openobserve/.github/workflows/build-pr-image.yml

name: Build PR Docker Image

on:
  workflow_dispatch:
    inputs:
      branch:
        description: 'Branch to build (e.g., feature/my-branch)'
        required: true
        type: string

concurrency:
  group: ${{ github.workflow }}-${{ inputs.branch }}
  cancel-in-progress: true

env:
  AWS_REGION: us-east-1

jobs:
  build_frontend:
    name: build_frontend
    runs-on: ubicloud-standard-4
    permissions:
      contents: read
    outputs:
      # we cache the git tag and hash and pass it to other jobs
      GIT_TAG: ${{ steps.set-git-tag.outputs.GIT_TAG }}
      GIT_HASH: ${{ steps.set-git-tag.outputs.GIT_HASH }}
    steps:
      - name: Clone the current repo
        uses: actions/checkout@v5
        with:
          repository: ${{ github.repository }}
          ref: ${{ inputs.branch }}
          fetch-depth: 0
          fetch-tags: true

      - name: Set GIT_TAG env
        id: set-git-tag
        run: |
          GIT_TAG=$(git describe --tags --abbrev=0)
          GIT_HASH=$(git rev-parse --short=7 HEAD)
          echo "GIT_TAG=$GIT_TAG" >> $GITHUB_OUTPUT
          echo "GIT_HASH=$GIT_HASH" >> $GITHUB_OUTPUT

      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: 'npm'
          cache-dependency-path: web/package-lock.json

      - name: Install frontend dependencies
        run: cd web && npm ci

      - name: Lint frontend code
        run: cd web && npm run lint:ci

      - name: Check for undefined CSS custom properties
        run: cd web && npm run lint:tokens

      - name: Check design-token consistency (strict ratchet — no raw-token creep, no slack)
        run: cd web && npm run lint:design:strict

      - name: Lint styles (stylelint — bans legacy --o2-* tokens)
        run: cd web && npm run lint:styles

      - name: Check token-file purity (token files contain tokens only)
        run: cd web && npm run lint:token-purity

      - name: Build frontend code
        env:
          NODE_OPTIONS: "--max-old-space-size=8192"
        run: cd web && npm run build

      - name: Upload frontend artifact
        uses: actions/upload-artifact@v4
        with:
          name: frontend-dist
          path: web/dist
          retention-days: 1
          if-no-files-found: error

  build_pr_image_amd64:
    name: build_pr_image_amd64
    needs: [build_frontend]
    permissions:
      id-token: write
      contents: read
      packages: write
    runs-on: ubicloud-standard-8
    steps:
      - name: Remove unused tools
        run: |
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf /opt/ghc
          sudo rm -rf "/usr/local/share/boost"
          sudo rm -rf "$AGENT_TOOLSDIRECTORY"

      - name: Clone the current repo
        uses: actions/checkout@v5
        with:
          repository: ${{ github.repository }}
          ref: ${{ inputs.branch }}
          fetch-depth: 0
          fetch-tags: true

      - name: Setup Rust Toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: nightly-2026-05-20

      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: openobserve-amd64
          save-if: ${{ inputs.branch == 'main' }}

      - name: Install Protoc
        run: |
          bash ./.github/protoc.sh

      - name: Download frontend artifact
        uses: actions/download-artifact@v4
        with:
          name: frontend-dist
          path: web/dist

      - name: Print rustc cfg
        run: rustc -C target-cpu=native --print cfg

      - name: Build and run binary
        run: |
          cargo build --features mimalloc --profile release-profiling --target x86_64-unknown-linux-gnu
          mkdir -p bin
          mv target/x86_64-unknown-linux-gnu/release-profiling/openobserve bin/openobserve

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ env.AWS_REGION }}
          role-to-assume: arn:aws:iam::058694856476:role/GitHubActionsRole
          role-session-name: GithubActionsSession

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public

      - name: Login to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build and push
        uses: docker/build-push-action@v7
        with:
          file: deploy/build/Dockerfile.pr
          context: .
          tags: |
            public.ecr.aws/zinclabs/openobserve-dev:${{ needs.build_frontend.outputs.GIT_TAG }}-${{ needs.build_frontend.outputs.GIT_HASH}}-amd64
            ghcr.io/openobserve/openobserve-dev:${{ needs.build_frontend.outputs.GIT_TAG }}-${{ needs.build_frontend.outputs.GIT_HASH}}-amd64
          push: true
          cache-from: type=gha,scope=amd64
          cache-to: type=gha,mode=max,scope=amd64
          platforms: linux/amd64

  build_pr_image_arm64:
    name: build_pr_image_arm64
    needs: [build_frontend]
    permissions:
      id-token: write
      contents: read
      packages: write
    runs-on: "ubicloud-standard-16-arm"
    steps:
      - name: Remove unused tools
        run: |
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf /opt/ghc
          sudo rm -rf "/usr/local/share/boost"
          sudo rm -rf "$AGENT_TOOLSDIRECTORY"

      - name: Clone the current repo
        uses: actions/checkout@v5
        with:
          repository: ${{ github.repository }}
          ref: ${{ inputs.branch }}
          fetch-depth: 0
          fetch-tags: true

      - name: Setup Rust Toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: nightly-2026-05-20

      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: openobserve-arm64
          save-if: ${{ inputs.branch == 'main' }}

      - name: Install Protoc
        run: |
          bash ./.github/protoc.sh

      - name: Download frontend artifact
        uses: actions/download-artifact@v4
        with:
          name: frontend-dist
          path: web/dist

      - name: Print rustc cfg
        run: rustc -C target-cpu=native --print cfg

      - name: Build and run binary
        run: |
          cargo build --features mimalloc --profile release-profiling --target aarch64-unknown-linux-gnu
          mkdir -p bin
          mv target/aarch64-unknown-linux-gnu/release-profiling/openobserve bin/openobserve

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ env.AWS_REGION }}
          role-to-assume: arn:aws:iam::058694856476:role/GitHubActionsRole
          role-session-name: GithubActionsSession

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public

      - name: Login to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build and push
        uses: docker/build-push-action@v7
        with:
          file: deploy/build/Dockerfile.pr
          context: .
          tags: |
            public.ecr.aws/zinclabs/openobserve-dev:${{ needs.build_frontend.outputs.GIT_TAG }}-${{ needs.build_frontend.outputs.GIT_HASH}}-arm64
            ghcr.io/openobserve/openobserve-dev:${{ needs.build_frontend.outputs.GIT_TAG }}-${{ needs.build_frontend.outputs.GIT_HASH}}-arm64
          push: true
          cache-from: type=gha,scope=arm64
          cache-to: type=gha,mode=max,scope=arm64
          platforms: linux/arm64

  build:
    needs: [build_pr_image_amd64, build_pr_image_arm64, build_frontend]
    if: ${{ needs.build_pr_image_amd64.result == 'success' && needs.build_pr_image_arm64.result == 'success' }}
    runs-on: ubicloud-standard-16-arm
    permissions:
      id-token: write
      contents: read
      packages: write
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ env.AWS_REGION }}
          role-to-assume: arn:aws:iam::058694856476:role/GitHubActionsRole
          role-session-name: GithubActionsSession

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public

      - name: Login to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: int128/docker-manifest-create-action@v2
        with:
          tags: |
            public.ecr.aws/zinclabs/openobserve-dev:${{ needs.build_frontend.outputs.GIT_TAG }}-${{ needs.build_frontend.outputs.GIT_HASH}}
          sources: |
            public.ecr.aws/zinclabs/openobserve-dev:${{ needs.build_frontend.outputs.GIT_TAG }}-${{ needs.build_frontend.outputs.GIT_HASH}}-amd64
            public.ecr.aws/zinclabs/openobserve-dev:${{ needs.build_frontend.outputs.GIT_TAG }}-${{ needs.build_frontend.outputs.GIT_HASH}}-arm64

      - uses: int128/docker-manifest-create-action@v2
        with:
          tags: |
            ghcr.io/openobserve/openobserve-dev:${{ needs.build_frontend.outputs.GIT_TAG }}-${{ needs.build_frontend.outputs.GIT_HASH}}
          sources: |
            ghcr.io/openobserve/openobserve-dev:${{ needs.build_frontend.outputs.GIT_TAG }}-${{ needs.build_frontend.outputs.GIT_HASH}}-amd64
            ghcr.io/openobserve/openobserve-dev:${{ needs.build_frontend.outputs.GIT_TAG }}-${{ needs.build_frontend.outputs.GIT_HASH}}-arm64

  build_pr_image_summary:
    runs-on: ubuntu-latest
    permissions: {}
    needs: [build_frontend, build_pr_image_amd64, build_pr_image_arm64, build]
    if: always()
    steps:
      - name: Check build results
        run: |
          if [ "${{ needs.build_frontend.result }}" == "success" ]; then
            echo "Frontend build passed"
          else
            echo "Frontend build failed"
            exit 1
          fi

          if [ "${{ needs.build_pr_image_amd64.result }}" == "success" ] || [ "${{ needs.build_pr_image_amd64.result }}" == "skipped" ]; then
            echo "AMD64 build passed or skipped"
          else
            echo "AMD64 build failed"
            exit 1
          fi

          if [ "${{ needs.build_pr_image_arm64.result }}" == "success" ] || [ "${{ needs.build_pr_image_arm64.result }}" == "skipped" ]; then
            echo "ARM64 build passed or skipped"
          else
            echo "ARM64 build failed"
            exit 1
          fi

          if [ "${{ needs.build.result }}" == "success" ] || [ "${{ needs.build.result }}" == "skipped" ]; then
            echo "Manifest build passed or skipped"
          else
            echo "Manifest build failed"
            exit 1
          fi

          echo "All builds completed successfully"