[CI] Build patched Docker images for both amd64 and arm64 (#34276)
This commit is contained in:
Liangsheng Yin
@@ -4,18 +4,19 @@ on:
|
|||||||
workflow_dispatch:
|
workflow_dispatch:
|
||||||
inputs:
|
inputs:
|
||||||
pr_numbers:
|
pr_numbers:
|
||||||
description: "Comma-separated PR numbers to apply (e.g. 18962,19010). Empty = fast-forward the base image to latest main."
|
description: "Comma-separated PR numbers, merged in the order listed (e.g. 18962,19010). Empty = fast-forward the base image to latest main."
|
||||||
required: false
|
required: false
|
||||||
default: ""
|
default: ""
|
||||||
image_tag:
|
image_tag:
|
||||||
description: "Base image tag to patch (e.g. dev, dev-cu13, dev-cu12)"
|
description: "Base image tag to patch (e.g. dev, dev-cu13, dev-cu12)"
|
||||||
required: true
|
required: true
|
||||||
output_tag:
|
output_tag:
|
||||||
description: "Tag to publish as. Must start with 'patch-' (e.g. patch-myfeature)."
|
description: "Tag to publish as. Overwrites it if it already exists."
|
||||||
required: true
|
required: true
|
||||||
|
|
||||||
concurrency:
|
concurrency:
|
||||||
group: patch-docker-${{ inputs.image_tag }}-${{ inputs.output_tag }}
|
# Keyed on the tag being written, which is the only resource two runs contend for.
|
||||||
|
group: patch-docker-${{ inputs.output_tag }}
|
||||||
cancel-in-progress: true
|
cancel-in-progress: true
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
@@ -42,18 +43,6 @@ jobs:
|
|||||||
validate_tag image_tag "${IMAGE_TAG}"
|
validate_tag image_tag "${IMAGE_TAG}"
|
||||||
validate_tag output_tag "${OUTPUT_TAG}"
|
validate_tag output_tag "${OUTPUT_TAG}"
|
||||||
|
|
||||||
# Released tags belong to release-docker*.yml, which builds them as
|
|
||||||
# multi-arch manifests. This job is x64-only, so it publishes under a
|
|
||||||
# prefix those builders never emit rather than denylisting their
|
|
||||||
# current names, which would rot as the release tag scheme changes.
|
|
||||||
case "${OUTPUT_TAG}" in
|
|
||||||
patch-?*) ;;
|
|
||||||
*)
|
|
||||||
echo "::error::output_tag must start with 'patch-' (e.g. patch-myfeature)"
|
|
||||||
exit 1
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
echo "BASE_IMAGE=lmsysorg/sglang:${IMAGE_TAG}" >> "$GITHUB_ENV"
|
echo "BASE_IMAGE=lmsysorg/sglang:${IMAGE_TAG}" >> "$GITHUB_ENV"
|
||||||
echo "OUT_IMAGE=lmsysorg/sglang:${OUTPUT_TAG}" >> "$GITHUB_ENV"
|
echo "OUT_IMAGE=lmsysorg/sglang:${OUTPUT_TAG}" >> "$GITHUB_ENV"
|
||||||
|
|
||||||
@@ -65,92 +54,130 @@ jobs:
|
|||||||
with:
|
with:
|
||||||
fetch-depth: 0
|
fetch-depth: 0
|
||||||
|
|
||||||
|
- name: Set up QEMU
|
||||||
|
uses: docker/setup-qemu-action@v3
|
||||||
|
|
||||||
|
- name: Set up Docker Buildx
|
||||||
|
uses: docker/setup-buildx-action@v3
|
||||||
|
|
||||||
- name: Login to Docker Hub
|
- name: Login to Docker Hub
|
||||||
uses: docker/login-action@v2
|
uses: docker/login-action@v2
|
||||||
with:
|
with:
|
||||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||||
|
|
||||||
- name: Pull base image and extract commit
|
- name: Extract base commit
|
||||||
run: |
|
run: |
|
||||||
docker pull "${BASE_IMAGE}"
|
docker pull "${BASE_IMAGE}"
|
||||||
if BASE_SHA=$(docker run --rm "${BASE_IMAGE}" git -C /sgl-workspace/sglang rev-parse HEAD 2>/dev/null); then
|
# --entrypoint skips the CUDA base image's banner, which goes to
|
||||||
echo "Image built from commit: ${BASE_SHA}"
|
# stdout and would otherwise be captured as part of the SHA.
|
||||||
else
|
BASE_SHA=$(docker run --rm --entrypoint git "${BASE_IMAGE}" \
|
||||||
BASE_SHA=""
|
-C /sgl-workspace/sglang rev-parse HEAD 2>/dev/null | tail -n 1)
|
||||||
echo "::warning::Image has no .git directory - cannot extract base commit"
|
# A banner line reaching GITHUB_ENV breaks the step, as above.
|
||||||
|
case "${BASE_SHA}" in *[!0-9a-f]*) BASE_SHA="" ;; esac
|
||||||
|
[ "${#BASE_SHA}" -eq 40 ] || BASE_SHA=""
|
||||||
|
if [ -z "${BASE_SHA}" ]; then
|
||||||
|
echo "::error::Cannot read the base commit of ${BASE_IMAGE}; the patch is computed against it"
|
||||||
|
exit 1
|
||||||
fi
|
fi
|
||||||
|
echo "Image built from commit: ${BASE_SHA}"
|
||||||
echo "BASE_SHA=${BASE_SHA}" >> "$GITHUB_ENV"
|
echo "BASE_SHA=${BASE_SHA}" >> "$GITHUB_ENV"
|
||||||
|
# Pulled only for the rev-parse above; buildx pulls the base itself.
|
||||||
|
docker image rm "${BASE_IMAGE}" || true
|
||||||
|
|
||||||
- name: Generate patches
|
- name: Generate patch
|
||||||
env:
|
env:
|
||||||
PR_NUMBERS: ${{ inputs.pr_numbers }}
|
PR_NUMBERS: ${{ inputs.pr_numbers }}
|
||||||
run: |
|
run: |
|
||||||
git config --global --add safe.directory "$GITHUB_WORKSPACE"
|
git config --global --add safe.directory "$GITHUB_WORKSPACE"
|
||||||
git fetch origin main
|
git fetch origin main
|
||||||
# Fixed path on a persistent runner: drop patches left by prior runs
|
git fetch origin "${BASE_SHA}"
|
||||||
# so they cannot be picked up by this run's COPY *.patch.
|
|
||||||
rm -rf /tmp/patch-ctx
|
# Per-run paths: the concurrency group keys on output_tag, so two runs
|
||||||
mkdir -p /tmp/patch-ctx
|
# with different tags can land on this runner at the same time.
|
||||||
|
WORK="/tmp/patch-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
|
||||||
|
rm -rf "${WORK}"
|
||||||
|
mkdir -p "${WORK}/ctx"
|
||||||
|
git worktree prune
|
||||||
|
# Merge onto the image's own commit so the patch context matches the
|
||||||
|
# image tree exactly and cannot drift. Conflicts then surface here in
|
||||||
|
# seconds instead of failing the build after a multi-GB pull.
|
||||||
|
git worktree add --detach "${WORK}/base-tree" "${BASE_SHA}"
|
||||||
|
echo "PATCH_CTX=${WORK}/ctx" >> "$GITHUB_ENV"
|
||||||
|
|
||||||
|
# -c rather than --global: leave no identity behind on the runner.
|
||||||
|
merge_into_base() {
|
||||||
|
git -C "${WORK}/base-tree" \
|
||||||
|
-c user.email=ci@sglang.local -c user.name="sglang CI" \
|
||||||
|
merge --no-edit "$1"
|
||||||
|
}
|
||||||
|
|
||||||
if [ -n "${PR_NUMBERS}" ]; then
|
if [ -n "${PR_NUMBERS}" ]; then
|
||||||
IFS=',' read -ra PRS <<< "${PR_NUMBERS}"
|
IFS=',' read -ra PRS <<< "${PR_NUMBERS}"
|
||||||
for pr in "${PRS[@]}"; do
|
for pr in "${PRS[@]}"; do
|
||||||
pr=$(echo "${pr}" | xargs)
|
pr=$(echo "${pr}" | xargs)
|
||||||
echo "Fetching PR #${pr}"
|
case "${pr}" in
|
||||||
|
""|*[!0-9]*)
|
||||||
|
echo "::error::'${pr}' is not a PR number"
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
echo "Merging PR #${pr}"
|
||||||
git fetch origin "pull/${pr}/head:pr-${pr}"
|
git fetch origin "pull/${pr}/head:pr-${pr}"
|
||||||
MERGE_BASE=$(git merge-base origin/main "pr-${pr}")
|
merge_into_base "pr-${pr}" || {
|
||||||
echo " PR #${pr}: merge-base=${MERGE_BASE}"
|
echo "::error::PR #${pr} conflicts with base image commit ${BASE_SHA}"
|
||||||
git diff "${MERGE_BASE}..pr-${pr}" > "/tmp/patch-ctx/${pr}.patch"
|
git -C "${WORK}/base-tree" diff --name-only --diff-filter=U
|
||||||
echo " PR #${pr}: $(wc -l < /tmp/patch-ctx/${pr}.patch) lines"
|
exit 1
|
||||||
|
}
|
||||||
done
|
done
|
||||||
elif [ -n "${BASE_SHA}" ]; then
|
|
||||||
echo "Generating diff: image ${BASE_SHA} -> latest main"
|
|
||||||
git fetch origin "${BASE_SHA}"
|
|
||||||
git diff "${BASE_SHA}..origin/main" > /tmp/patch-ctx/main.patch
|
|
||||||
echo " main: $(wc -l < /tmp/patch-ctx/main.patch) lines"
|
|
||||||
else
|
else
|
||||||
echo "::error::No PR numbers specified and image has no .git - cannot generate diff against main"
|
echo "Fast-forwarding to latest main"
|
||||||
exit 1
|
merge_into_base origin/main || {
|
||||||
|
echo "::error::Cannot merge latest main into base image commit ${BASE_SHA}"
|
||||||
|
git -C "${WORK}/base-tree" diff --name-only --diff-filter=U
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
fi
|
fi
|
||||||
|
|
||||||
TOTAL=$(cat /tmp/patch-ctx/*.patch | wc -l)
|
git -C "${WORK}/base-tree" diff --binary "${BASE_SHA}"..HEAD > "${WORK}/ctx/merged.patch"
|
||||||
if [ "${TOTAL}" -eq 0 ]; then
|
if [ ! -s "${WORK}/ctx/merged.patch" ]; then
|
||||||
echo "::error::All patches are empty - nothing to apply on top of ${BASE_IMAGE}"
|
echo "::error::Patch is empty - nothing to apply on top of ${BASE_IMAGE}"
|
||||||
exit 1
|
exit 1
|
||||||
fi
|
fi
|
||||||
|
PATCH_STAT=$(git -C "${WORK}/base-tree" diff --shortstat "${BASE_SHA}"..HEAD | xargs)
|
||||||
|
echo "Patch: ${PATCH_STAT}"
|
||||||
|
echo "PATCH_STAT=${PATCH_STAT}" >> "$GITHUB_ENV"
|
||||||
|
|
||||||
- name: Build patched image
|
- name: Build and push patched image
|
||||||
run: |
|
run: |
|
||||||
cat <<'DOCKERFILE' > /tmp/patch-ctx/Dockerfile
|
cat <<'DOCKERFILE' > "${PATCH_CTX}/Dockerfile"
|
||||||
ARG BASE_IMAGE
|
ARG BASE_IMAGE
|
||||||
FROM ${BASE_IMAGE}
|
FROM ${BASE_IMAGE}
|
||||||
COPY *.patch /tmp/patches/
|
COPY merged.patch /tmp/merged.patch
|
||||||
|
# git apply, not patch: no fuzz is needed given the exact context, and
|
||||||
|
# it handles renames, mode changes and binary files.
|
||||||
RUN cd /sgl-workspace/sglang \
|
RUN cd /sgl-workspace/sglang \
|
||||||
&& for p in /tmp/patches/*.patch; do \
|
&& git apply --binary -v -p1 /tmp/merged.patch \
|
||||||
if [ ! -s "${p}" ]; then \
|
&& rm -f /tmp/merged.patch \
|
||||||
echo "Skipping ${p} (empty)"; \
|
&& python3 -m compileall -q -f python/sglang \
|
||||||
else \
|
&& ( find python -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null || true )
|
||||||
echo "Applying ${p}..." \
|
|
||||||
&& patch -p1 --fuzz=2 --no-backup-if-mismatch -f < "${p}" \
|
|
||||||
|| { echo "ERROR: Failed to apply ${p}"; exit 1; }; \
|
|
||||||
fi; \
|
|
||||||
done \
|
|
||||||
&& rm -rf /tmp/patches
|
|
||||||
DOCKERFILE
|
DOCKERFILE
|
||||||
|
|
||||||
docker build \
|
# Each platform patches its own arch of the base manifest list, so the
|
||||||
|
# output stays a list. A single-arch base fails here on purpose: the
|
||||||
|
# output would not be pullable on the other arch.
|
||||||
|
docker buildx build \
|
||||||
|
--platform linux/amd64,linux/arm64 \
|
||||||
--no-cache \
|
--no-cache \
|
||||||
--build-arg BASE_IMAGE="${BASE_IMAGE}" \
|
--build-arg BASE_IMAGE="${BASE_IMAGE}" \
|
||||||
-t "${OUT_IMAGE}" \
|
-t "${OUT_IMAGE}" \
|
||||||
/tmp/patch-ctx/
|
--push \
|
||||||
|
"${PATCH_CTX}/"
|
||||||
|
|
||||||
- name: Push patched image
|
- name: Write summary
|
||||||
env:
|
env:
|
||||||
PR_NUMBERS: ${{ inputs.pr_numbers }}
|
PR_NUMBERS: ${{ inputs.pr_numbers }}
|
||||||
run: |
|
run: |
|
||||||
docker push "${OUT_IMAGE}"
|
|
||||||
|
|
||||||
if [ -n "${PR_NUMBERS}" ]; then
|
if [ -n "${PR_NUMBERS}" ]; then
|
||||||
SOURCE="PRs: ${PR_NUMBERS}"
|
SOURCE="PRs: ${PR_NUMBERS}"
|
||||||
else
|
else
|
||||||
@@ -159,7 +186,18 @@ jobs:
|
|||||||
{
|
{
|
||||||
echo "### Patched \`${OUT_IMAGE}\`"
|
echo "### Patched \`${OUT_IMAGE}\`"
|
||||||
echo "- **Base image:** \`${BASE_IMAGE}\`"
|
echo "- **Base image:** \`${BASE_IMAGE}\`"
|
||||||
echo "- **Base commit:** \`${BASE_SHA:-unknown (no .git)}\`"
|
echo "- **Base commit:** \`${BASE_SHA}\`"
|
||||||
echo "- **Source:** ${SOURCE}"
|
echo "- **Source:** ${SOURCE}"
|
||||||
echo "- **Platform:** \`linux/amd64\` only - patched on an x64 runner, so the base image's multi-arch manifest is not carried over"
|
echo "- **Patch:** ${PATCH_STAT}"
|
||||||
|
echo "- **Platforms:** \`linux/amd64,linux/arm64\`"
|
||||||
} >> "$GITHUB_STEP_SUMMARY"
|
} >> "$GITHUB_STEP_SUMMARY"
|
||||||
|
|
||||||
|
- name: Clean up
|
||||||
|
if: always()
|
||||||
|
run: |
|
||||||
|
# Per-run paths are never reclaimed by a later run, so drop them here.
|
||||||
|
WORK="/tmp/patch-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
|
||||||
|
git worktree remove --force "${WORK}/base-tree" 2>/dev/null || true
|
||||||
|
rm -rf "${WORK}"
|
||||||
|
git worktree prune 2>/dev/null || true
|
||||||
|
docker buildx prune --filter "until=72h" -f || true
|
||||||
|
|||||||
Reference in New Issue
Block a user