ci(docker): publish arm64, drop per-commit tags, prune untagged versions - #79
Open
aivuk wants to merge 1 commit into
Open
ci(docker): publish arm64, drop per-commit tags, prune untagged versions#79aivuk wants to merge 1 commit into
aivuk wants to merge 1 commit into
Conversation
The published image was linux/amd64 only, so every Apple Silicon user ran GUIbiont under qemu — a heavy penalty for Julia numerics. Build each arch on its own native runner (free for public repos) and join the two by digest into one manifest list. Package storage was also unbounded: type=sha minted a permanent sha-<short> tag on every push to main, 25 by v1.1.0, none of them referenced by run.sh and each holding ~1 GB of layers. Drop that tag rule — the commit is still on the image as org.opencontainers.image.revision, and any build stays addressable by digest — and prune untagged versions left behind by the digest-based push.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three fixes to how
ghcr.io/pinheirogroup/guibiontis built and stored.1. arm64 is now published
The image was
linux/amd64only, so every Apple Silicon Mac ran GUIbiont under qemu emulation — a large penalty for a Julia numerics workload, and likely a good share of the user base.julia:1.12-bookwormalready publisheslinux/arm64/v8and the Dockerfile is arch-neutral, so no image changes were needed. Each architecture builds on its own native runner (ubuntu-24.04-armis free for public repos, so this avoids emulated build time) and pushes an untagged digest; amergejob joins the digests into one manifest list carryinglatest/v*.2. Per-commit tags no longer accumulate
type=shaminted a permanentsha-<short>tag on every push tomain— 25 of the package's 27 tags by v1.1.0, none referenced byrun.sh/run.ps1, each pinning ~1 GB of layers in package storage forever.Dropped that tag rule. Traceability is preserved: the commit is still on the image as
org.opencontainers.image.revision, and any build stays addressable by digest.3. Untagged versions are pruned
The digest-based push in (1) leaves the per-arch images and their attestations as untagged package versions, which would otherwise pile up one build at a time. A
cleanupjob prunes them withdelete-only-untagged-versions: true, so tagged versions (latest,v*) are never touched.min-versions-to-keep: 20is a safety margin rather than a target — the untagged versions backing the current manifest list must survive or:latestbreaks. One build produces roughly four (two arches + two attestations), so 20 leaves about five builds of headroom.Test plan
actionlintcleanjulia:1.12-bookwormpublisheslinux/arm64/v8docker.ymlonly triggers on push tomain, so this PR does not exercise it. First run after merge should be watched.docker buildx imagetools inspect ghcr.io/pinheirogroup/guibiont:latestshows bothlinux/amd64andlinux/arm64Not included
The 25 existing
sha-*tags are untouched — this stops the bleeding but does not clean up history. Deleting published versions is destructive and irreversible, so it is left as a deliberate manual step.