
# than the `docker-container` builder setup-buildx creates by default. With a
# container builder every `--load` compresses the result into a tarball and
# imports it into the daemon; for the `*-builder` targets, which carry the Rust
# toolchain and the cargo target directory, that alone was two to three
# minutes. With the daemon's builder the image lands in the store directly, and
# the second build of the `*-builder` target is a cache hit on the first.
#
# No BuildKit layer cache (`cache-to: type=gha`). The source is cloned at
# DSTACK_REV inside the build, so the cargo layer misses on every commit, and
# `mode=max` still exported the whole builder stage to the Actions cache: about
# two and a half minutes per job, and most of the repository's 10 GB cache
# quota, which evicted the cargo caches the other workflows depend on. What it
# could have saved was the pinned-package install, roughly fifteen seconds.
jobs:
  build-script-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Test release build orchestration
        run: python3 -m unittest discover -s dstack/build/shared/tests -v

  gateway:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: docker

      - name: Build Gateway Docker image
        uses: docker/build-push-action@v5
        with:
          context: dstack/gateway/dstack-app/builder
          push: false
          load: true
          tags: dstack-gateway-check:latest
          provenance: false
          build-contexts: |
            build-shared=dstack/build/shared
          build-args: |
            DSTACK_REV=${{ env.DSTACK_REV }}
            DSTACK_SRC_URL=${{ env.DSTACK_SRC_URL }}

      - name: Verify pinned packages
        run: |
          dstack/build/shared/verify-pinned-packages.sh dstack-gateway-check:latest \
            dstack/gateway/dstack-app/builder/shared/pinned-packages.txt

      - name: Build gateway-builder target
        run: |
          docker buildx build \
            --load \
            --target gateway-builder \
            --tag gateway-builder-check:latest \
            --provenance=false \
            --build-context build-shared=dstack/build/shared \
            --build-arg "DSTACK_REV=${DSTACK_REV}" \
            --build-arg "DSTACK_SRC_URL=${DSTACK_SRC_URL}" \
            dstack/gateway/dstack-app/builder

      - name: Verify builder pinned packages
        run: |
          dstack/build/shared/verify-pinned-packages.sh gateway-builder-check:latest \
            dstack/gateway/dstack-app/builder/shared/builder-pinned-packages.txt

  kms:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Checkout KMS contract dependencies
        run: |
          git submodule update --init --recursive --depth 1 -- \
            dstack/kms/auth-eth/lib/forge-std \
            dstack/kms/auth-eth/lib/openzeppelin-contracts-upgradeable \
            dstack/kms/auth-eth/lib/openzeppelin-foundry-upgrades

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: docker

      - name: Build KMS Docker image
        uses: docker/build-push-action@v5
        with:
          context: dstack/kms/dstack-app/builder
          push: false
          load: true
          tags: dstack-kms-check:latest
          provenance: false
          build-contexts: |
            build-shared=dstack/build/shared
          build-args: |
            DSTACK_REV=${{ env.DSTACK_REV }}
            DSTACK_SRC_URL=${{ env.DSTACK_SRC_URL }}

      - name: Verify pinned packages
        run: |
          dstack/build/shared/verify-pinned-packages.sh dstack-kms-check:latest \
            dstack/kms/dstack-app/builder/shared/pinned-packages.txt

      - name: Build kms-builder target
        run: |
          docker buildx build \
            --load \
            --target kms-builder \
            --tag kms-builder-check:latest \
            --provenance=false \
            --build-context build-shared=dstack/build/shared \
            --build-arg "DSTACK_REV=${DSTACK_REV}" \
            --build-arg "DSTACK_SRC_URL=${DSTACK_SRC_URL}" \
            dstack/kms/dstack-app/builder

      - name: Verify builder pinned packages
        run: |
          dstack/build/shared/verify-pinned-packages.sh kms-builder-check:latest \
            dstack/kms/dstack-app/builder/shared/builder-pinned-packages.txt

      - name: Install Foundry
        uses: foundry-rs/foundry-toolchain@v1

      - name: Build KMS contracts
        run: |
          cd dstack/kms/auth-eth
          forge build

  verifier:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: docker

      - name: Build Verifier Docker image
        uses: docker/build-push-action@v5
        with:
          context: dstack/verifier
          file: dstack/verifier/builder/Dockerfile
          push: false
          load: true
          tags: dstack-verifier-check:latest
          provenance: false
          build-contexts: |
            build-shared=dstack/build/shared
          build-args: |
            DSTACK_REV=${{ env.DSTACK_REV }}
            DSTACK_SRC_URL=${{ env.DSTACK_SRC_URL }}

      - name: Verify pinned packages (runtime)
        run: |
          dstack/build/shared/verify-pinned-packages.sh dstack-verifier-check:latest \
            dstack/verifier/builder/shared/pinned-packages.txt

      - name: Build verifier-builder target
        run: |
          docker buildx build \
            --load \
            --target verifier-builder \
            --tag verifier-builder-check:latest \
            --provenance=false \
            --file dstack/verifier/builder/Dockerfile \
            --build-context build-shared=dstack/build/shared \
            --build-arg "DSTACK_REV=${DSTACK_REV}" \
            --build-arg "DSTACK_SRC_URL=${DSTACK_SRC_URL}" \
            dstack/verifier

      - name: Verify builder pinned packages
        run: |
          dstack/build/shared/verify-pinned-packages.sh verifier-builder-check:latest \
            dstack/verifier/builder/shared/builder-pinned-packages.txt