Make the multi-arch image build tolerate transient failures

.github/workflows/build.yml

@@ -34,12 +34,32 @@ env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
 jobs:
+  prepare:
+    runs-on: ubuntu-latest
+
+    outputs:
+      ruby_sha: ${{ steps.ruby_sha.outputs.ruby_sha }}
+
+    steps:
+    - name: Resolve ruby_sha
+      id: ruby_sha
+      run: |-
+        if [ "$ruby_version" = master ] && [ -z "$ruby_sha" ]; then
+          for attempt in 1 2 3; do
+            ruby_sha=$(gh api repos/ruby/ruby/commits/master --jq .sha) && break
+            sleep 30
+          done
+          test -n "$ruby_sha"
+        fi
+        echo "ruby_sha=$ruby_sha" >> "$GITHUB_OUTPUT"
+
   build:
+    needs: prepare
+
     strategy:
       fail-fast: false
       matrix:
         debug_suffix: ['', '-debug']
-        dev_suffix: ['', '-dev']
         ubuntu_version:
           - resolute
           - noble
@@ -49,11 +69,8 @@ jobs:
     runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
 
     env:
-      push: false
+      ruby_sha: ${{ needs.prepare.outputs.ruby_sha }}
       ubuntu_version: "${{ matrix.ubuntu_version }}"
-      tag_suffix: "-${{ matrix.arch }}-${{ github.run_id }}"
-      push_tags: ${{ github.event.inputs.ruby_version || github.event.client_payload.ruby_version || 'master' }}${{ matrix.debug_suffix }}${{ matrix.dev_suffix }}-${{ matrix.ubuntu_version }}-${{ matrix.arch }}-${{ github.run_id }}
-      dev_suffix: ${{ matrix.dev_suffix }}
       debug_suffix: ${{ matrix.debug_suffix }}
 
     steps:
@@ -70,54 +87,46 @@ jobs:
         username: ${{ secrets.GHCR_USER }}
         password: ${{ secrets.GHCR_ACCESS_TOKEN }}
 
+    - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
     - run: |
-        if [ "${{ env.dev_suffix }}" = "-dev" ]; then
-          echo "target=development" >> $GITHUB_ENV
-        else
-          echo "target=ruby" >> $GITHUB_ENV
-        fi
         if [ "${{ env.debug_suffix }}" = "-debug" ]; then
           echo "cppflags=-DENABLE_PATH_CHECK=0 -DRUBY_DEBUG=1" >> $GITHUB_ENV
           echo "optflags=-O3 -fno-inline" >> $GITHUB_ENV
         fi
 
-    - name: Build docker image
-      run: |-
-        rake docker:build ruby_version=${{ env.ruby_version }} \
-                          ubuntu_version=${{ env.ubuntu_version }} \
-                          arch=linux/${{ matrix.arch }} \
-                          image_version_suffix=${{ env.debug_suffix }}${{ env.dev_suffix }} \
-                          tag_suffix=${{ env.tag_suffix }} \
-                          optflags="${{ env.optflags }}" \
-                          cppflags="${{ env.cppflags }}" \
-                          target=${{ env.target }} \
-
-    - name: List images
-      run: docker images
-
-    - name: Push docker image to rubylang
-      if: "${{ env.push_tags }}"
+    - name: Build and push docker images
       run: |-
-        push_tags="${{ env.push_tags }}"
-        for tag in $push_tags; do
-          docker push rubylang/ruby:$tag
+        mkdir -p "$RUNNER_TEMP/digests"
+        for target in ruby development; do
+          for attempt in 1 2 3; do
+            rake docker:build ruby_version=${{ env.ruby_version }} \
+                              ubuntu_version=${{ env.ubuntu_version }} \
+                              arch=linux/${{ matrix.arch }} \
+                              optflags="${{ env.optflags }}" \
+                              cppflags="${{ env.cppflags }}" \
+                              target=$target \
+                              push_registries="rubylang ghcr.io/ruby" \
+                              metadata_file="$RUNNER_TEMP/$target.json" && break
+            if [ $attempt = 3 ]; then exit 1; fi
+            sleep 60
+          done
+          jq -r '."containerimage.digest"' "$RUNNER_TEMP/$target.json" > "$RUNNER_TEMP/digests/$target-${{ matrix.arch }}"
         done
 
-    - name: Push docker image to ghcr.io/ruby
-      if: "${{ env.push_tags }}"
-      run: |-
-        push_tags="${{ env.push_tags }}"
-        for tag in $push_tags; do
-          docker tag rubylang/ruby:$tag ghcr.io/ruby/ruby:$tag
-          docker push ghcr.io/ruby/ruby:$tag
-        done
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: digests${{ matrix.debug_suffix }}-${{ matrix.ubuntu_version }}-${{ matrix.arch }}
+        path: ${{ runner.temp }}/digests/*
+        if-no-files-found: error
+        retention-days: 1
 
     - uses: ruby/action-slack@d260b61aa817726d5bedd22dd6cc305787fa4cdd # v4.0.0
       with:
         payload: |
           {
             "attachments": [{
-              "text": "build ${{ job.status }}: ${{ matrix.ubuntu_version }} ${{ matrix.arch }} ${{ matrix.debug_suffix }} ${{ matrix.dev_suffix }} <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>",
+              "text": "build ${{ job.status }}: ${{ matrix.ubuntu_version }} ${{ matrix.arch }} ${{ matrix.debug_suffix }} <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>",
               "color": "danger"
             }]
           }
@@ -129,16 +138,20 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        registry_name: [rubylang, ghcr.io/ruby]
-        image_version_suffix: ['', '-dev', '-debug', '-debug-dev']
+        debug_suffix: ['', '-debug']
         ubuntu_version:
           - resolute
           - noble
           - jammy
 
     runs-on: ubuntu-latest
 
-    needs: build
+    needs: [prepare, build]
+
+    if: ${{ !cancelled() && needs.prepare.result == 'success' }}
+
+    env:
+      ruby_sha: ${{ needs.prepare.outputs.ruby_sha }}
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -147,51 +160,40 @@ jobs:
       with:
         username: ${{ secrets.DOCKER_USER }}
         password: ${{ secrets.DOCKER_PASS }}
-      if: ${{ matrix.registry_name == 'rubylang' }}
 
     - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         registry: ghcr.io
         username: ${{ secrets.GHCR_USER }}
         password: ${{ secrets.GHCR_ACCESS_TOKEN }}
-      if: ${{ matrix.registry_name == 'ghcr.io/ruby' }}
 
-    # Make sure the sha of "master-{sha}" tags agrees with the RUBY_REVISION in the image
-    - name: Extract ruby_sha
-      run: echo "ruby_sha=$(docker run "$docker_image" ruby -e 'puts RUBY_REVISION')" >> "$GITHUB_ENV"
-      env:
-        # In docker:manifest:create:
-        #   tags = ["master#{version_suffix}", ...]                                                       #=> "master${{ matrix.image_version_suffix }}"
-        #   tags.collect! {|t| "#{docker_image_name}:#{t}-#{ubuntu_version(ruby_version)}#{tag_suffix}" } #=> "${{ matrix.registry_name}}/ruby:master${{ matrix.image_version_suffix }}-${{ matrix.ubuntu_version }}"
-        #   manifest_name = "#{tags[0]}-#{arch}"                                                          #=> "${{ matrix.registry_name}}/ruby:master${{ matrix.image_version_suffix }}-${{ matrix.ubuntu_version }}-amd64"
-        #   manifest_name = "#{manifest_name}-#{manifest_suffix}" if manifest_suffix                      #=> "${{ matrix.registry_name}}/ruby:master${{ matrix.image_version_suffix }}-${{ matrix.ubuntu_version }}-amd64-${{ github.run_id }}"
-        docker_image: ${{ matrix.registry_name}}/ruby:master${{ matrix.image_version_suffix }}-${{ matrix.ubuntu_version }}-amd64-${{ github.run_id }}
-      if: ${{ (github.event.inputs.ruby_version || github.event.client_payload.ruby_version || 'master') == 'master' && (github.event.inputs.ruby_sha || github.event.client_payload.ruby_sha || '') == '' }}
-
-    - name: Create manifest for ${{ matrix.registry_name }}
-      run: |-
-        rake docker:manifest:create \
-             registry_name="${{ matrix.registry_name }}" \
-             ruby_version="${{ env.ruby_version }}" \
-             ubuntu_version="${{ matrix.ubuntu_version }}" \
-             architectures="amd64 arm64" \
-             manifest_suffix=${{ github.run_id }} \
-             image_version_suffix=${{ matrix.image_version_suffix }}
-
-    - name: Push manifest to ${{ matrix.registry_name }}
+    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        pattern: digests${{ matrix.debug_suffix }}-${{ matrix.ubuntu_version }}-*
+        path: ${{ runner.temp }}/digests
+        merge-multiple: true
+
+    - name: Create and push manifests
       run: |-
-        rake docker:manifest:push \
-             registry_name="${{ matrix.registry_name }}" \
-             ruby_version="${{ env.ruby_version }}" \
-             ubuntu_version="${{ matrix.ubuntu_version }}" \
-             image_version_suffix=${{ matrix.image_version_suffix }}
+        for target in ruby development; do
+          if [ $target = development ]; then dev_suffix=-dev; else dev_suffix=; fi
+          digests=$(cat "$RUNNER_TEMP/digests/$target-amd64" "$RUNNER_TEMP/digests/$target-arm64")
+          for registry_name in rubylang ghcr.io/ruby; do
+            rake docker:manifest:create \
+                 registry_name="$registry_name" \
+                 ruby_version="${{ env.ruby_version }}" \
+                 ubuntu_version="${{ matrix.ubuntu_version }}" \
+                 image_version_suffix=${{ matrix.debug_suffix }}$dev_suffix \
+                 digests="$digests"
+          done
+        done
 
     - uses: ruby/action-slack@d260b61aa817726d5bedd22dd6cc305787fa4cdd # v4.0.0
       with:
         payload: |
           {
             "attachments": [{
-              "text": "deploy_multiarch ${{ job.status }}: ${{ matrix.registry_name }} / ${{ matrix.ubuntu_version }} ${{ matrix.image_version_suffix }} <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>",
+              "text": "deploy_multiarch ${{ job.status }}: ${{ matrix.ubuntu_version }} ${{ matrix.debug_suffix }} <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>",
               "color": "danger"
             }]
           }