From 18759b533f7f4c9017483ad0e99b66100fd5b853 Mon Sep 17 00:00:00 2001 From: Miguel Pena Date: Tue, 19 May 2026 20:40:21 -0700 Subject: [PATCH 1/2] ci updates --- .github/workflows/ngwpc-cicd.yml | 45 +++++++++++++++++++++++--------- Dockerfile | 10 ++++--- 2 files changed, 39 insertions(+), 16 deletions(-) diff --git a/.github/workflows/ngwpc-cicd.yml b/.github/workflows/ngwpc-cicd.yml index cd2094962a..fcb8be7b4c 100644 --- a/.github/workflows/ngwpc-cicd.yml +++ b/.github/workflows/ngwpc-cicd.yml @@ -81,6 +81,7 @@ jobs: clean_ref: ${{ steps.vars.outputs.clean_ref }} ngen_forcing_digest: ${{ steps.vars.outputs.ngen_forcing_digest }} ngen_forcing_revision: ${{ steps.vars.outputs.ngen_forcing_revision }} + ewts_revision: ${{ steps.vars.outputs.ewts_revision }} steps: - name: Compute image vars id: vars @@ -139,20 +140,37 @@ jobs: # base image (ngen-forcing) metadata for ngen Dockerfile labels NGEN_FORCING_IMAGE_TAG="${{ inputs.NGEN_FORCING_IMAGE_TAG || 'latest' }}" NGEN_FORCING_IMAGE="ghcr.io/${ORG}/ngen-bmi-forcing:${NGEN_FORCING_IMAGE_TAG}" - NGEN_FORCING_INSPECT=$(skopeo inspect "docker://${NGEN_FORCING_IMAGE}" 2>/dev/null || echo '{}') + NGEN_FORCING_INSPECT=$(skopeo inspect --override-os linux --override-arch amd64 "docker://${NGEN_FORCING_IMAGE}" 2>/dev/null || echo '{}') NGEN_FORCING_DIGEST=$(echo "$NGEN_FORCING_INSPECT" | jq -r '.Digest // "unknown"') NGEN_FORCING_REVISION=$(echo "$NGEN_FORCING_INSPECT" | jq -r '.Labels["org.opencontainers.image.revision"] // "unknown"') + # resolve each source repo's ref (branch/tag/SHA) to its commit SHA for revision labels + resolve_sha() { + local url="$1" ref="$2" out sha + # a full 40-char SHA can't be looked up via ls-remote; use it directly + if [[ "$ref" =~ ^[0-9a-f]{40}$ ]]; then echo "$ref"; return; fi + out=$(git ls-remote "$url" "$ref" "refs/tags/${ref}^{}" 2>/dev/null) + # prefer the dereferenced commit (^{}) for annotated tags; else first match + sha=$(echo "$out" | grep '\^{}$' | head -n1 | cut -f1) + [ -z "$sha" ] && sha=$(echo "$out" | head -n1 | cut -f1) + echo "${sha:-unknown}" + } + + EWTS_REVISION=$(resolve_sha "https://github.com/${{ inputs.EWTS_ORG || github.repository_owner }}/nwm-ewts.git" "${{ inputs.EWTS_REF || 'development' }}") + # save outputs - echo "org=${ORG}" >> "$GITHUB_OUTPUT" - echo "image_base=${IMAGE_BASE}" >> "$GITHUB_OUTPUT" - echo "test_image_tag=${TEST_TAG}" >> "$GITHUB_OUTPUT" - echo "alias_tag=${ALIAS}" >> "$GITHUB_OUTPUT" - echo "commit_sha=${REAL_SHA}" >> "$GITHUB_OUTPUT" - echo "commit_sha_short=${SHORT_SHA}" >> "$GITHUB_OUTPUT" - echo "clean_ref=${CLEAN_REF}" >> "$GITHUB_OUTPUT" - echo "ngen_forcing_digest=${NGEN_FORCING_DIGEST}" >> "$GITHUB_OUTPUT" - echo "ngen_forcing_revision=${NGEN_FORCING_REVISION}" >> "$GITHUB_OUTPUT" + cat >> "$GITHUB_OUTPUT" < Date: Tue, 19 May 2026 21:32:07 -0700 Subject: [PATCH 2/2] ci updates --- .github/workflows/ngwpc-cicd.yml | 29 ++++++++++++++++++-------- Dockerfile.test | 35 -------------------------------- 2 files changed, 21 insertions(+), 43 deletions(-) delete mode 100644 Dockerfile.test diff --git a/.github/workflows/ngwpc-cicd.yml b/.github/workflows/ngwpc-cicd.yml index fcb8be7b4c..07f7f8c80f 100644 --- a/.github/workflows/ngwpc-cicd.yml +++ b/.github/workflows/ngwpc-cicd.yml @@ -79,6 +79,7 @@ jobs: test_image_tag: ${{ steps.vars.outputs.test_image_tag }} alias_tag: ${{ steps.vars.outputs.alias_tag }} clean_ref: ${{ steps.vars.outputs.clean_ref }} + default_ref: ${{ steps.vars.outputs.default_ref }} ngen_forcing_digest: ${{ steps.vars.outputs.ngen_forcing_digest }} ngen_forcing_revision: ${{ steps.vars.outputs.ngen_forcing_revision }} ewts_revision: ${{ steps.vars.outputs.ewts_revision }} @@ -113,6 +114,18 @@ jobs: CLEAN_REF=$(echo "$REAL_REF" | tr '[:upper:]' '[:lower:]' | sed 's/\//-/g') SHORT_SHA="${REAL_SHA:0:7}" + # default source-repo ref: follow the release-line branch we're building from + # (development / ngwpc-candidate / ngwpc-release); tags and other branches fall + # back to development. Override per source repo via the *_REF dispatch inputs. + case "${GITHUB_REF_TYPE}:${GITHUB_REF_NAME}" in + branch:development|branch:ngwpc-candidate|branch:ngwpc-release) + DEFAULT_REF="$GITHUB_REF_NAME" ;; + *) + DEFAULT_REF="development" ;; + esac + # use an explicit *_REF input if provided, else DEFAULT_REF + ref_or_default() { [ -n "$1" ] && echo "$1" || echo "$DEFAULT_REF"; } + # logic for the tags: # test_image_tag (commit short sha): used for the initial build and test # alias_tag: used for final tagging on successful tests @@ -156,7 +169,7 @@ jobs: echo "${sha:-unknown}" } - EWTS_REVISION=$(resolve_sha "https://github.com/${{ inputs.EWTS_ORG || github.repository_owner }}/nwm-ewts.git" "${{ inputs.EWTS_REF || 'development' }}") + EWTS_REVISION=$(resolve_sha "https://github.com/${{ inputs.EWTS_ORG || github.repository_owner }}/nwm-ewts.git" "$(ref_or_default "${{ inputs.EWTS_REF }}")") # save outputs cat >> "$GITHUB_OUTPUT" < /build_info.txt - -# Add a timestamp so every build layer looks slightly different (optional, forces fresh hash) -ARG BUILD_DATE -RUN echo "Built on $BUILD_DATE" >> /build_info.txt - -CMD ["cat", "/build_info.txt"]