posthog/.github/workflows/cd-sandbox-base-image.yml at f2a88130702f46cb472425c9d7c39232dc322257 · PostHog/posthog · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
name: Tasks Sandbox Container Image CD

on:
    push:
        branches:
            - master
    pull_request:
    workflow_dispatch:

jobs:
    changes:
        runs-on: ubuntu-24.04
        timeout-minutes: 5
        if: github.repository == 'PostHog/posthog'
        name: Determine if sandbox image needs to be built
        permissions:
            contents: read
            pull-requests: read
        outputs:
            sandbox_image: ${{ steps.filter.outputs.sandbox_image }}
        steps:
            - uses: actions/checkout@v6

            - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
              id: filter
              with:
                  filters: |
                      sandbox_image:
                        - 'products/tasks/backend/sandbox/images/**'

    sandbox_base_build:
        needs: changes
        name: Build and push Tasks Sandbox container image
        if: |
            github.repository == 'PostHog/posthog' && (
                needs.changes.outputs.sandbox_image == 'true' ||
                github.event_name == 'workflow_dispatch' ||
                contains(github.event.pull_request.labels.*.name, 'build-tasks-sandbox-image')
            )
        runs-on: depot-ubuntu-latest
        permissions:
            id-token: write # allow issuing OIDC tokens for this workflow run
            contents: read # allow at least reading the repo contents, add other permissions if necessary
            packages: write # allow push to ghcr.io

        steps:
            - name: Check out
              uses: actions/checkout@v6
              with:
                  fetch-depth: 2

            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

            - name: Set up QEMU
              uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

            - name: Set up Depot CLI
              uses: depot/setup-action@b0b1ea4f69e92ebf5dea3f8713a1b0c37b2126a5 # v1.6.0

            - name: Login to ghcr.io
              uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
              with:
                  registry: ghcr.io
                  username: ${{ github.actor }}
                  password: ${{ secrets.GITHUB_TOKEN }}
                  logout: false

            - name: Build and push container image (base)
              id: build
              uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
              with:
                  file: ./products/tasks/backend/sandbox/images/Dockerfile.sandbox-base
                  buildx-fallback: false # the fallback is so slow it's better to just fail
                  push: true
                  tags: ${{ github.ref == 'refs/heads/master' && format('ghcr.io/posthog/posthog-sandbox-base:master,ghcr.io/posthog/posthog-sandbox-base:{0}', github.sha) || format('ghcr.io/posthog/posthog-sandbox-base:{0}', github.sha) }}
                  platforms: linux/arm64,linux/amd64
                  build-args: COMMIT_HASH=${{ github.sha }}

            - name: Build and push container image (notebook)
              id: build-notebook
              uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
              with:
                  file: ./products/tasks/backend/sandbox/images/Dockerfile.sandbox-notebook
                  buildx-fallback: false # the fallback is so slow it's better to just fail
                  push: true
                  tags: ${{ github.ref == 'refs/heads/master' && format('ghcr.io/posthog/posthog-sandbox-notebook:master,ghcr.io/posthog/posthog-sandbox-notebook:{0}', github.sha) || format('ghcr.io/posthog/posthog-sandbox-notebook:{0}', github.sha) }}
                  platforms: linux/arm64,linux/amd64
                  build-args: COMMIT_HASH=${{ github.sha }}