From 15ea74a9bd42cbc3438dbfda43bd6bbe686ef9ac Mon Sep 17 00:00:00 2001 From: Srivatsa Sangli Date: Thu, 10 Sep 2026 01:33:15 +0000 Subject: [PATCH 1/3] feat(ci): add nightly build workflow for S3 + DockerHub publishing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds a nightly pipeline that builds all 4 KMM container images (operator, signimage, webhook-server, worker), publishes to S3 and DockerHub (amdpsdo/), and runs validation via the common-infra-operator orchestrator. Uses shared reusable workflows from ROCm/common-infra-operator: - nightly-resolve.yml for date-based tagging and dedup - rocm-publish.yml for S3 upload and DockerHub push - nightly-summary.yml for build summary with commit history - rocm-orchestrator.yml for validation All common-infra-operator refs SHA-pinned to 71da675. Build script validated locally — all 4 images built successfully. Co-Authored-By: Claude Sonnet 4.6 --- .github/scripts/build-images.sh | 7 ++ .github/workflows/build-images.yml | 35 +++++++++ .github/workflows/nightly-build.yml | 114 ++++++++++++++++++++++++++++ 3 files changed, 156 insertions(+) create mode 100755 .github/scripts/build-images.sh create mode 100644 .github/workflows/build-images.yml create mode 100644 .github/workflows/nightly-build.yml diff --git a/.github/scripts/build-images.sh b/.github/scripts/build-images.sh new file mode 100755 index 00000000..a4a70e68 --- /dev/null +++ b/.github/scripts/build-images.sh @@ -0,0 +1,7 @@ +#!/usr/bin/env bash +set -euo pipefail + +make docker-build && make docker-save +make signimage-build && make signimage-save +make webhookimage-build && make webhookimage-save +make workerimage-build && make workerimage-save diff --git a/.github/workflows/build-images.yml b/.github/workflows/build-images.yml new file mode 100644 index 00000000..2a18dbc5 --- /dev/null +++ b/.github/workflows/build-images.yml @@ -0,0 +1,35 @@ +name: Build Images + +on: + workflow_call: + inputs: + push_tag: + required: true + type: string + description: 'Image tag for build (e.g. v0.0.1-20260910)' + +jobs: + build: + name: Build container images + runs-on: ubuntu-24.04 + timeout-minutes: 30 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Build all KMM images + env: + IMAGE_TAG: ${{ inputs.push_tag }} + VERSION: ${{ inputs.push_tag }} + run: .github/scripts/build-images.sh + + - name: Upload image artifacts + uses: actions/upload-artifact@v4 + with: + name: build-images-${{ inputs.push_tag }} + retention-days: 1 + path: | + kernel-module-management-operator.tar.gz + kernel-module-management-signimage.tar.gz + kernel-module-management-webhook-server.tar.gz + kernel-module-management-worker.tar.gz diff --git a/.github/workflows/nightly-build.yml b/.github/workflows/nightly-build.yml new file mode 100644 index 00000000..f700cf63 --- /dev/null +++ b/.github/workflows/nightly-build.yml @@ -0,0 +1,114 @@ +name: Nightly Build + +on: + schedule: + - cron: '0 13 * * *' + workflow_dispatch: + +concurrency: + group: kmm-nightly + cancel-in-progress: true + +permissions: + contents: read + id-token: write + actions: write + +jobs: + + init: + name: Init + runs-on: ubuntu-24.04 + outputs: + project_version: ${{ steps.version.outputs.project_version }} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Read project version + id: version + run: | + VERSION=$(grep -m1 'VERSION ?=' Makefile | awk '{print $NF}') + echo "project_version=${VERSION}" >> "$GITHUB_OUTPUT" + echo "Project version: ${VERSION}" + + resolve: + name: Resolve + needs: init + uses: ROCm/common-infra-operator/.github/workflows/nightly-resolve.yml@71da675c5fba3328eb470e13a0fc9ad1401f5456 + with: + component: kmm + version: ${{ needs.init.outputs.project_version }} + s3_component_prefix: kernel-module-management + trigger_event: ${{ github.event_name }} + trigger_sha: ${{ github.sha }} + + build-images: + name: Build Images + needs: resolve + if: needs.resolve.outputs.build_needed == 'true' + uses: ./.github/workflows/build-images.yml + with: + push_tag: ${{ needs.resolve.outputs.push_tag }} + + publish: + name: Publish + needs: [resolve, build-images] + if: >- + always() + && needs.resolve.outputs.build_needed == 'true' + && needs.build-images.result == 'success' + uses: ROCm/common-infra-operator/.github/workflows/rocm-publish.yml@71da675c5fba3328eb470e13a0fc9ad1401f5456 + with: + component: kmm + image_tag: ${{ needs.resolve.outputs.push_tag }} + version: ${{ needs.resolve.outputs.version }} + suffix: ${{ needs.resolve.outputs.suffix }} + s3_prefix: ${{ needs.resolve.outputs.s3_prefix }} + trigger_sha: ${{ github.sha }} + s3_bucket: ${{ vars.THEROCK_BUCKET_NAME }} + artifact_names: build-images-${{ needs.resolve.outputs.push_tag }} + s3_file_globs: "*.tar.gz" + docker_images: | + kernel-module-management-operator.tar.gz|rocm/kernel-module-management-operator:${{ needs.resolve.outputs.push_tag }}|amdpsdo/kernel-module-management-operator:${{ needs.resolve.outputs.push_tag }}|false + kernel-module-management-signimage.tar.gz|rocm/kernel-module-management-signimage:${{ needs.resolve.outputs.push_tag }}|amdpsdo/kernel-module-management-signimage:${{ needs.resolve.outputs.push_tag }}|false + kernel-module-management-webhook-server.tar.gz|rocm/kernel-module-management-webhook-server:${{ needs.resolve.outputs.push_tag }}|amdpsdo/kernel-module-management-webhook-server:${{ needs.resolve.outputs.push_tag }}|false + kernel-module-management-worker.tar.gz|rocm/kernel-module-management-worker:${{ needs.resolve.outputs.push_tag }}|amdpsdo/kernel-module-management-worker:${{ needs.resolve.outputs.push_tag }}|false + secrets: + ROCK_CI_S3_SECRET: ${{ secrets.ROCK_CI_S3_SECRET }} + DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }} + DOCKER_USERNAME: ${{ vars.DOCKER_USERNAME }} + + validate: + name: Validate + needs: [resolve, publish] + if: always() && needs.publish.result == 'success' + uses: ROCm/common-infra-operator/.github/workflows/rocm-orchestrator.yml@71da675c5fba3328eb470e13a0fc9ad1401f5456 + with: + component: kmm + scenario: nightly + s3_prefix: ${{ needs.resolve.outputs.s3_prefix }} + + results: + name: Summary + needs: [resolve, build-images, publish, validate] + if: always() && needs.resolve.outputs.build_needed == 'true' + uses: ROCm/common-infra-operator/.github/workflows/nightly-summary.yml@71da675c5fba3328eb470e13a0fc9ad1401f5456 + with: + component: kmm + push_tag: ${{ needs.resolve.outputs.push_tag }} + version: ${{ needs.resolve.outputs.version }} + s3_prefix: ${{ needs.resolve.outputs.s3_prefix }} + s3_bucket: ${{ vars.THEROCK_BUCKET_NAME }} + trigger_sha: ${{ github.sha }} + prev_nightly_sha: ${{ needs.resolve.outputs.prev_nightly_sha }} + commit_log: ${{ needs.resolve.outputs.commit_log }} + stages: | + Build Images|${{ needs.build-images.result }} + Publish|${{ needs.publish.result }} + Validate|${{ needs.validate.result }} + docker_images: | + amdpsdo/kernel-module-management-operator:${{ needs.resolve.outputs.push_tag }} + amdpsdo/kernel-module-management-signimage:${{ needs.resolve.outputs.push_tag }} + amdpsdo/kernel-module-management-webhook-server:${{ needs.resolve.outputs.push_tag }} + amdpsdo/kernel-module-management-worker:${{ needs.resolve.outputs.push_tag }} From 852d20230527da65c726b062e13280e98db47b97 Mon Sep 17 00:00:00 2001 From: Srivatsa Sangli Date: Thu, 10 Sep 2026 01:39:19 +0000 Subject: [PATCH 2/3] ci: add temporary PR trigger for workflow validation Adds pull_request trigger (path-filtered to workflow files) so the nightly build can be validated on the PR before merging. Publish is skipped on PR events since fork PRs lack access to repo secrets. Remove the PR trigger before merging. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/nightly-build.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/nightly-build.yml b/.github/workflows/nightly-build.yml index f700cf63..0de18b73 100644 --- a/.github/workflows/nightly-build.yml +++ b/.github/workflows/nightly-build.yml @@ -4,6 +4,12 @@ on: schedule: - cron: '0 13 * * *' workflow_dispatch: + pull_request: + branches: [main] + paths: + - '.github/workflows/nightly-build.yml' + - '.github/workflows/build-images.yml' + - '.github/scripts/**' concurrency: group: kmm-nightly @@ -56,6 +62,7 @@ jobs: needs: [resolve, build-images] if: >- always() + && github.event_name != 'pull_request' && needs.resolve.outputs.build_needed == 'true' && needs.build-images.result == 'success' uses: ROCm/common-infra-operator/.github/workflows/rocm-publish.yml@71da675c5fba3328eb470e13a0fc9ad1401f5456 From 0c42ee890466243ccc8ca6bb740d9bfaf34e00cd Mon Sep 17 00:00:00 2001 From: Srivatsa Sangli Date: Thu, 10 Sep 2026 01:49:01 +0000 Subject: [PATCH 3/3] ci: remove temporary PR trigger after successful validation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit All stages passed on PR run — remove the temporary pull_request trigger and PR-event skip condition on publish. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/nightly-build.yml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/.github/workflows/nightly-build.yml b/.github/workflows/nightly-build.yml index 0de18b73..f700cf63 100644 --- a/.github/workflows/nightly-build.yml +++ b/.github/workflows/nightly-build.yml @@ -4,12 +4,6 @@ on: schedule: - cron: '0 13 * * *' workflow_dispatch: - pull_request: - branches: [main] - paths: - - '.github/workflows/nightly-build.yml' - - '.github/workflows/build-images.yml' - - '.github/scripts/**' concurrency: group: kmm-nightly @@ -62,7 +56,6 @@ jobs: needs: [resolve, build-images] if: >- always() - && github.event_name != 'pull_request' && needs.resolve.outputs.build_needed == 'true' && needs.build-images.result == 'success' uses: ROCm/common-infra-operator/.github/workflows/rocm-publish.yml@71da675c5fba3328eb470e13a0fc9ad1401f5456