docker.yml

name: Docker Images

on:
  workflow_call:
    inputs:
      source_sha:
        required: true
        type: string
      publish:
        required: false
        type: boolean
        default: false
  workflow_dispatch:
  pull_request:
    paths:
      - Dockerfile
      - .dockerignore
      - compose*.yaml
      - docker/**
      - requirements*.txt
      - pre-requirements.txt
      - .github/workflows/docker.yml
  release:
    types: [published]

permissions:
  contents: read

jobs:
  image:
    name: Docker ${{ matrix.variant }}
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write
    strategy:
      fail-fast: false
      matrix:
        variant: [cpu, cuda]
    steps:
      - uses: actions/checkout@v7.0.1
        with:
          ref: ${{ inputs.source_sha || github.event.release.tag_name || github.ref }}

      - name: Check version and destination
        id: meta
        shell: bash
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
          SOURCE_SHA: ${{ inputs.source_sha }}
        run: |
          VERSION="$(cat VERSION)"
          REVISION="$(git rev-parse HEAD)"
          if [ -n "$SOURCE_SHA" ]; then test "$REVISION" = "$SOURCE_SHA"; fi
          if [ -n "$RELEASE_TAG" ]; then
            test "$RELEASE_TAG" = "v$VERSION"
            test "$(git rev-parse HEAD)" = "$(git rev-parse "refs/tags/$RELEASE_TAG^{commit}")"
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "revision=$REVISION" >> "$GITHUB_OUTPUT"
          echo "image=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"

      - uses: docker/setup-buildx-action@v4.3.0

      - name: Build image for acceptance
        uses: docker/build-push-action@v7.3.0
        with:
          context: .
          platforms: linux/amd64
          load: true
          tags: ai-rvc:test
          build-args: |
            VARIANT=${{ matrix.variant }}
            VERSION=${{ steps.meta.outputs.version }}
            REVISION=${{ steps.meta.outputs.revision }}
          cache-from: type=gha,scope=docker-${{ matrix.variant }}
          cache-to: type=gha,mode=max,scope=docker-${{ matrix.variant }}

      - name: Verify image dependencies and non-root volume initialization
        shell: bash
        run: |
          docker run --rm ai-rvc:test python -m pip check
          docker run --rm ai-rvc:test python -c "import os, torch, torchvision, torchaudio; from audio_separator.separator import Separator; from pedalboard import Pedalboard, Reverb; assert os.getuid() == 1000; assert os.path.isfile('/data/config.json'); print(torch.__version__)"
          docker create --name ai-rvc-resources ai-rvc:test
          mkdir -p ui/multitrack/dist
          docker cp ai-rvc-resources:/app/ui/multitrack/dist/player.html ui/multitrack/dist/player.html
          docker rm -v ai-rvc-resources

      - name: Run full source regression suite in the built runtime
        shell: bash
        run: |
          mkdir -p temp
          docker run --rm --network none --no-healthcheck --entrypoint python -e AI_RVC_DEVICE=cpu \
            --mount type=bind,src="$PWD",dst=/validation,readonly \
            --tmpfs /validation/temp:rw,uid=1000,gid=1000,mode=1777 --workdir /validation \
            ai-rvc:test -m unittest discover -s tests

      # Hosted runners have no NVIDIA GPU. Existing real-audio evidence is recorded
      # separately; these build/runtime checks are not presented as GPU inference.
      - uses: docker/login-action@v4.6.0
        if: github.event_name == 'release' || inputs.publish
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish tested versioned image
        if: github.event_name == 'release' || inputs.publish
        uses: docker/build-push-action@v7.3.0
        with:
          context: .
          platforms: linux/amd64
          push: true
          provenance: mode=max
          sbom: true
          tags: ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version }}-${{ matrix.variant }}
          build-args: |
            VARIANT=${{ matrix.variant }}
            VERSION=${{ steps.meta.outputs.version }}
            REVISION=${{ steps.meta.outputs.revision }}
          cache-from: type=gha,scope=docker-${{ matrix.variant }}