Do not push to GHCR for Pull Requests from fork repositories #3619
Conversation
allgandalf
changed the title
allgandalf
changed the title
robkooper
left a comment
robkooper
left a comment
There was a problem hiding this comment.
the other thing we need to fix is that it uses the right base image later, see error at: https://github.com/PecanProject/pecan/actions/runs/17475953611/job/49637278181?pr=3619#step:12:254
| - name: Login to GitHub Container Registry | ||
| uses: docker/login-action@v3 | ||
| # Check if we are pushing to GHCR (i.e., not a PR from a fork) | ||
| if: ${{ github.repository == 'pecanproject/pecan' && (github.event_name == 'push' || github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule') }} |
There was a problem hiding this comment.
best if we do a case insensitive compare.
| with: | ||
| username: ${{ secrets.DOCKERHUB_USERNAME }} | ||
| password: ${{ secrets.DOCKERHUB_PASSWORD }} | ||
|
|
There was a problem hiding this comment.
Putting comments from slack here for future work since slack messages aren't visible after sometime:
Rohan Sasne
Sep 5th at 2:12 AM
my understanding here was that we do not need to push docker builds from PR's which are raised from fork repositories to GHCR, but please correct me if i am wrong!
2:13
we only need to build the docker file
infotroph
Sep 5th at 2:20 AM
The part that gets thorny is that the build is a whole stack of images that build on each other, so if we’re not pushing one we have to decide whether that means not building the ones that depend on it, building them on top of the last-pushed version and hoping it’s close enough, etc.
I believe there are some complications around Docker build cache as well, but I don’t have a firm enough grasp on how that works to know what changes are needed.
All solveable, but I’ll defer to @kooper on how we should approach it.
👍
1
Rohan Sasne
Sep 5th at 2:28 AM
so if we’re not pushing one
Just to be clear are you concerned that we will not push the changes to GHCR when we merge the pull request with my current changes?
2:28
or do you mean that during building on the new commits in the current pull request which is yet to get merged? (edited)
infotroph
Sep 5th at 2:35 AM
The second — we want to check that all images build successfully from this particular commit, and the way everything is setup right now that requires pushing the freshly built images as we go so that we can pull the ones that are dependencies back when building each downstream one on top of it.
2:38
Last time we discussed this I think @kooper mentioned we might be able to work around that by configuring a local-to-the-runner Docker registry, but then immediately added something to the effect “but then we’d run into all kinds of disk space issues”. I’ll let Rob tell us whether that was a possiblity worth pursuing or one he was immediately talking himself out of. (edited)
Also sent to the channel
kooper
Sep 11th at 7:31 AM
Yes if you look at the workflow for the docker images they are building on top of each other:
depends -> base -> pecan ->models -> sipnet
7:33
so if you want to test the build we need each of the intermediate images, and to get those in the next step of the workflow we have to store them somewhere. As far as I have seen there are 2 options, you save them and write them to storage, every github has some small storage, or we leverage a docker registry. We can use a local registry, but the more I looked into that the harder it will be since we have different jobs, and I don't think we can keep the registr alive between jobs, esp since we use a matrix, where the jobs will run on different servers.
7:35
or, what we started to do, we push the images to a registry, like dockerhub or github. What we need to do is when we specify the image we want to use, we don't just specify the name, but also include the project and repository, so image arg should be more like ghcr.io/pecanproject/depends:pr-966 this way we have the exact image that we want to use.
2 participants
Description
Fixed issue #3618
With this PR, we fix the CI failure for forked branches, we cannot push to dockerhub since forks dont have write permission to
Pecan ProjectGHCR.Motivation and Context
Review Time Estimate
Types of changes
Checklist: