@norskvideo/ctl-dev-kit 0.1.27 → 0.1.28

package/conventions/build-image.yml

@@ -1,21 +1,43 @@
-# Build the product image on every push to main (and on demand), on the org's
-# self-hosted x64 pool inside `nix develop` (bun + cargo/rustc from flake.nix).
-# Proves the repo builds standalone against the published @norskvideo/ctl-* +
-# @norskvideo/norsk-* packages. A deployed product sets PUBLISH_IMAGE to its
-# Docker Hub repo (norskvideo org) and the built image is pushed there; a product
-# with an empty PUBLISH_IMAGE builds as a standalone-build proof only and
-# publishes nothing. Single-sourced in @norskvideo/ctl-dev-kit
-# (conventions/build-image.yml) and drift-gated — edit the dev-kit source, never
-# the copy. Only the PUBLISH_IMAGE env and the notify job's product: key are
-# per-repo. Single-arch (amd64) to start; multi-arch is a follow-up. Repo-local
-# for now; to be hoisted into id3as/ci-workflows as a reusable workflow
-# (RFC 0001 Workstream E).
+# Build + publish a PRODUCT container image, multi-arch (linux/amd64 +
+# linux/arm64), to Docker Hub. Single-sourced in @norskvideo/ctl-dev-kit
+# (conventions/build-image.yml) and drift-gated -- edit the dev-kit source, never
+# the copy.
+#
+# Multi-arch house style: native build per arch (no QEMU), each arch pushes its
+# own `:<label>-<arch>` tag to Docker Hub, then a publish job combines them with
+# `docker buildx imagetools create` into the multi-arch manifest. Each publish
+# writes two tags:
+#   <repo>:<label>    immutable, label = YYYY-MM-DD-<sha8> (what deployments pin)
+#   <repo>:<channel>  moving (latest | rc | nightly)
+#
+# The one per-repo value is the masked PUBLISH_IMAGE env: set to a product's
+# Docker Hub repo (norskvideo org) it builds + publishes both arches; left empty
+# the build runs as a standalone-build proof (both arches) and publishes nothing
+# -- for a product that is not deployed yet.
+#
+# CHANNEL: push-to-main publishes `latest` (matches the retired in-monorepo
+# pipeline, so :latest + the dated tags stay fresh for installers/deployments).
+# workflow_dispatch can publish any channel. When the product channel model
+# (rc -> latest promotion) lands, flip the push default to `nightly` and let the
+# promotion gate move `latest`.
+#
+# Repo-local for now; to be hoisted into id3as/ci-workflows as a reusable
+# workflow (RFC 0001 Workstream E).
 name: build-image
 
 on:
   push:
     branches: [main]
   workflow_dispatch:
+    inputs:
+      channel:
+        description: "Moving channel tag to publish (latest | rc | nightly)."
+        type: string
+        default: latest
+      dry_run:
+        description: "Build + stage both arches, skip the Docker Hub publish."
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -32,10 +54,44 @@ env:
   PUBLISH_IMAGE: ""
 
 jobs:
-  build:
+  # Compute the immutable label ONCE, so both arch builds and the manifest share
+  # it (a per-job `date` could straddle midnight and disagree).
+  label:
     runs-on: x64
+    outputs:
+      label: ${{ steps.gen.outputs.label }}
+      channel: ${{ steps.gen.outputs.channel }}
+      # `publish` is derived here (in a step, where the env context is readable)
+      # because the env context is NOT available in a job-level `if:` -- the
+      # publish job gates on this output instead of on PUBLISH_IMAGE directly.
+      publish: ${{ steps.gen.outputs.publish }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          clean: false
+      - id: gen
+        run: |
+          label="$(date -u +%Y-%m-%d)-$(git rev-parse --short=8 HEAD)"
+          channel="${{ github.event.inputs.channel || 'latest' }}"
+          if [ -n "${PUBLISH_IMAGE}" ]; then publish=true; else publish=false; fi
+          echo "label=${label}" >> "$GITHUB_OUTPUT"
+          echo "channel=${channel}" >> "$GITHUB_OUTPUT"
+          echo "publish=${publish}" >> "$GITHUB_OUTPUT"
+          echo "label=${label} channel=${channel} publish=${publish}"
+
+  build:
+    needs: label
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: x64
+            arch: amd64
+          - runner: ar-arm-vm
+            arch: arm64
+    runs-on: ${{ matrix.runner }}
     steps:
-      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
+      # clean: false -- the integration suite (shared pool) leaves root-owned
       # bind-mount dirs under test-temp/ that a non-root git clean can't remove
       # (EACCES). This job never needs them; skip the clean so it doesn't choke on
       # another workflow's leftovers.
@@ -43,12 +99,12 @@ jobs:
         with:
           clean: false
 
-      - name: Build product image (copy-only, via the dev-kit driver)
+      - name: Build product image (copy-only, via the dev-kit driver, native ${{ matrix.arch }})
         run: |
           if [ -n "${PUBLISH_IMAGE}" ]; then
-            IMAGE_TAG="${PUBLISH_IMAGE}:${{ github.sha }}"
+            IMAGE_TAG="${PUBLISH_IMAGE}:${{ needs.label.outputs.label }}-${{ matrix.arch }}"
           else
-            IMAGE_TAG="norsk-ctl-product:${{ github.sha }}"
+            IMAGE_TAG="norsk-ctl-product:${{ needs.label.outputs.label }}-${{ matrix.arch }}"
           fi
           echo "IMAGE_TAG=${IMAGE_TAG}" >> "$GITHUB_ENV"
           export IMAGE_TAG
@@ -65,26 +121,51 @@ jobs:
           username: norskvideo
           password: ${{ secrets.DOCKER_PAT }}
 
-      - name: Push image to Docker Hub
+      - name: Push the per-arch image to Docker Hub
         if: ${{ env.PUBLISH_IMAGE != '' }}
+        run: docker push "$IMAGE_TAG"
+
+  # Combine the per-arch images into a multi-arch manifest and write the two
+  # published tags. Skipped for a build-only product (empty PUBLISH_IMAGE) and on
+  # a dry run.
+  publish:
+    needs: [label, build]
+    if: ${{ needs.label.outputs.publish == 'true' && !inputs.dry_run }}
+    runs-on: x64
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          clean: false
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        with:
+          username: norskvideo
+          password: ${{ secrets.DOCKER_PAT }}
+
+      - name: Create + push the multi-arch manifest (dated label + channel)
         run: |
-          docker tag "$IMAGE_TAG" "${PUBLISH_IMAGE}:main"
-          docker push "$IMAGE_TAG"
-          docker push "${PUBLISH_IMAGE}:main"
+          label="${{ needs.label.outputs.label }}"
+          channel="${{ needs.label.outputs.channel }}"
+          # buildx imagetools create, not `docker manifest create`: the arm64
+          # runner's containerd image store pushes single-arch images wrapped in
+          # an OCI index, which `docker manifest create` refuses to nest. imagetools
+          # accepts index sources and writes every -t tag in one push.
+          docker buildx imagetools create \
+            -t "${PUBLISH_IMAGE}:${label}" \
+            -t "${PUBLISH_IMAGE}:${channel}" \
+            "${PUBLISH_IMAGE}:${label}-amd64" \
+            "${PUBLISH_IMAGE}:${label}-arm64"
 
   # Report this pipeline's result to the aggregated product CI dashboard
-  # (id3as/ci-workflows) instead of posting its own pony — the dashboard renders
+  # (id3as/ci-workflows) instead of posting its own pony -- the dashboard renders
   # the pony/emoji from the dispatched result. always() so a red or manual run
   # still reports.
   notify:
-    needs: build
+    needs: [build, publish]
     if: ${{ !cancelled() }}
     runs-on: x64
     steps:
-      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
-      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
-      # (EACCES). This job never needs them; skip the clean so it doesn't choke on
-      # another workflow's leftovers.
       - uses: actions/checkout@v5
         with:
           clean: false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.1.27",
+  "version": "0.1.28",
   "type": "module",
   "exports": {
     "./package.json": "./package.json",