feat(evalboard): run the wall-clock signal beside the turn budget, be… #77
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Docker Image | |
| # Builds the coder-eval-agent container image and pushes it to GitHub | |
| # Container Registry (ghcr.io) on every push to main. | |
| # | |
| # Tags applied: | |
| # :latest — always points at tip-of-main | |
| # :sha-<short-sha> — immutable per-commit tag | |
| # | |
| # The authoritative `:<version>` tag is published by release.yml, in the same | |
| # job that cuts the release (where pyproject is already bumped). This workflow | |
| # runs on the triggering commit, BEFORE the bump, so it cannot tag the release | |
| # version -- it would lag by one release and mislabel the image -- so it | |
| # deliberately no longer pushes a version tag. | |
| # | |
| # Auth: built-in GITHUB_TOKEN. No PAT, no Azure setup. The package inherits | |
| # the visibility of this repo (private), and is then promoted to `internal` | |
| # so any UiPath org member can pull — matching the convention used by | |
| # cloud-hypervisor, playground-web-service, flow-workbench/registry, etc. | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| concurrency: | |
| group: docker-publish-${{ github.ref }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| packages: write # push images to ghcr.io; also lets us PATCH visibility | |
| env: | |
| REGISTRY: ghcr.io | |
| # Image path under the org. GHCR requires lowercase; the repo name is | |
| # already lowercase. The image name (coder-eval-agent) matches what | |
| # `make docker-image` tags locally. | |
| IMAGE_NAME: ${{ github.repository_owner }}/coder-eval-agent | |
| jobs: | |
| publish: | |
| name: Build and push to GHCR | |
| runs-on: uipath-ubuntu-latest | |
| # Skip semantic-release's own commit so we don't double-build on the | |
| # version-bump push. | |
| if: "!contains(github.event.head_commit.message, 'chore(release):')" | |
| timeout-minutes: 30 | |
| # No SAFE_CHAIN_MINIMUM_PACKAGE_AGE_EXCLUSIONS on purpose: nothing installs on the | |
| # host here, and the Docker build doesn't inherit job env (it uses its own ARG). | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Read version from pyproject.toml | |
| id: ver | |
| run: | | |
| VERSION=$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])") | |
| SHORT_SHA=$(git rev-parse --short HEAD) | |
| # Lowercase the owner since GHCR enforces it. | |
| OWNER_LC=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]') | |
| echo "version=${VERSION}" >> "$GITHUB_OUTPUT" | |
| echo "short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT" | |
| echo "owner_lc=${OWNER_LC}" >> "$GITHUB_OUTPUT" | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push image | |
| uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 | |
| with: | |
| context: . | |
| file: docker/Dockerfile | |
| push: true | |
| tags: | | |
| ${{ env.REGISTRY }}/${{ steps.ver.outputs.owner_lc }}/coder-eval-agent:latest | |
| ${{ env.REGISTRY }}/${{ steps.ver.outputs.owner_lc }}/coder-eval-agent:sha-${{ steps.ver.outputs.short_sha }} | |
| build-args: | | |
| CODER_EVAL_VERSION=${{ steps.ver.outputs.version }} | |
| secrets: | | |
| "uv_index_username=${{ secrets.UV_INDEX_UIPATH_USERNAME }}" | |
| "uv_index_password=${{ secrets.UV_INDEX_UIPATH_PASSWORD }}" | |
| cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ steps.ver.outputs.owner_lc }}/coder-eval-agent:buildcache | |
| cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ steps.ver.outputs.owner_lc }}/coder-eval-agent:buildcache,mode=max | |
| - name: Ensure package visibility is `internal` | |
| # The first push creates the package as `private` (inherits repo | |
| # visibility). Promote to `internal` so any UiPath org member can | |
| # pull, matching the convention used by other org packages. This | |
| # is idempotent: a no-op once visibility is already `internal`. | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| PKG="coder-eval-agent" | |
| OWNER="${{ steps.ver.outputs.owner_lc }}" | |
| # url-encode the slash if the package name ever grows one | |
| gh api -X PATCH "orgs/${OWNER}/packages/container/${PKG}" \ | |
| -f visibility=internal 2>&1 || \ | |
| echo "WARN: could not set visibility (package may not exist yet on first run, or token lacks org admin)" |