call-images-build-ci.yml

name: "🖼️ Build: CI Images (all distros)"

on:
  workflow_call:
    inputs:
      distros:
        description: "Space-separated distro list"
        required: true
        type: string
      checkout_ref:
        description: "Optional git ref to checkout before build (default: event ref)"
        required: false
        type: string
        default: ""
      source_repository:
        description: "Repository to checkout as the build source (default: github.repository). Set to a fork only for maintainer-trusted PRs."
        required: false
        type: string
        default: ""
      image_tag:
        description: "Optional image tag override (default: ci-${github.sha})"
        required: false
        type: string
        default: ""
      concurrency_channel:
        description: "Optional channel to separate concurrency groups between callers"
        required: false
        type: string
        default: "default"
      allow_unsafe_checkout:
        description: "Allow actions/checkout to fetch PR head/merge code under pull_request_target. Only set for maintainer-trusted fork PRs."
        required: false
        type: boolean
        default: false

permissions:
  contents: read

concurrency:
  group: infinito-build-${{ github.repository }}-${{ inputs.concurrency_channel }}-${{ inputs.checkout_ref || github.ref }}
  cancel-in-progress: false

jobs:
  build:
    name: 💿 Image
    runs-on: ubuntu-26.04
    permissions:
      contents: read
      packages: write

    steps:
      - name: ⬇️ Checkout trusted workflow repo (helpers)
        uses: actions/checkout@v7.0.0
        with:
          ref: ${{ github.sha }}
          persist-credentials: false

      - name: ⬇️ Checkout source to build
        uses: actions/checkout@v7.0.0
        with:
          repository: ${{ inputs.source_repository || github.repository }}
          ref: ${{ inputs.checkout_ref || github.ref }}
          path: _src
          persist-credentials: false
          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_checkout }}

      - name: 📦 Install jq
        run: ./scripts/install/apt.sh jq

      - name: 🧮 Compute the distro list and image tag
        id: out
        run: scripts/github/runner/images_build_outputs.sh "${{ inputs.distros }}" "${{ inputs.image_tag }}"

      - name: 💽 Disk pressure (start)
        shell: bash
        run: bash scripts/github/runner/disk_pressure_report.sh START

      - name: 🔍 Resolve buildkit image ref
        id: buildkit
        shell: bash
        run: |
          set -euo pipefail
          ref="$(bash scripts/meta/resolve/image/service_ref.sh svc-runner buildkit mirror)"
          echo "ref=${ref}" >> "$GITHUB_OUTPUT"

      - name: ⬇️ Pre-pull buildkit image (retry 7x, 20s)
        shell: bash
        env:
          MAX_ATTEMPTS: "7"
          RETRY_DELAY_SECONDS: "20"
        run: bash scripts/github/runner/pull_with_retry.sh "${{ steps.buildkit.outputs.ref }}"

      - name: 🔧 Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
        with:
          driver-opts: image=${{ steps.buildkit.outputs.ref }}

      - name: 🔑 Login to GHCR
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: 💽 Disk pressure (pre-build)
        shell: bash
        run: bash scripts/github/runner/disk_pressure_report.sh PRE-BUILD

      - name: 🔍 Resolve repository owner
        id: owner
        shell: bash
        run: |
          set -euo pipefail
          echo "owner=$(scripts/meta/resolve/repository/owner.sh)" >> "$GITHUB_OUTPUT"
          echo "name=$(scripts/meta/resolve/repository/name.sh)" >> "$GITHUB_OUTPUT"

      - name: 🔨 Build & push every distro (retry 7x, 20s)
        if: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) }}
        shell: bash
        env:
          GITHUB_REPOSITORY_OWNER: ${{ steps.owner.outputs.owner }}
          BUILD_CONTEXT_DIR: _src
          INFINITO_DISTROS: ${{ join(fromJson(steps.out.outputs.matrix), ' ') }}
          IMAGE_TAG: ${{ steps.out.outputs.image_tag }}
          USE_NIX_TOKEN: ${{ !(github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository) }}
          NIX_GITHUB_TOKEN: ${{ github.token }}
          MAX_ATTEMPTS: "7"
          RETRY_DELAY_SECONDS: "20"
        run: ./scripts/image/push_all.sh

      - name: ⏳ Assert every distro image is in the registry
        shell: bash
        env:
          REGISTRY: ghcr.io
          OWNER: ${{ steps.owner.outputs.owner }}
          REPO_PREFIX: ${{ steps.owner.outputs.name }}
          CI_TAG: ${{ steps.out.outputs.image_tag }}
          INFINITO_DISTROS: ${{ join(fromJson(steps.out.outputs.matrix), ' ') }}
          WAIT_ATTEMPTS: "90"
          WAIT_SLEEP_SECONDS: "10"
        run: ./scripts/meta/wait/ci_images.sh

      - name: 📤 Upload per-distro build logs
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: image-build-logs
          path: build/image-logs/
          retention-days: 7
          if-no-files-found: ignore

      - name: 💽 Disk pressure (post-build)
        if: always()
        shell: bash
        run: bash scripts/github/runner/disk_pressure_report.sh POST-BUILD

      - name: 🧹 Cleanup (always)
        if: always()
        shell: bash
        run: bash scripts/github/runner/cleanup_docker.sh