feature/add gh action to promote docker image to registry by rpmcginty · Pull Request #37 · AllenInstitute/aibs-informatics-aws-lambda

rpmcginty · 2026-04-01T18:28:09Z

What's in this Change?

Adds a new GitHub Actions workflow to build and publish a Docker image to GitHub Container Registry (GHCR), with publishing gated on successful completion of the existing “Build and Test” workflow for main and direct publishing for version tags / manual dispatch.

This will help simplify consuming the docker image directly instead of having to rebuild

Changes:

Introduces .github/workflows/publish_docker.yml to build and push a Docker image to ghcr.io.
Uses workflow_run to gate publishing on successful test workflow completion for main.
Adds Docker metadata-based tagging and GitHub Actions cache configuration for faster rebuilds.

Testing

Build step is included in PR checks (run only after build and test succeeds)

…of tests and simplify Docker image push conditions

codecov · 2026-04-01T18:29:06Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.79%. Comparing base (af2c23a) to head (ca4172e).
⚠️ Report is 10 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #37   +/-   ##
=======================================
  Coverage   90.79%   90.79%           
=======================================
  Files          26       26           
  Lines        1412     1412           
  Branches      131      131           
=======================================
  Hits         1282     1282           
  Misses         94       94           
  Partials       36       36

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

Pull request overview

Adds a new GitHub Actions workflow to build and publish a Docker image to GitHub Container Registry (GHCR), with publishing gated on successful completion of the existing “Build and Test” workflow for main and direct publishing for version tags / manual dispatch.

Changes:

Introduces .github/workflows/publish_docker.yml to build and push a Docker image to ghcr.io.
Uses workflow_run to gate publishing on successful test workflow completion for main.
Adds Docker metadata-based tagging and GitHub Actions cache configuration for faster rebuilds.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-01T18:34:44Z

+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4


For workflow_run events, actions/checkout defaults to the repository’s default branch HEAD at run time, not the SHA that was actually tested. This can result in publishing an image for a different commit than the one that triggered the successful “Build and Test” run. Consider checking out github.event.workflow_run.head_sha when github.event_name == 'workflow_run' (and falling back to github.sha for other triggers).

Suggested change

uses: actions/checkout@v4

uses: actions/checkout@v4

with:

ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}

will fix this

Copilot · 2026-04-01T18:34:45Z

+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=ref,event=branch
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha


Because this workflow is triggered via workflow_run, runs can complete out of order (an older main commit’s tests may finish after a newer one). With latest enabled on the default branch, a late publish from an older SHA can overwrite the latest tag with an older image. To avoid this, add a guard that only publishes latest (or publishes at all) when the workflow_run.head_sha matches the current HEAD of main (e.g., compare against refs/heads/main via git ls-remote/GitHub API), or otherwise skip/cancel stale runs.

I will add concurrency with cancel-in-progress set to true

…ts and skip image push for PRs

…mproved comments for clarity

…orkflow

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

njmei · 2026-04-01T19:17:54Z

+      # For workflow_run events, checkout the SHA that was actually tested,
+      # not the current HEAD (which may have moved). For other events, use github.sha.
+      - name: Checkout repository
+        uses: actions/checkout@v4


We may want to bump the version we use to the latest?

https://github.com/actions/checkout

njmei · 2026-04-01T19:18:33Z

+
+      # Buildx enables advanced features like caching and multi-platform builds.
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3


Same here, v4 looks to be newest?

https://github.com/docker/setup-buildx-action

sounds good

mardoum

Not sure but Allen repo auth step might not be necessary, either way probably doesn't hurt anything. Looks good.

mardoum · 2026-04-01T21:28:09Z

+concurrency:
+  group: docker-publish-${{ github.event.workflow_run.head_branch || github.ref_name }}
+  cancel-in-progress: true


I didn't know about this mechanism -- cool

mardoum · 2026-04-01T21:31:47Z

+      - name: Set up AllenInstitute Repo Authorization
+        uses: ./.github/actions/configure-org-repo-authorization
+        with:
+          token: ${{ secrets.AI_PACKAGES_TOKEN }}
+          ssh_private_key: ${{ secrets.AIBSGITHUB_PRIVATE_KEY }}


I didn't seem to need this when I wrote a similar workflow.

rpmcginty added 2 commits April 1, 2026 11:25

Add GitHub Action to build and publish Docker image to registry

8da1977

Refactor GitHub Actions workflow to trigger on successful completion …

0ee6191

…of tests and simplify Docker image push conditions

Renamed GH action and added comments for improved readability

9a8c7c8

rpmcginty requested a review from Copilot April 1, 2026 18:31

Copilot started reviewing on behalf of rpmcginty April 1, 2026 18:31 View session

Copilot AI reviewed Apr 1, 2026

View reviewed changes

rpmcginty added 3 commits April 1, 2026 11:34

Enhance GitHub Actions workflow to validate Dockerfile on pull reques…

adeb2da

…ts and skip image push for PRs

Refining Docker build workflow with optional SSH agent handling and i…

1302498

…mproved comments for clarity

Add concurrency control and improve checkout step in Docker publish w…

9d269bc

…orkflow

rpmcginty requested review from Copilot and njmei April 1, 2026 19:10

Copilot started reviewing on behalf of rpmcginty April 1, 2026 19:12 View session

Copilot AI reviewed Apr 1, 2026

View reviewed changes

Comment thread .github/workflows/publish_docker.yml

Comment thread .github/workflows/publish_docker.yml

njmei reviewed Apr 1, 2026

View reviewed changes

upgrade gh actions

ca4172e

rpmcginty requested a review from njmei April 1, 2026 19:34

mardoum approved these changes Apr 1, 2026

View reviewed changes

njmei approved these changes Apr 1, 2026

View reviewed changes

rpmcginty merged commit 90ab548 into main Apr 1, 2026
9 checks passed

rpmcginty deleted the feature/add-gh-action-to-promote-docker-image-to-registry branch April 1, 2026 22:58

Conversation

rpmcginty commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What's in this Change?

Testing

Uh oh!

codecov Bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

rpmcginty Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

rpmcginty Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

njmei Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

njmei Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

rpmcginty Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

mardoum left a comment

Choose a reason for hiding this comment

Uh oh!

mardoum Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

mardoum Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rpmcginty commented Apr 1, 2026 •

edited

Loading

codecov Bot commented Apr 1, 2026 •

edited

Loading