openobserve/.github/workflows/build-fork-pr-image.yml

name: Build PR Docker Image on Fork

on:
  repository_dispatch:
    types: [ok-to-test-command]

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  AWS_REGION: us-east-1

jobs:
  build_pr_image_on_fork:
    name: build_pr_image_on_fork
    permissions:
      id-token: write
      contents: read
      pull-requests: write
      checks: write
      packages: write
    if: |
      github.event_name == 'repository_dispatch' &&
      github.event.client_payload.slash_command.args.named.sha != '' &&
      contains(
        github.event.client_payload.pull_request.head.sha,
        github.event.client_payload.slash_command.args.named.sha
      )
    runs-on: ${{ github.event.client_payload.pull_request.head.repo.fork == true && 'ubuntu-2204-8-cores' || 'ubicloud-standard-8' }}
    steps:
      - name: Remove unused tools
        run: |
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf /opt/ghc
          sudo rm -rf "/usr/local/share/boost"
          sudo rm -rf "$AGENT_TOOLSDIRECTORY"

      - name: Clone the current repo
        # uses: actions/checkout@v3
        # with:
        #   ref: 'refs/pull/${{ github.event.client_payload.pull_request.number }}/merge'
        uses: actions/checkout@v5
        with:
          ref: "refs/pull/${{ github.event.client_payload.pull_request.number }}/merge"
          # repository: ${{ github.event.client_payload.pull_request.head.repo.full_name }}
          # ref: ${{ github.event.client_payload.pull_request.head.sha }}
          # fetch-depth: 0
          # fetch-tags: true

      # Inlined rather than `uses: ./.github/actions/github-auth`: this job checks out a caller-chosen
      # ref, and running a local action from that checkout is a cache-poisoning vector (CodeQL).
      - name: Authenticate github.com fetches
        shell: bash
        env:
          TOKEN: ${{ github.token }}
        run: |
          # Sent on every github.com request, so throttled anonymous downloads never happen. A credential helper
          # or a token in the URL is only used after a 401, and GitHub never challenges for a public repository.
          B64=$(printf 'x-access-token:%s' "$TOKEN" | base64 | tr -d '\n')
          echo "::add-mask::$B64"
          git config --global http.https://github.com/.extraheader "AUTHORIZATION: basic $B64"
          # actions/checkout keeps the same header in each checked-out repository; two copies make GitHub answer 400.
          for d in "$GITHUB_WORKSPACE" "$GITHUB_WORKSPACE"/*/; do
            [ -d "$d/.git" ] && git -C "$d" config --local --unset-all http.https://github.com/.extraheader || true
          done
          echo "GIT_TERMINAL_PROMPT=0" >> "$GITHUB_ENV"
          # cargo's libgit2 transport ignores http.extraheader; the git CLI honours it.
          echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
      - name: Set GIT_TAG env
        run: |
          git fetch -f --tags
          echo "GIT_TAG=$(git describe --tags `git rev-list --tags --max-count=1`)" >> $GITHUB_ENV
          echo "GIT_HASH=${{github.event.client_payload.slash_command.args.named.sha}}" >> $GITHUB_ENV

      - name: Setup Rust Toolchain
        uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # master
        with:
          toolchain: nightly-2026-05-20

      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          cache-on-failure: true
          shared-key: fork-pr-release
          save-if: "false"
      - name: Install Protoc
        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
        with:
          version: "21.12"
      - uses: actions/setup-node@v7
        with:
          node-version: 24

      - name: Install frontend dependencies
        run: cd web && npm ci

      - name: Lint frontend code
        run: cd web && npm run lint:ci

      - name: Build frontend code
        env:
          NODE_OPTIONS: "--max-old-space-size=8192"
        run: cd web && npm run build

      - name: Print rustc cfg
        run: rustc -C target-cpu=native --print cfg

      - name: Build and run binary
        run: |
          cargo build --release --features mimalloc --target x86_64-unknown-linux-gnu
          mkdir -p bin
          mv target/x86_64-unknown-linux-gnu/release/openobserve bin/openobserve

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          aws-region: ${{ env.AWS_REGION }}
          role-to-assume: arn:aws:iam::058694856476:role/GitHubActionsRole
          role-session-name: GithubActionsSession

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7
        with:
          registry-type: public

      - name: Login to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
      - name: Build and push
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          file: deploy/build/Dockerfile.pr.amd64
          context: .
          tags: |
            public.ecr.aws/zinclabs/openobserve-dev:${{ env.GIT_TAG }}-${{ env.GIT_HASH}}-amd64
            ghcr.io/openobserve/openobserve-dev:${{ env.GIT_TAG }}-${{ env.GIT_HASH}}-amd64
          push: true
          cache-from: type=gha
          cache-to: type=gha,mode=max
      # - uses: actions/github-script@v7
      #   id: update-check-run
      #   if: ${{ always() }}
      #   env:
      #     number: ${{ github.event.client_payload.pull_request.number }}
      #     job: ${{ github.job }}
      #     # Conveniently, job.status maps to https://developer.github.com/v3/checks/runs/#update-a-check-run
      #     conclusion: ${{ job.status }}
      #   with:
      #     github-token: ${{ secrets.GITHUB_TOKEN }}
      #     script: |
      #       const { data: pull } = await github.rest.pulls.get({
      #         ...context.repo,
      #         pull_number: process.env.number
      #       });
      #       const ref = pull.head.sha;

      #       const { data: checks } = await github.rest.checks.listForRef({
      #         ...context.repo,
      #         ref
      #       });
      #       console.log(checks)

      #       const check = checks.check_runs.filter(c => c.name === process.env.job);

      #       const { data: result } = await github.rest.checks.update({
      #         ...context.repo,
      #         check_run_id: check[0].id,
      #         status: 'completed',
      #         conclusion: process.env.conclusion
      #       });

      #       return result;