additional-ci-image-checks.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
---
name: Additional CI image checks
on:  # yamllint disable-line rule:truthy
  workflow_call:
    inputs:
      runs-on-as-json-default:
        description: "The array of labels (in json form) determining default runner used for the build."
        required: true
        type: string
      runs-on-as-json-public:
        description: "The array of labels (in json form) determining public runners."
        required: true
        type: string
      runs-on-as-json-self-hosted:
        description: "The array of labels (in json form) determining self-hosted runners."
        required: true
        type: string
      image-tag:
        description: "Tag to set for the image"
        required: true
        type: string
      python-versions:
        description: "The list of python versions (stringified JSON array) to run the tests on."
        required: true
        type: string
      branch:
        description: "Branch used to run the CI jobs in (main/v2_*_test)."
        required: true
        type: string
      constraints-branch:
        description: "Branch used to get constraints from"
        required: true
        type: string
      default-python-version:
        description: "Which version of python should be used by default"
        required: true
        type: string
      upgrade-to-newer-dependencies:
        description: "Whether to upgrade to newer dependencies (true/false)"
        required: true
        type: string
      skip-pre-commits:
        description: "Whether to skip pre-commits (true/false)"
        required: true
        type: string
      docker-cache:
        description: "Docker cache specification to build the image (registry, local, disabled)."
        required: true
        type: string
      canary-run:
        description: "Whether this is a canary run (true/false)"
        required: true
        type: string
      latest-versions-only:
        description: "Whether to run only latest versions (true/false)"
        required: true
        type: string
      include-success-outputs:
        description: "Whether to include success outputs (true/false)"
        required: true
        type: string
      debug-resources:
        description: "Whether to debug resources (true/false)"
        required: true
        type: string
jobs:
  # Push early BuildX cache to GitHub Registry in Apache repository, This cache does not wait for all the
  # tests to complete - it is run very early in the build process for "main" merges in order to refresh
  # cache using the current constraints. This will speed up cache refresh in cases when pyproject.toml
  # changes or in case of Dockerfile changes. Failure in this step is not a problem (at most it will
  # delay cache refresh. It does not attempt to upgrade to newer dependencies.
  # We only push CI cache as PROD cache usually does not gain as much from fresh cache because
  # it uses prepared airflow and provider packages that invalidate the cache anyway most of the time
  push-early-buildx-cache-to-github-registry:
    name: Push Early Image Cache
    uses: ./.github/workflows/push-image-cache.yml
    permissions:
      contents: read
      # This write is only given here for `push` events from "apache/airflow" repo. It is not given for PRs
      # from forks. This is to prevent malicious PRs from creating images in the "apache/airflow" repo.
      # For regular build for PRS this "build-prod-images" workflow will be skipped anyway by the
      # "in-workflow-build" condition
      packages: write
    secrets: inherit
    with:
      runs-on-as-json-public: ${{ inputs.runs-on-as-json-public }}
      runs-on-as-json-self-hosted: ${{ inputs.runs-on-as-json-self-hosted }}
      cache-type: "Early"
      include-prod-images: "false"
      push-latest-images: "false"
      platform: "linux/amd64"
      python-versions: ${{ inputs.python-versions }}
      branch: ${{ inputs.branch }}
      constraints-branch: ${{ inputs.constraints-branch }}
      use-uv: "true"
      include-success-outputs: ${{ inputs.include-success-outputs }}
      docker-cache: ${{ inputs.docker-cache }}
    if: inputs.branch == 'main'

  # Check that after earlier cache push, breeze command will build quickly
  check-that-image-builds-quickly:
    timeout-minutes: 11
    name: Check that image builds quickly
    runs-on: ${{ fromJSON(inputs.runs-on-as-json-public) }}
    env:
      UPGRADE_TO_NEWER_DEPENDENCIES: false
      PYTHON_MAJOR_MINOR_VERSION: ${{ inputs.default-python-version }}
      PYTHON_VERSION: ${{ inputs.default-python-version }}
      GITHUB_REPOSITORY: ${{ github.repository }}
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      GITHUB_USERNAME: ${{ github.actor }}
      VERBOSE: "true"
    if: inputs.branch == 'main'
    steps:
      - name: "Cleanup repo"
        shell: bash
        run: docker run -v "${GITHUB_WORKSPACE}:/workspace" -u 0:0 bash -c "rm -rf /workspace/*"
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: "Cleanup docker"
        run: ./scripts/ci/cleanup_docker.sh
      - name: "Install Breeze"
        uses: ./.github/actions/breeze
      - name: "Login to ghcr.io"
        run: echo "${{ env.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
      - name: "Check that image builds quickly"
        run: breeze shell --max-time 600 --platform "linux/amd64"

  # This is only a check if ARM images are successfully building when committer runs PR from
  # Apache repository. This is needed in case you want to fix failing cache job in "canary" run
  # There is no point in running this one in "canary" run, because the above step is doing the
  # same build anyway.
  build-ci-arm-images:
    name: Build CI ARM images (in-workflow)
    uses: ./.github/workflows/ci-image-build.yml
    permissions:
      contents: read
      packages: write
    secrets: inherit
    with:
      push-image: "false"
      runs-on-as-json-public: ${{ inputs.runs-on-as-json-public }}
      runs-on-as-json-self-hosted: ${{ inputs.runs-on-as-json-self-hosted }}
      image-tag: ${{ inputs.image-tag }}
      python-versions: ${{ inputs.python-versions }}
      platform: "linux/arm64"
      branch: ${{ inputs.branch }}
      constraints-branch: ${{ inputs.constraints-branch }}
      use-uv: "true"
      upgrade-to-newer-dependencies: ${{ inputs.upgrade-to-newer-dependencies }}
      docker-cache: ${{ inputs.docker-cache }}