diff --git a/.github/workflows/docker-ci-publish.yml b/.github/workflows/docker-ci-publish.yml new file mode 100644 index 0000000000..de2298f0bc --- /dev/null +++ b/.github/workflows/docker-ci-publish.yml @@ -0,0 +1,103 @@ +name: Docker for CI + +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +on: + push: + # Only run when the file is edited on main + branches: [ "main" ] + paths: [ "Dockerfile-ci" ] + pull_request: + # Only run when the file is edited on main + branches: [ "main" ] + paths: [ "Dockerfile-ci" ] + workflow_dispatch: {} + +env: + # Use docker.io for Docker Hub if empty + REGISTRY: ghcr.io + # github.repository as / + IMAGE_NAME: ${{ github.repository }}-ci + + +jobs: + build: + + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + # This is used to complete the identity challenge + # with sigstore/fulcio when running outside of PRs. + id-token: write + + steps: + # Taken from https://github.com/orgs/community/discussions/25678#discussioncomment-5242449 + - name: Delete huge unnecessary tools folder + run: rm -rf /opt/hostedtoolcache + - name: Checkout repository + uses: actions/checkout@v4 + + # Install the cosign tool except on PR + # https://github.com/sigstore/cosign-installer + - name: Install cosign + if: github.event_name != 'pull_request' + uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0 + with: + cosign-release: 'v2.2.4' + + # Set up BuildKit Docker container builder to be able to build + # multi-platform images and export cache + # https://github.com/docker/setup-buildx-action + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0 + + # Login against a Docker registry except on PR + # https://github.com/docker/login-action + - name: Log into registry ${{ env.REGISTRY }} + if: github.event_name != 'pull_request' + uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + # Extract metadata (tags, labels) for Docker + # https://github.com/docker/metadata-action + - name: Extract Docker metadata + id: meta + uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + + # Build and push Docker image with Buildx (don't push on PR) + # https://github.com/docker/build-push-action + - name: Build and push Docker image + id: build-and-push + uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0 + with: + context: . + file: Dockerfile-ci + push: ${{ github.event_name != 'pull_request' }} + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max + + # Sign the resulting Docker image digest except on PRs. + # This will only write to the public Rekor transparency log when the Docker + # repository is public to avoid leaking data. If you would like to publish + # transparency data even for private images, pass --force to cosign below. + # https://github.com/sigstore/cosign + - name: Sign the published Docker image + if: ${{ github.event_name != 'pull_request' }} + env: + # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable + TAGS: ${{ steps.meta.outputs.tags }} + DIGEST: ${{ steps.build-and-push.outputs.digest }} + # This step uses the identity token to provision an ephemeral certificate + # against the sigstore community Fulcio instance. + run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} diff --git a/Dockerfile-ci b/Dockerfile-ci new file mode 100644 index 0000000000..57910360ac --- /dev/null +++ b/Dockerfile-ci @@ -0,0 +1,71 @@ +# syntax=docker/dockerfile:1 + +FROM python:3.12-slim + +LABEL org.opencontainers.image.source=https://github.com/juaml/junifer +LABEL org.opencontainers.image.description="Junifer CI container image" +LABEL org.opencontainers.image.licenses=AGPL-3.0-only + +RUN apt-get update && \ + apt-get install -y \ + pkg-config \ + gcc \ + git \ + make \ + curl \ + # ANTs runtime stuff + libhdf5-dev \ + bc \ + # AFNI runtime stuff + libf2c2-dev \ + libglew-dev \ + libglib2.0-dev \ + libglu1-mesa-dev \ + libglw1-mesa-dev \ + libgsl-dev \ + libgts-dev \ + libjpeg62-turbo-dev \ + libmotif-dev \ + libxi-dev \ + libxmhtml-dev \ + libxmu-dev \ + libxpm-dev \ + libxt-dev \ + netpbm \ + libjpeg-progs \ + qhull-bin \ + r-base \ + tcsh \ + xvfb \ + # FSL runtime stuff + file \ + dc \ + libquadmath0 \ + libgomp1 + +# Add xfms +COPY --from=ghcr.io/juaml/human-template-xfms:main /opt/xfms /root/junifer/data/xfms + +# Add ANTs +COPY --from=antsx/ants:latest /opt/ants /opt/ants +# Set env vars for ANTs +ENV PATH="/opt/ants/bin:$PATH" \ + LD_LIBRARY_PATH="/opt/ants/lib" + +# Add AFNI +COPY --from=afni/afni_make_build:latest /opt/afni/install /opt/afni/bin +# Set env vars for AFNI +ENV PATH="/opt/afni/bin:$PATH" +# Patch gsl +RUN ln -s /usr/lib/x86_64-linux-gnu/libgsl.so.27 /usr/lib/x86_64-linux-gnu/libgsl.so.23 + +# Add FSL +RUN curl https://fsl.fmrib.ox.ac.uk/fsldownloads/fslconda/releases/fslinstaller.py | \ + python - -d /opt/fsl/ --skip_registration +# Set env vars for FSL +ENV FSLDIR="/opt/fsl" \ + FSLOUTPUTTYPE="NIFTI_GZ" \ + PATH="/opt/fsl/bin:$PATH" + +# Clean apt cache +RUN apt-get autoremove --purge && apt-get clean diff --git a/docs/changes/newsfragments/382.misc b/docs/changes/newsfragments/382.misc new file mode 100644 index 0000000000..577760dff7 --- /dev/null +++ b/docs/changes/newsfragments/382.misc @@ -0,0 +1 @@ +Add Dockerfile for CI and a corresponding action for building and publishing the image by `Synchon Mandal`_