build-sandboxes.yml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Build Sandbox Images

on:
  push:
    branches: [main]
    paths:
      - "sandboxes/**"
  pull_request:
    branches: [main]
    paths:
      - "sandboxes/**"
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  IMAGE_PREFIX: ${{ github.repository }}

permissions:
  contents: read
  packages: write

jobs:
  # ---------------------------------------------------------------------------
  # Detect which sandbox images have changed
  # ---------------------------------------------------------------------------
  detect-changes:
    name: Detect changed sandboxes
    runs-on: ubuntu-latest
    outputs:
      base-changed: ${{ steps.changes.outputs.base_changed }}
      sandboxes: ${{ steps.changes.outputs.sandboxes }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Determine changed sandboxes
        id: changes
        run: |
          set -euo pipefail

          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            # Build everything on manual trigger
            BASE_CHANGED="true"
            SANDBOXES=$(find sandboxes -mindepth 1 -maxdepth 1 -type d -name '*.base' -prune -o -exec test -f {}/Dockerfile \; -print \
              | xargs -I{} basename {} \
              | grep -v '^base$' \
              | jq -R -s -c 'split("\n") | map(select(length > 0))')
          else
            if [ "${{ github.event_name }}" = "pull_request" ]; then
              BASE_SHA="${{ github.event.pull_request.base.sha }}"
            else
              BASE_SHA="${{ github.event.before }}"
            fi

            CHANGED=$(git diff --name-only "$BASE_SHA" "${{ github.sha }}" -- sandboxes/)

            # Check if base changed
            if echo "$CHANGED" | grep -q '^sandboxes/base/'; then
              BASE_CHANGED="true"
              # When base changes, rebuild all sandboxes that have a Dockerfile
              SANDBOXES=$(find sandboxes -mindepth 1 -maxdepth 1 -type d -exec test -f {}/Dockerfile \; -print \
                | xargs -I{} basename {} \
                | grep -v '^base$' \
                | jq -R -s -c 'split("\n") | map(select(length > 0))')
            else
              BASE_CHANGED="false"
              SANDBOXES=$(echo "$CHANGED" \
                | cut -d'/' -f2 \
                | sort -u \
                | while read -r name; do
                    if [ "$name" != "base" ] && [ -f "sandboxes/${name}/Dockerfile" ]; then echo "$name"; fi
                  done \
                | jq -R -s -c 'split("\n") | map(select(length > 0))')
            fi
          fi

          echo "base_changed=${BASE_CHANGED}" >> "$GITHUB_OUTPUT"
          echo "sandboxes=${SANDBOXES}" >> "$GITHUB_OUTPUT"
          echo "Base changed: ${BASE_CHANGED}"
          echo "Will build: ${SANDBOXES}"

  # ---------------------------------------------------------------------------
  # Build the base sandbox image (other sandboxes depend on this)
  # ---------------------------------------------------------------------------
  build-base:
    name: Build base
    needs: detect-changes
    if: needs.detect-changes.outputs.base-changed == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Lowercase image prefix
        id: repo
        run: echo "image_prefix=${IMAGE_PREFIX,,}" >> "$GITHUB_OUTPUT"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate image metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ steps.repo.outputs.image_prefix }}/sandboxes/base
          tags: |
            type=sha,prefix=
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: sandboxes/base
          platforms: linux/amd64,linux/arm64
          push: ${{ github.ref == 'refs/heads/main' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=base
          cache-to: type=gha,mode=max,scope=base

  # ---------------------------------------------------------------------------
  # Build dependent sandbox images (after base completes)
  # ---------------------------------------------------------------------------
  build:
    name: Build ${{ matrix.sandbox }}
    needs: [detect-changes, build-base]
    if: |
      always() &&
      needs.detect-changes.result == 'success' &&
      (needs.build-base.result == 'success' || needs.build-base.result == 'skipped') &&
      needs.detect-changes.outputs.sandboxes != '[]'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        sandbox: ${{ fromJson(needs.detect-changes.outputs.sandboxes) }}
    steps:
      - uses: actions/checkout@v4

      - name: Lowercase image prefix
        id: repo
        run: echo "image_prefix=${IMAGE_PREFIX,,}" >> "$GITHUB_OUTPUT"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      # On PRs, use a local registry so the base image built in this job is
      # accessible to the subsequent buildx build (docker-container driver
      # cannot see images loaded into the host daemon).
      - name: Start local registry (PR only)
        if: github.ref != 'refs/heads/main'
        run: docker run -d -p 5000:5000 --name registry registry:2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: ${{ github.ref != 'refs/heads/main' && 'network=host' || '' }}

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Determine parent sandbox
        id: parent
        run: |
          set -euo pipefail
          DOCKERFILE="sandboxes/${{ matrix.sandbox }}/Dockerfile"
          DEFAULT_BASE=""
          if grep -q '^ARG BASE_IMAGE=' "$DOCKERFILE"; then
            DEFAULT_BASE=$(grep '^ARG BASE_IMAGE=' "$DOCKERFILE" | head -1 | cut -d= -f2-)
          fi

          PARENT=""
          if [ -n "$DEFAULT_BASE" ]; then
            PARENT=$(echo "$DEFAULT_BASE" | sed -n 's|.*/sandboxes/\([^:]*\).*|\1|p')
            if [ -z "$PARENT" ]; then
              PARENT="base"
            fi
          fi

          echo "sandbox=$PARENT" >> "$GITHUB_OUTPUT"
          if [ -n "$PARENT" ]; then
            echo "Parent for ${{ matrix.sandbox }}: $PARENT"
          else
            echo "${{ matrix.sandbox }} is a standalone sandbox image"
          fi

      # On PRs the base image is not in GHCR. Build it locally, push to the
      # local registry, and override BASE_IMAGE to point there for dependent
      # sandbox images. Standalone images do not need this step.
      - name: Build base image locally (PR only)
        if: github.ref != 'refs/heads/main' && steps.parent.outputs.sandbox != ''
        uses: docker/build-push-action@v6
        with:
          context: sandboxes/base
          push: true
          tags: localhost:5000/sandboxes/base:latest
          cache-from: type=gha,scope=base

      # When a sandbox depends on another sandbox (not base), build that
      # intermediate parent locally so it is available to the buildx build.
      - name: Build parent sandbox locally (PR only)
        if: github.ref != 'refs/heads/main' && steps.parent.outputs.sandbox != '' && steps.parent.outputs.sandbox != 'base'
        uses: docker/build-push-action@v6
        with:
          context: sandboxes/${{ steps.parent.outputs.sandbox }}
          push: true
          tags: localhost:5000/sandboxes/${{ steps.parent.outputs.sandbox }}:latest
          build-args: |
            BASE_IMAGE=localhost:5000/sandboxes/base:latest
          cache-from: type=gha,scope=${{ steps.parent.outputs.sandbox }}

      - name: Set BASE_IMAGE
        id: base
        run: |
          PARENT="${{ steps.parent.outputs.sandbox }}"
          if [ -z "$PARENT" ]; then
            echo "image=" >> "$GITHUB_OUTPUT"
          elif [ "${{ github.ref }}" = "refs/heads/main" ]; then
            echo "image=${{ env.REGISTRY }}/${{ steps.repo.outputs.image_prefix }}/sandboxes/${PARENT}:latest" >> "$GITHUB_OUTPUT"
          else
            echo "image=localhost:5000/sandboxes/${PARENT}:latest" >> "$GITHUB_OUTPUT"
          fi

      - name: Generate image metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ steps.repo.outputs.image_prefix }}/sandboxes/${{ matrix.sandbox }}
          tags: |
            type=sha,prefix=
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Set build platforms
        id: platforms
        run: |
          if [ "${{ github.ref }}" = "refs/heads/main" ] || [ "${{ matrix.sandbox }}" = "nvidia-gpu" ]; then
            echo "value=linux/amd64,linux/arm64" >> "$GITHUB_OUTPUT"
          else
            echo "value=linux/amd64" >> "$GITHUB_OUTPUT"
          fi

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: sandboxes/${{ matrix.sandbox }}
          platforms: ${{ steps.platforms.outputs.value }}
          push: ${{ github.ref == 'refs/heads/main' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            BASE_IMAGE=${{ steps.base.outputs.image }}
          cache-from: type=gha,scope=${{ matrix.sandbox }}
          cache-to: type=gha,mode=max,scope=${{ matrix.sandbox }}