minke.yu/sglang
1
0
Fork 0
Code Issues Pull Requests Actions 12 Packages Projects Releases Wiki Activity

[CI] Build patched Docker images for both amd64 and arm64 (#34276)

Browse Source
This commit is contained in:
Liangsheng Yin
2026-08-10 04:49:22 -07:00
committed by GitHub
parent 01a2ef95b8
commit 4eaaeda004
1 changed files with 99 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/patch-docker-dev.yml
+99 -61
View File
@@ -4,18 +4,19 @@ on:
workflow_dispatch:
inputs:
pr_numbers:
description: "Comma-separated PR numbers to apply (e.g. 18962,19010). Empty = fast-forward the base image to latest main."
description: "Comma-separated PR numbers, merged in the order listed (e.g. 18962,19010). Empty = fast-forward the base image to latest main."
required: false
default: ""
image_tag:
description: "Base image tag to patch (e.g. dev, dev-cu13, dev-cu12)"
required: true
output_tag:
description: "Tag to publish as. Must start with 'patch-' (e.g. patch-myfeature)."
description: "Tag to publish as. Overwrites it if it already exists."
required: true
concurrency:
group: patch-docker-${{ inputs.image_tag }}-${{ inputs.output_tag }}
# Keyed on the tag being written, which is the only resource two runs contend for.
group: patch-docker-${{ inputs.output_tag }}
cancel-in-progress: true
jobs:
@@ -42,18 +43,6 @@ jobs:
validate_tag image_tag "${IMAGE_TAG}"
validate_tag output_tag "${OUTPUT_TAG}"
# Released tags belong to release-docker*.yml, which builds them as
# multi-arch manifests. This job is x64-only, so it publishes under a
# prefix those builders never emit rather than denylisting their
# current names, which would rot as the release tag scheme changes.
case "${OUTPUT_TAG}" in
patch-?*) ;;
*)
echo "::error::output_tag must start with 'patch-' (e.g. patch-myfeature)"
exit 1
;;
esac
echo "BASE_IMAGE=lmsysorg/sglang:${IMAGE_TAG}" >> "$GITHUB_ENV"
echo "OUT_IMAGE=lmsysorg/sglang:${OUTPUT_TAG}" >> "$GITHUB_ENV"
@@ -65,92 +54,130 @@ jobs:
with:
fetch-depth: 0
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Login to Docker Hub
uses: docker/login-action@v2
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Pull base image and extract commit
- name: Extract base commit
run: |
docker pull "${BASE_IMAGE}"
if BASE_SHA=$(docker run --rm "${BASE_IMAGE}" git -C /sgl-workspace/sglang rev-parse HEAD 2>/dev/null); then
echo "Image built from commit: ${BASE_SHA}"
else
BASE_SHA=""
echo "::warning::Image has no .git directory - cannot extract base commit"
# --entrypoint skips the CUDA base image's banner, which goes to
# stdout and would otherwise be captured as part of the SHA.
BASE_SHA=$(docker run --rm --entrypoint git "${BASE_IMAGE}" \
-C /sgl-workspace/sglang rev-parse HEAD 2>/dev/null | tail -n 1)
# A banner line reaching GITHUB_ENV breaks the step, as above.
case "${BASE_SHA}" in *[!0-9a-f]*) BASE_SHA="" ;; esac
[ "${#BASE_SHA}" -eq 40 ] || BASE_SHA=""
if [ -z "${BASE_SHA}" ]; then
echo "::error::Cannot read the base commit of ${BASE_IMAGE}; the patch is computed against it"
exit 1
fi
echo "Image built from commit: ${BASE_SHA}"
echo "BASE_SHA=${BASE_SHA}" >> "$GITHUB_ENV"
# Pulled only for the rev-parse above; buildx pulls the base itself.
docker image rm "${BASE_IMAGE}" || true
- name: Generate patches
- name: Generate patch
env:
PR_NUMBERS: ${{ inputs.pr_numbers }}
run: |
git config --global --add safe.directory "$GITHUB_WORKSPACE"
git fetch origin main
# Fixed path on a persistent runner: drop patches left by prior runs
# so they cannot be picked up by this run's COPY *.patch.
rm -rf /tmp/patch-ctx
mkdir -p /tmp/patch-ctx
git fetch origin "${BASE_SHA}"
# Per-run paths: the concurrency group keys on output_tag, so two runs
# with different tags can land on this runner at the same time.
WORK="/tmp/patch-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
rm -rf "${WORK}"
mkdir -p "${WORK}/ctx"
git worktree prune
# Merge onto the image's own commit so the patch context matches the
# image tree exactly and cannot drift. Conflicts then surface here in
# seconds instead of failing the build after a multi-GB pull.
git worktree add --detach "${WORK}/base-tree" "${BASE_SHA}"
echo "PATCH_CTX=${WORK}/ctx" >> "$GITHUB_ENV"
# -c rather than --global: leave no identity behind on the runner.
merge_into_base() {
git -C "${WORK}/base-tree" \
-c user.email=ci@sglang.local -c user.name="sglang CI" \
merge --no-edit "$1"
}
if [ -n "${PR_NUMBERS}" ]; then
IFS=',' read -ra PRS <<< "${PR_NUMBERS}"
for pr in "${PRS[@]}"; do
pr=$(echo "${pr}" | xargs)
echo "Fetching PR #${pr}"
case "${pr}" in
""|*[!0-9]*)
echo "::error::'${pr}' is not a PR number"
exit 1
;;
esac
echo "Merging PR #${pr}"
git fetch origin "pull/${pr}/head:pr-${pr}"
MERGE_BASE=$(git merge-base origin/main "pr-${pr}")
echo " PR #${pr}: merge-base=${MERGE_BASE}"
git diff "${MERGE_BASE}..pr-${pr}" > "/tmp/patch-ctx/${pr}.patch"
echo " PR #${pr}: $(wc -l < /tmp/patch-ctx/${pr}.patch) lines"
merge_into_base "pr-${pr}" || {
echo "::error::PR #${pr} conflicts with base image commit ${BASE_SHA}"
git -C "${WORK}/base-tree" diff --name-only --diff-filter=U
exit 1
}
done
elif [ -n "${BASE_SHA}" ]; then
echo "Generating diff: image ${BASE_SHA} -> latest main"
git fetch origin "${BASE_SHA}"
git diff "${BASE_SHA}..origin/main" > /tmp/patch-ctx/main.patch
echo " main: $(wc -l < /tmp/patch-ctx/main.patch) lines"
else
echo "::error::No PR numbers specified and image has no .git - cannot generate diff against main"
exit 1
echo "Fast-forwarding to latest main"
merge_into_base origin/main || {
echo "::error::Cannot merge latest main into base image commit ${BASE_SHA}"
git -C "${WORK}/base-tree" diff --name-only --diff-filter=U
exit 1
}
fi
TOTAL=$(cat /tmp/patch-ctx/*.patch | wc -l)
if [ "${TOTAL}" -eq 0 ]; then
echo "::error::All patches are empty - nothing to apply on top of ${BASE_IMAGE}"
git -C "${WORK}/base-tree" diff --binary "${BASE_SHA}"..HEAD > "${WORK}/ctx/merged.patch"
if [ ! -s "${WORK}/ctx/merged.patch" ]; then
echo "::error::Patch is empty - nothing to apply on top of ${BASE_IMAGE}"
exit 1
fi
PATCH_STAT=$(git -C "${WORK}/base-tree" diff --shortstat "${BASE_SHA}"..HEAD | xargs)
echo "Patch: ${PATCH_STAT}"
echo "PATCH_STAT=${PATCH_STAT}" >> "$GITHUB_ENV"
- name: Build patched image
- name: Build and push patched image
run: |
cat <<'DOCKERFILE' > /tmp/patch-ctx/Dockerfile
cat <<'DOCKERFILE' > "${PATCH_CTX}/Dockerfile"
ARG BASE_IMAGE
FROM ${BASE_IMAGE}
COPY *.patch /tmp/patches/
COPY merged.patch /tmp/merged.patch
# git apply, not patch: no fuzz is needed given the exact context, and
# it handles renames, mode changes and binary files.
RUN cd /sgl-workspace/sglang \
&& for p in /tmp/patches/*.patch; do \
if [ ! -s "${p}" ]; then \
echo "Skipping ${p} (empty)"; \
else \
echo "Applying ${p}..." \
&& patch -p1 --fuzz=2 --no-backup-if-mismatch -f < "${p}" \
|| { echo "ERROR: Failed to apply ${p}"; exit 1; }; \
fi; \
done \
&& rm -rf /tmp/patches
&& git apply --binary -v -p1 /tmp/merged.patch \
&& rm -f /tmp/merged.patch \
&& python3 -m compileall -q -f python/sglang \
&& ( find python -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null || true )
DOCKERFILE
docker build \
# Each platform patches its own arch of the base manifest list, so the
# output stays a list. A single-arch base fails here on purpose: the
# output would not be pullable on the other arch.
docker buildx build \
--platform linux/amd64,linux/arm64 \
--no-cache \
--build-arg BASE_IMAGE="${BASE_IMAGE}" \
-t "${OUT_IMAGE}" \
/tmp/patch-ctx/
--push \
"${PATCH_CTX}/"
- name: Push patched image
- name: Write summary
env:
PR_NUMBERS: ${{ inputs.pr_numbers }}
run: |
docker push "${OUT_IMAGE}"
if [ -n "${PR_NUMBERS}" ]; then
SOURCE="PRs: ${PR_NUMBERS}"
else
@@ -159,7 +186,18 @@ jobs:
{
echo "### Patched \`${OUT_IMAGE}\`"
echo "- **Base image:** \`${BASE_IMAGE}\`"
echo "- **Base commit:** \`${BASE_SHA:-unknown (no .git)}\`"
echo "- **Base commit:** \`${BASE_SHA}\`"
echo "- **Source:** ${SOURCE}"
echo "- **Platform:** \`linux/amd64\` only - patched on an x64 runner, so the base image's multi-arch manifest is not carried over"
echo "- **Patch:** ${PATCH_STAT}"
echo "- **Platforms:** \`linux/amd64,linux/arm64\`"
} >> "$GITHUB_STEP_SUMMARY"
- name: Clean up
if: always()
run: |
# Per-run paths are never reclaimed by a later run, so drop them here.
WORK="/tmp/patch-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
git worktree remove --force "${WORK}/base-tree" 2>/dev/null || true
rm -rf "${WORK}"
git worktree prune 2>/dev/null || true
docker buildx prune --filter "until=72h" -f || true