diff --git a/.github/workflows/docker-release-split.yml b/.github/workflows/docker-release-split.yml index c05cc4b..57d1847 100644 --- a/.github/workflows/docker-release-split.yml +++ b/.github/workflows/docker-release-split.yml @@ -46,10 +46,13 @@ name: Docker Release (split) # docker-release.yml for validation builds. Callers with single-platform # images should also stay on docker-release.yml — split buys nothing there. # -# Runners: amd64 defaults to a GitHub-hosted runner. arm64 defaults to -# ubuntu-24.04-arm, which is FREE ONLY FOR PUBLIC REPOS — private repos must -# pass their own label (org larger runners, or the self-hosted EKS/ARC runner -# labels) via `arm64-runner`. +# Runners: the legs default to the org's self-hosted EKS/ARC runner scale +# sets — pinpredict-dev (amd64) and pinpredict-dev-arm64 (arm64). With ARC +# the scale set name IS the runs-on label (scale sets take no extra labels). +# Same-VPC to ECR, so image pushes and registry-cache traffic stay local. +# Pass amd64-runner/arm64-runner to override — e.g. GitHub-hosted +# ubuntu-24.04 / ubuntu-24.04-arm (arm64 standard runners work in private +# repos since 2026-01, at 2 vCPU). on: workflow_call: @@ -75,15 +78,15 @@ on: type: number default: 4 amd64-runner: - description: "runs-on label for the linux/amd64 leg." + description: "runs-on label for the linux/amd64 leg. Defaults to the EKS/ARC amd64 scale set." required: false type: string - default: "ubuntu-24.04" + default: "pinpredict-dev" arm64-runner: - description: "runs-on label for the linux/arm64 leg. The default is free for PUBLIC repos only — private repos pass an org larger-runner or self-hosted (EKS/ARC) label." + description: "runs-on label for the linux/arm64 leg. Defaults to the EKS/ARC arm64 scale set." required: false type: string - default: "ubuntu-24.04-arm" + default: "pinpredict-dev-arm64" cache: description: "Layer-cache backend: gha (per-platform scope), registry (//buildcache: — repo must exist), or none." required: false diff --git a/README.md b/README.md index 4e67e24..2ec05a9 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ Why `.github` and not a dedicated `github-actions` repo: `.github` is *the* GitH | File | Purpose | |---|---| | `docker-release.yml` | Image build + release via [stevedore](https://github.com/blairham/stevedore), driven by the caller repo's `.stevedore.yaml` — **no `matrix` input**. Single job by design (pinpredict/.github#39): one runner + one BuildKit, so a build-once Dockerfile compiles once for every image. Version = highest `X.Y.Z` tag in the ECR repo + 1 (ECR is the version record — platform-gitops#1201, resolved by stevedore); advances the `refs/releases/image/` marker refs. No git tags or GitHub Releases. Optional `only` accepts comma-separated image ids or `all` for manual release pickers. Exports `STEVEDORE_CACHE_FROM/TO` (one `type=gha` scope) for configs that opt into layer caching. Notifies Dispatch once per **pushed** image from stevedore's release summary (`no-push` builds notify nothing). Optional `private-modules: true` mints a short-lived read-only `pinpredict-argocd` App token and exposes it as `GH_PRIVATE_TOKEN`, which the caller's `.stevedore.yaml` wires to a BuildKit `--secret` (`secrets: [{id: gh_token, env: GH_PRIVATE_TOKEN}]`) so a Dockerfile can `go mod download` a private pinpredict module (e.g. `github.com/pinpredict/ppkit`) without vendoring — the Docker analogue of `setup-go`'s `private-modules`; default false. Existing callers are pinned to `@pre-stevedore` (the frozen matrix implementation, which carried the same `private-modules` BuildKit-secret input) — see the tagging exception below. | -| `docker-release-split.yml` | Multi-arch variant of `docker-release.yml` for repos whose images list several `platforms:` — one **native-arch leg per platform, in parallel**, no QEMU (stevedore >= v0.0.10 split/merge, blairham/stevedore#15). A `plan` job pins the release set and versions once; each leg runs `release --only … --split ` on a runner of that arch, building **all** planned images on one BuildKit (the #39 build-once property, kept per platform) and pushing per-arch images untagged by digest; a `merge` job stitches the digests into tagged manifest lists, runs the release tail, advances marker refs, and notifies Dispatch. Merge refuses to publish while any platform lacks a digest, so a failed leg can't ship a partial image. `cache: gha` exports one scope per platform; `cache: registry` uses `//buildcache:` (repo must exist — best for heavy build stages like trading's .NET compile). `arm64-runner` must be set by private repos (the default `ubuntu-24.04-arm` is free for public repos only; pass the org larger-runner or EKS/ARC label). No `no-push` — validation builds stay on `docker-release.yml`. | +| `docker-release-split.yml` | Multi-arch variant of `docker-release.yml` for repos whose images list several `platforms:` — one **native-arch leg per platform, in parallel**, no QEMU (stevedore >= v0.0.10 split/merge, blairham/stevedore#15). A `plan` job pins the release set and versions once; each leg runs `release --only … --split ` on a runner of that arch, building **all** planned images on one BuildKit (the #39 build-once property, kept per platform) and pushing per-arch images untagged by digest; a `merge` job stitches the digests into tagged manifest lists, runs the release tail, advances marker refs, and notifies Dispatch. Merge refuses to publish while any platform lacks a digest, so a failed leg can't ship a partial image. `cache: gha` exports one scope per platform; `cache: registry` uses `//buildcache:` (repo must exist — best for heavy build stages like trading's .NET compile). Legs default to the EKS/ARC runner scale sets — `pinpredict-dev` (amd64) and `pinpredict-dev-arm64` (arm64); the scale set name is the `runs-on` label, and `amd64-runner`/`arm64-runner` override it (e.g. GitHub-hosted `ubuntu-24.04`/`ubuntu-24.04-arm`). No `no-push` — validation builds stay on `docker-release.yml`. | | `chart-release.yml` | Auto-discovers `charts/*/`, skips charts unchanged since their `refs/releases/chart/` marker ref, resolves the next version from the ECR OCI repo, packages, pushes (+ `X.Y.Z-` provenance alias), advances the marker, notifies Dispatch. No git tags or GitHub Releases. Optional `only` accepts comma-separated chart names for a targeted manual release. | | `tag-config.yml` | Tags merges to main that touch `.platform/services/.yaml` with `vX.Y.Z+` (per-service Kargo `-config` Warehouse freight), then dispatches `service-config-tag` to platform-gitops so missing pointer files get seeded. | | `actionlint.yml` | Lints GitHub Actions workflow YAML with [`actionlint`](https://github.com/rhysd/actionlint) at a pinned version. Self-runs on this repo when PRs/pushes touch `.github/workflows/**` or `actions/**/action.yml`; callers reuse it via `uses: pinpredict/.github/.github/workflows/actionlint.yml@main`. |