dev_environment.yml

on:
  workflow_call:
    inputs:
      dockerfile:
        required: true
        type: string
      platforms:
        type: string
        required: false
        default: linux/amd64
      build_target:
        required: false
        type: string
      build_args:
        required: false
        type: string
      registry_cache_from:
        required: false
        type: string
      local_cache_from:
        required: false
        type: string
      create_local_cache:
        required: false
        type: boolean
        default: false
      registry_cache_update:
        required: false
        type: boolean
        default: false
      registry_cache_update_only:
        required: false
        type: boolean
        default: false
      additional_build_caches:
        required: false
        type: string
      additional_local_caches:
        required: false
        type: string
      toolchain:
        required: false
        type: string
      matrix_key:
        required: false
        type: string
      pull_request_number:
        required: false
        type: string
        description: The issue number of the pull request to check out. Permits to run the workflow from a different branch than the PR branch.
      pull_request_commit:
        required: false
        type: string
        description: The commit to check out. Only used when pull_request_number is set.
      environment:
        required: false
        type: string
    outputs:
      image_hash:
        description: "The name and digest of the docker image that was deployed to the registry, which can be used to retrieve it independently of any tag updates."
        value: ${{ jobs.finalize.outputs.image_hash }}
      cache_key:
        description: "The cache key to retrieve a tar archive containing the built image(s)."
        value: ${{ jobs.finalize.outputs.cache_key }}
      tar_archive:
        description: "The location of the tar archive in the cache."
        value: ${{ jobs.finalize.outputs.tar_archive }}
      build_cache:
        description: "The location from which the build cache can be loaded in subsequent builds."
        value: ${{ jobs.finalize.outputs.build_cache }}

name: CUDA Quantum cached dev images

jobs:
  metadata:
    name: Metadata
    runs-on: ubuntu-latest
    permissions:
      contents: read

    outputs:
      runner: ${{ steps.build_info.outputs.runner }}
      platform_tag: ${{ steps.build_info.outputs.platform_tag }}
      dockerfile: ${{ steps.build_info.outputs.dockerfile }}
      owner: ${{ steps.build_info.outputs.owner }}
      image_name: ${{ steps.build_info.outputs.image_name }}
      image_title: ${{ steps.build_info.outputs.image_title }}
      image_id: ${{ steps.build_info.outputs.image_id }}
      image_tags: ${{ steps.metadata.outputs.tags }}
      image_labels: ${{ steps.metadata.outputs.labels }}
      llvm_commit: ${{ steps.build_info.outputs.llvm_commit }}

    # Needed for access to environment variables (like the registry name).
    environment:
      name: ${{ inputs.environment || 'default' }}
      url: ${{ vars.deployment_url || format('https://github.com/{0}', github.repository) }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          ref: "${{ (inputs.pull_request_number != '' && (inputs.pull_request_commit || format('refs/pull/{0}/merge', inputs.pull_request_number))) || '' }}"

      - name: Determine build arguments
        id: build_info
        run: |
          if [ -n "$(echo ${{ inputs.platforms }} | grep ',')" ]; then
            # multi-platform builds get no platform tag
            echo "runner=linux-amd64-cpu16" >> $GITHUB_OUTPUT
          elif [ -n "$(echo ${{ inputs.platforms }} | grep -i arm)" ]; then
            platform_tag=`echo ${{ inputs.platforms }} | sed 's/linux\///g' | tr -d ' '`
            echo "platform_tag=$platform_tag" >> $GITHUB_OUTPUT
            echo "runner=linux-arm64-cpu8" >> $GITHUB_OUTPUT
          else
            platform_tag=`echo ${{ inputs.platforms }} | sed 's/linux\///g' | tr -d ' '`
            echo "platform_tag=$platform_tag" >> $GITHUB_OUTPUT
            echo "runner=linux-amd64-cpu8" >> $GITHUB_OUTPUT
          fi

          repo_owner=${{ github.repository_owner }}
          registry=${{ vars.registry || 'localhost:5000' }}
          build_target=${{ inputs.build_target }}
          image_id=`basename ${{ inputs.dockerfile }} .Dockerfile`${build_target:+.$build_target}
          image_title=cuda-quantum-`echo $image_id | cut -d "." -f 1`
          image_name=$registry/${repo_owner,,}/$image_title
          toolchain=${{ inputs.toolchain }}
          tag_prefix=`echo $image_id | cut -s -d "." -f 2- | xargs -I "%" echo %. | tr . -`${platform_tag:+$platform_tag-}${toolchain:+$toolchain-}
          tag_suffix=""

          if ${{ inputs.pull_request_commit != '' }}; then
            custom_tags="type=raw,value=${{ inputs.registry_cache_from || inputs.pull_request_commit }},priority=1000"
          elif ${{ github.event.pull_request.merged == true }}; then
            custom_tags="type=raw,value=${{ github.event.pull_request.base.ref }},priority=1000"
          elif ${{ inputs.pull_request_number != '' }} || [ -n "$(echo ${{ github.ref_name }} | grep pull-request/)" ]; then
            pr_number=`echo ${{ github.ref_name }} | grep -o [0-9]*`
            custom_tags="type=raw,value=pr-${pr_number:-${{ inputs.pull_request_number }}},priority=1000"
          fi

          echo "image_name=$image_name" >> $GITHUB_OUTPUT
          echo "image_title=$image_title" >> $GITHUB_OUTPUT
          echo "image_id=$image_id" >> $GITHUB_OUTPUT
          echo "tag_prefix=$tag_prefix" >> $GITHUB_OUTPUT
          echo "tag_suffix=$tag_suffix" >> $GITHUB_OUTPUT
          echo "custom_tags=$custom_tags" >> $GITHUB_OUTPUT
          echo "dockerfile=${{ inputs.dockerfile }}" >> $GITHUB_OUTPUT
          echo "owner=${repo_owner,,}" >> $GITHUB_OUTPUT
          echo "llvm_commit=$(git rev-parse @:./tpls/llvm)" >> $GITHUB_OUTPUT

      - name: Extract metadata for Docker image
        id: metadata
        uses: docker/metadata-action@v4
        with:
          images: ${{ steps.build_info.outputs.image_name }}
          flavor: |
            latest=false
            prefix=${{ steps.build_info.outputs.tag_prefix }},onlatest=true
            suffix=${{ steps.build_info.outputs.tag_suffix }},onlatest=true
          tags: |
            type=ref,enable=${{ steps.build_info.outputs.custom_tags == '' }},event=branch
            type=ref,enable=${{ inputs.pull_request_number == '' }},prefix=${{ steps.build_info.outputs.tag_prefix }}pr-,event=pr
            type=ref,enable=${{ inputs.pull_request_number == '' }},event=tag
            ${{ steps.build_info.outputs.custom_tags }}
          labels: |
            org.opencontainers.image.title=${{ steps.build_info.outputs.image_title }}
            org.opencontainers.image.description=Dev tools for building and testing CUDA Quantum

  build:
    name: Caching
    needs: metadata
    runs-on: ${{ needs.metadata.outputs.runner }}
    timeout-minutes: 600
    permissions:
      contents: read
      packages: write
      id-token: write

    outputs:
      tar_cache: ${{ steps.cache.outputs.tar_cache }}
      tar_archive: ${{ steps.cache.outputs.tar_archive }}
      build_cache: ${{ steps.cache.outputs.build_cache }}
      image_hash: ${{ needs.metadata.outputs.image_name }}@${{ steps.docker_build.outputs.digest }}

    environment:
      name: ${{ inputs.environment || 'default' }}
      url: ${{ vars.deployment_url || format('https://github.com/{0}', github.repository) }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          ref: "${{ (inputs.pull_request_number != '' && (inputs.pull_request_commit || format('refs/pull/{0}/merge', inputs.pull_request_number))) || '' }}"

      - name: Set up context for buildx
        run: |
          docker context create builder_context

      - name: Set up buildx runner
        uses: docker/setup-buildx-action@v2
        with:
          endpoint: builder_context

      - name: Log in to GitHub CR
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Create cache locations
        id: cache
        run: |
          toolchain=${{ inputs.toolchain }}
          registry_cache=ghcr.io/${{ needs.metadata.outputs.owner }}/buildcache-cuda-quantum
          nvidia_registry_cache=ghcr.io/nvidia/buildcache-cuda-quantum
          registry_cache_base=$(echo ${{ inputs.registry_cache_from || github.event.pull_request.base.ref || 'main' }} | tr / -)
          cache_id=$(echo ${{ needs.metadata.outputs.image_id }}${toolchain:+-$toolchain} | tr . -)

          orig_gh_ref=${{ github.ref_name }}
          if [ "$orig_gh_ref" != "${orig_gh_ref#pull-request/}" ]; then
            # original branch prior to the move by copy-pr-bot
            orig_gh_ref=${orig_gh_ref#pull-request/}/merge
          fi

          # Local caches are always to and from a single location.

          platform_id=`echo "${{ inputs.platforms }}" | sed 's/linux\///g' | tr -d ' ' | tr ',' -`
          local_buildcache_path="/tmp/.buildcache.${{ needs.metadata.outputs.image_id }}"
          local_buildcache_key_suffix="-$(git rev-parse HEAD)"

          if ${{ inputs.pull_request_number != '' }}; then
            local_buildcache_key="${{ inputs.pull_request_number }}/merge-cuda-quantum-${cache_id}-${platform_id}"
          else
            local_cache_from=${{ inputs.local_cache_from }}
            local_cache_from=$(echo ${local_cache_from:-$orig_gh_ref} | tr . -)
            if ${{ inputs.local_cache_from == '' && github.event.pull_request.merged == true }}; then
              local_cache_from=${{ github.event.pull_request.number }}/merge
            fi
            local_buildcache_key="${local_cache_from}-cuda-quantum-${cache_id}-${platform_id}"
          fi

          if ${{ inputs.registry_cache_update || inputs.registry_cache_update_only }}; then
            registry_cache_target=$(echo $orig_gh_ref | tr / -)
            build_cache="type=registry,ref=${registry_cache}-${cache_id}-${platform_id}:$registry_cache_target"
            cache_to="${build_cache},mode=max,ignore-error=false"
          elif ${{ inputs.create_local_cache }}; then
            # In general, using the build cache from the registry/parent branch is the quickest.
            # We hence create a build cache only upon request.
            build_cache="${local_buildcache_key}"
            cache_to="type=local,dest=${local_buildcache_path}-new,mode=max,ignore-error=true"
          fi

          # Registry caches pull from a separate cache for each platform
          # but create a single joint cache for multi-platform builds.

          platform_ids=$(echo "${{ inputs.platforms }}" | sed 's/linux\///g' | tr , ' ')
          {
            echo 'cache_from_gh<<multiline'
            echo "type=local,src=${local_buildcache_path}"
            echo multiline
          } >> $GITHUB_OUTPUT
          {
            echo 'cache_from_registry<<multiline'
            for platform_id in $platform_ids; do
              echo "type=registry,ref=${registry_cache}-${cache_id}-${platform_id}:${registry_cache_base}"
              echo "type=registry,ref=${nvidia_registry_cache}-${cache_id}-${platform_id}:${registry_cache_base}"
            done
            echo multiline
          } >> $GITHUB_OUTPUT

          echo "local_buildcache_key=$local_buildcache_key" >> $GITHUB_OUTPUT
          echo "local_buildcache_key_suffix=$local_buildcache_key_suffix" >> $GITHUB_OUTPUT
          echo "local_buildcache_path=$local_buildcache_path" >> $GITHUB_OUTPUT

          echo "cache_to=$cache_to" >> $GITHUB_OUTPUT
          echo "build_cache=$build_cache" >> $GITHUB_OUTPUT
          if ${{ inputs.environment == '' && ! inputs.registry_cache_update_only }}; then
            tar_archive=/tmp/${{ needs.metadata.outputs.image_id }}.tar
            echo "tar_cache=tar-${cache_id}-${platform_id}${local_buildcache_key_suffix}" >> $GITHUB_OUTPUT
            echo "tar_archive=$tar_archive" >> $GITHUB_OUTPUT
            echo "docker_output=type=docker,dest=$tar_archive" >> $GITHUB_OUTPUT
          fi

      - name: Check out local cache
        uses: actions/cache/restore@v3
        with:
          path: ${{ steps.cache.outputs.local_buildcache_path }}
          key: ${{ steps.cache.outputs.local_buildcache_key }}${{ steps.cache.outputs.local_buildcache_key_suffix }}
          restore-keys: |
            ${{ inputs.additional_local_caches }}
            ${{ steps.cache.outputs.local_buildcache_key }}

      - name: Build ${{ needs.metadata.outputs.image_title }} image
        id: docker_build
        uses: docker/build-push-action@v4
        with:
          context: .
          file: ./docker/${{ needs.metadata.outputs.dockerfile }}
          target: ${{ inputs.build_target }}
          build-args: |
            toolchain=${{ inputs.toolchain }}
            llvm_commit=${{ needs.metadata.outputs.llvm_commit }}
            ${{ inputs.build_args }}
          tags: ${{ needs.metadata.outputs.image_tags }}
          labels: ${{ needs.metadata.outputs.image_labels }}
          platforms: ${{ inputs.platforms }}
          cache-from: |
            ${{ inputs.additional_build_caches }}
            ${{ steps.cache.outputs.cache_from_gh }}
            ${{ steps.cache.outputs.cache_from_registry }}
          cache-to: ${{ steps.cache.outputs.cache_to }}
          push: ${{ inputs.environment && ! inputs.registry_cache_update_only || false }}
          outputs: ${{ steps.cache.outputs.docker_output }}

      - name: Install Cosign
        if: inputs.environment
        uses: sigstore/cosign-installer@v3.1.1

      - name: Sign image with GitHub OIDC Token
        if: inputs.environment
        env:
          DIGEST: ${{ steps.docker_build.outputs.digest }}
          TAGS: ${{ needs.metadata.outputs.image_tags }}
        run: cosign sign --yes --recursive "${TAGS}@${DIGEST}"

      # See also https://github.com/moby/buildkit/issues/1896
      - name: Clean up local cache
        run: |
          rm -rf "${{ steps.cache.outputs.local_buildcache_path }}"
          build_cache="${{ steps.cache.outputs.local_buildcache_path }}-new"
          if [ -d "$build_cache" ]; then
            mv "$build_cache" "${{ steps.cache.outputs.local_buildcache_path }}"
          fi

      - name: Upload build cache
        if: inputs.create_local_cache
        uses: actions/cache/save@v3
        with:
          path: ${{ steps.cache.outputs.local_buildcache_path }}
          key: ${{ steps.cache.outputs.local_buildcache_key }}${{ steps.cache.outputs.local_buildcache_key_suffix }}

      - name: Cache ${{ needs.metadata.outputs.image_title }} image
        if: steps.cache.outputs.tar_cache && steps.cache.outputs.tar_archive
        uses: actions/cache/save@v3
        with:
          path: ${{ steps.cache.outputs.tar_archive }}
          key: ${{ steps.cache.outputs.tar_cache }}

  finalize:
    name: Finalize
    runs-on: ubuntu-latest
    if: always() && !cancelled()
    needs: [metadata, build]

    outputs:
      image_hash: ${{ fromJson(steps.write_json.outputs.result).image_hash }}
      cache_key: ${{ fromJson(steps.write_json.outputs.result).cache_key }}
      tar_archive: ${{ fromJson(steps.write_json.outputs.result).tar_archive }}
      build_cache: ${{ fromJson(steps.write_json.outputs.result).build_cache }}

    steps:        
      - uses: cloudposse/github-action-matrix-outputs-write@0.3.0
        id: write_json
        with:
          matrix-step-name: ${{ inputs.matrix_key && 'dev_environment' }}
          matrix-key: ${{ inputs.matrix_key }}
          outputs: |
            image_hash: ${{ needs.build.outputs.image_hash }}
            cache_key: ${{ needs.build.outputs.tar_cache }}
            tar_archive: ${{ needs.build.outputs.tar_archive }}
            build_cache: ${{ needs.build.outputs.build_cache }}