Skip to content

Do not push to GHCR for Pull Requests from fork repositories #3619

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: develop
Choose a base branch
from
Open

Do not push to GHCR for Pull Requests from fork repositories #3619

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
41270bd
Fix push to dockerHub for fork repositories
allgandalf Sep 4, 2025
4d14158
Merge branch 'develop' into fixCIFailure
allgandalf Sep 4, 2025
a00d8c4
Merge branch 'PecanProject:develop' into fixCIFailure
allgandalf Oct 16, 2025
e8b0fbc
try fixing workflow using artifacts
allgandalf Oct 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
88 changes: 54 additions & 34 deletions .github/workflows/docker-build-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,11 @@ on:
r-version:
required: true
type: string
parent-image:
parent-image: # This input is for the *short name* of the parent
required: false
default: ''
type: string
parent-image-full-tag: # NEW: This input will be the *full tag* of the parent
required: false
default: ''
type: string
Expand All @@ -27,13 +31,21 @@ on:
required: false
default: "linux/amd64"
type: string
enable-push: # NEW: Control whether to push the image
required: false
type: boolean
default: true
secrets:
DOCKERHUB_USERNAME:
description: 'DockerHub username used to push images'
required: false
DOCKERHUB_PASSWORD:
description: 'DockerHub password used to push images'
required: false
outputs: # NEW: Output the primary tag for artifact handling
image-primary-tag:
description: "The primary tag generated by docker/metadata-action"
value: ${{ fromJson(steps.meta.outputs.tags)[0] }}

env:
DEFAULT_R_VERSION: "4.4"
Expand All @@ -42,24 +54,28 @@ jobs:
build:
runs-on: ubuntu-latest
permissions:
packages: write
packages: write # Keep this for GHCR pushing (if enabled)

steps:

- name: lowercase image name
id: name
run: |
echo "image_name=$(echo ${{ inputs.image-name }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
echo "repository=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT

- name: set PARENT_IMAGE only if specified
# NEW: Modify parent step to use parent-image-full-tag if provided
- name: set PARENT_IMAGE_FULL_TAG build-arg if specified
id: parent
shell: bash
run: |
echo "PARENT_IMAGE_IF_SET=$(
[[ -n '${{ inputs.parent-image-full-tag }}' ]] &&
echo 'PARENT_IMAGE=${{ inputs.parent-image-full-tag }}' ||
[[ -n '${{ inputs.parent-image }}' ]] &&
echo "PARENT_IMAGE=ghcr.io/${{ steps.name.outputs.repository }}/"'${{ inputs.parent-image }}'
)" >> $GITHUB_OUTPUT
echo 'PARENT_IMAGE=ghcr.io/${{ steps.name.outputs.repository }}/${{ inputs.parent-image }}:latest' # Fallback for base image
)" >> "$GITHUB_OUTPUT"
# The 'latest' fallback here is a simplification. Ideally, the parent-image-full-tag
# should always be passed if a parent exists.

- name: set MODEL_VERSION only if specified
id: modelver
Expand All @@ -68,73 +84,58 @@ jobs:
echo "MODEL_VERSION_IF_SET=$(
[[ -n '${{ inputs.model-version }}' ]] &&
echo 'MODEL_VERSION=${{ inputs.model-version }}'
)" >> $GITHUB_OUTPUT
)" >> "$GITHUB_OUTPUT"

- uses: actions/checkout@v4

# create metadata for image
- name: Docker meta
env:
check_var: ${{ secrets.DOCKERHUB_USERNAME }}
is_default_R: ${{ inputs.r-version == env.DEFAULT_R_VERSION }}
id: meta
uses: docker/metadata-action@v5
with:
# list of Docker images to use as base name for tags
images: |
# Only generate GHCR tags for all builds, DockerHub only if pushing to it
name=ghcr.io/${{ steps.name.outputs.repository }}/${{ steps.name.outputs.image_name }}
name=pecan/${{ steps.name.outputs.image_name }},enable=${{ env.check_var != null }}
# generate Docker tags based on the following events/attributes
name=pecan/${{ steps.name.outputs.image_name }},enable=${{ inputs.enable-push && secrets.DOCKERHUB_USERNAME != null }}
tags: |
type=schedule
type=ref,event=branch,enable=${{ env.is_default_R }}
type=ref,event=branch,enable=${{ inputs.r-version == env.DEFAULT_R_VERSION }}
type=ref,event=branch,suffix=-R${{ inputs.r-version }}
type=ref,event=pr
type=semver,pattern={{version}},enable=${{ env.is_default_R }}
type=semver,pattern={{major}}.{{minor}},enable=${{ env.is_default_R }}
type=semver,pattern={{major}},enable=${{ env.is_default_R }}
type=semver,pattern={{version}},enable=${{ inputs.r-version == env.DEFAULT_R_VERSION }}
type=semver,pattern={{major}}.{{minor}},enable=${{ inputs.r-version == env.DEFAULT_R_VERSION }}
type=semver,pattern={{major}},enable=${{ inputs.r-version == env.DEFAULT_R_VERSION }}
type=semver,pattern={{version}},suffix=-R${{ inputs.r-version }}

# setup docker build
- name: Set up QEMU
uses: docker/setup-qemu-action@v3

- name: Set up Docker Buildx
id: buildx
uses: docker/setup-buildx-action@v3

- name: Inspect Builder
run: |
echo "Name: ${{ steps.buildx.outputs.name }}"
echo "Endpoint: ${{ steps.buildx.outputs.endpoint }}"
echo "Status: ${{ steps.buildx.outputs.status }}"
echo "Flags: ${{ steps.buildx.outputs.flags }}"
echo "Platforms: ${{ steps.buildx.outputs.platforms }}"

# login to registries
# Login to registries (conditional on enable-push)
- name: Login to DockerHub
env:
check_var: ${{ secrets.DOCKERHUB_USERNAME }}
if: env.check_var != null
if: ${{ inputs.enable-push && secrets.DOCKERHUB_USERNAME != null }}
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_PASSWORD }}

Copy link
Collaborator Author

@allgandalf allgandalf Oct 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Putting comments from slack here for future work since slack messages aren't visible after sometime:

Rohan Sasne
Sep 5th at 2:12 AM
my understanding here was that we do not need to push docker builds from PR's which are raised from fork repositories to GHCR, but please correct me if i am wrong!
2:13
we only need to build the docker file

infotroph
Sep 5th at 2:20 AM
The part that gets thorny is that the build is a whole stack of images that build on each other, so if we’re not pushing one we have to decide whether that means not building the ones that depend on it, building them on top of the last-pushed version and hoping it’s close enough, etc.
I believe there are some complications around Docker build cache as well, but I don’t have a firm enough grasp on how that works to know what changes are needed.
All solveable, but I’ll defer to @kooper on how we should approach it.
👍
1

Rohan Sasne
Sep 5th at 2:28 AM
so if we’re not pushing one
Just to be clear are you concerned that we will not push the changes to GHCR when we merge the pull request with my current changes?
2:28
or do you mean that during building on the new commits in the current pull request which is yet to get merged? (edited)

infotroph
Sep 5th at 2:35 AM
The second — we want to check that all images build successfully from this particular commit, and the way everything is setup right now that requires pushing the freshly built images as we go so that we can pull the ones that are dependencies back when building each downstream one on top of it.
2:38
Last time we discussed this I think @kooper mentioned we might be able to work around that by configuring a local-to-the-runner Docker registry, but then immediately added something to the effect “but then we’d run into all kinds of disk space issues”. I’ll let Rob tell us whether that was a possiblity worth pursuing or one he was immediately talking himself out of. (edited)
Also sent to the channel

kooper
Sep 11th at 7:31 AM
Yes if you look at the workflow for the docker images they are building on top of each other:
depends -> base -> pecan ->models -> sipnet
7:33
so if you want to test the build we need each of the intermediate images, and to get those in the next step of the workflow we have to store them somewhere. As far as I have seen there are 2 options, you save them and write them to storage, every github has some small storage, or we leverage a docker registry. We can use a local registry, but the more I looked into that the harder it will be since we have different jobs, and I don't think we can keep the registr alive between jobs, esp since we use a matrix, where the jobs will run on different servers.
7:35
or, what we started to do, we push the images to a registry, like dockerhub or github. What we need to do is when we specify the image we want to use, we don't just specify the name, but also include the project and repository, so image arg should be more like ghcr.io/pecanproject/depends:pr-966 this way we have the exact image that we want to use.

- name: Login to GitHub Container Registry
if: ${{ inputs.enable-push }}
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}

# build the docker images
- name: Build and push ${{ steps.name.outputs.image_name }}
# Build and conditionally push or load
- name: Build and ${{ inputs.enable-push && 'push' || 'load' }} ${{ steps.name.outputs.image_name }}
id: build_image
uses: docker/build-push-action@v6
with:
context: ${{ inputs.build-context }}
file: ${{ inputs.dockerfile }}
push: true
platforms: ${{ inputs.platforms }}
cache-from: type=gha
cache-to: type=gha,mode=max
Expand All @@ -151,3 +152,22 @@ jobs:
PECAN_GIT_BRANCH=${{ github.head_ref || github.ref_name }}
PECAN_GIT_CHECKSUM=${{ github.sha }}
PECAN_GIT_DATE=${{ github.event.repository.updated_at }}
push: ${{ inputs.enable-push }}
load: ${{ !inputs.enable-push }} # Load the image to the local Docker daemon if not pushing

# NEW: Export image as artifact if not pushed
- name: Save image to artifact (if not pushed)
if: ${{ !inputs.enable-push && fromJson(steps.meta.outputs.tags)[0] }}
run: |
# Use the first generated tag as the canonical tag to save the image
PRIMARY_TAG="${{ fromJson(steps.meta.outputs.tags)[0] }}"
echo "Saving image $PRIMARY_TAG to ${{ inputs.image-name }}.tar"
docker save -o "${{ inputs.image-name }}.tar" "$PRIMARY_TAG"

- name: Upload image artifact (if not pushed)
if: ${{ !inputs.enable-push }}
uses: actions/upload-artifact@v4
with:
name: image-${{ inputs.image-name }}
path: ${{ inputs.image-name }}.tar
retention-days: 1 # Short retention, only for this workflow run
Loading
Loading