已合并
[v2.7.1] Add CI Docker images build workflow #43047
wangqi创建于 7月28日
[v2.7.1] Add CI Docker images build workflow #43047
已合并
共 1 个文件变更+118-0
| @@ -0,0 +1,118 @@ | |||
| 1 | +name: Build v2.7.1 build/test Docker Images | ||
| 2 | + | ||
| 3 | +on: | ||
| 4 | + workflow_dispatch: | ||
| 5 | + inputs: | ||
| 6 | + tag: | ||
| 7 | + description: 'Single image tag to build (without timestamp). Leave empty to build all.' | ||
| 8 | + required: false | ||
| 9 | + type: string | ||
| 10 | + push: | ||
| 11 | + paths: | ||
| 12 | + - .ci/docker/** | ||
| 13 | + - .github/workflows/build-docker-images.yml | ||
| 14 | + | ||
| 15 | +env: | ||
| 16 | + REGISTRY: swr.cn-north-4.myhuaweicloud.com | ||
| 17 | + SWR_ORG: frameworkptadapter | ||
| 18 | + IMAGE_NAME: pytorch | ||
| 19 | + | ||
| 20 | +jobs: | ||
| 21 | + matrix: | ||
| 22 | + runs-on: ubuntu-latest | ||
| 23 | + outputs: | ||
| 24 | + tags: ${{ steps.set.outputs.tags }} | ||
| 25 | + steps: | ||
| 26 | + - id: set | ||
| 27 | + run: | | ||
| 28 | + if [ -n "${{ inputs.tag }}" ]; then | ||
| 29 | + TAGS='["${{ inputs.tag }}"]' | ||
| 30 | + else | ||
| 31 | + TAGS='["torch-npu-builder-x86_64-torch2.7.1","torch-npu-builder-aarch64-torch2.7.1","torch-npu-test-x86_64-cann-a1-py3.10-torch2.7.1","torch-npu-test-x86_64-cann-a2-py3.10-torch2.7.1","torch-npu-test-x86_64-cann-a3-py3.10-torch2.7.1","torch-npu-test-aarch64-cann-a1-py3.10-torch2.7.1","torch-npu-test-aarch64-cann-a2-py3.10-torch2.7.1","torch-npu-test-aarch64-cann-a3-py3.10-torch2.7.1"]' | ||
| 32 | + fi | ||
| 33 | + echo "tags=${TAGS}" >> $GITHUB_OUTPUT | ||
| 34 | + | ||
| 35 | + build: | ||
| 36 | + needs: matrix | ||
| 37 | + permissions: | ||
| 38 | + contents: read | ||
| 39 | + strategy: | ||
| 40 | + fail-fast: false | ||
| 41 | + matrix: | ||
| 42 | + tag: ${{ fromJSON(needs.matrix.outputs.tags) }} | ||
| 43 | + runs-on: ${{ contains(matrix.tag, 'x86_64') && 'ubuntu-latest' || 'ubuntu-22.04-arm' }} | ||
| 44 | + steps: | ||
| 45 | + - name: Free up disk space | ||
| 46 | + run: | | ||
| 47 | + sudo rm -rf /usr/local/lib/android /opt/ghc /usr/local/share/boost | ||
| 48 | + sudo rm -rf /usr/share/dotnet /usr/local/share/powershell | ||
| 49 | + sudo rm -rf /opt/hostedtoolcache | ||
| 50 | + docker system prune -af | ||
| 51 | + sudo apt clean && sudo apt autoremove -y | ||
| 52 | + df -h | ||
| 53 | + | ||
| 54 | + - name: Checkout repository | ||
| 55 | + uses: actions/checkout@v4 | ||
| 56 | + | ||
| 57 | + - name: Log in to SWR | ||
| 58 | + uses: docker/login-action@v3 | ||
| 59 | + with: | ||
| 60 | + registry: ${{ env.REGISTRY }} | ||
| 61 | + username: ${{ secrets.SWR_USERNAME }} | ||
| 62 | + password: ${{ secrets.SWR_PASSWORD }} | ||
| 63 | + | ||
| 64 | + - name: Build and push image | ||
| 65 | + run: | | ||
| 66 | + TIMESTAMP=$(date -u +%Y%m%d%H%M) | ||
| 67 | + cd .ci/docker | ||
| 68 | + chmod +x ./docker_build.sh | ||
| 69 | + TIMESTAMP=${TIMESTAMP} ./docker_build.sh ${{ matrix.tag }} | ||
| 70 | + | ||
| 71 | + IMAGE_TAG="${{ matrix.tag }}-${TIMESTAMP}" | ||
| 72 | + REMOTE_IMAGE="${{ env.REGISTRY }}/${{ env.SWR_ORG }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}" | ||
| 73 | + docker tag "${IMAGE_TAG}" "${REMOTE_IMAGE}" | ||
| 74 | + docker push "${REMOTE_IMAGE}" | ||
| 75 | + mkdir -p /tmp/result | ||
| 76 | + echo "${REMOTE_IMAGE}" > "/tmp/result/${{ matrix.tag }}.txt" | ||
 | |||
| 77 | + echo "Pushed ${REMOTE_IMAGE}" | ||
| 78 | + | ||
| 79 | + - name: Upload result | ||
| 80 | + if: always() | ||
| 81 | + uses: actions/upload-artifact@v4 | ||
| 82 | + with: | ||
| 83 | + name: result-${{ matrix.tag }} | ||
| 84 | + path: /tmp/result/${{ matrix.tag }}.txt | ||
| 85 | + retention-days: 1 | ||
| 86 | + | ||
| 87 | + summary: | ||
| 88 | + needs: [matrix, build] | ||
| 89 | + runs-on: ubuntu-latest | ||
| 90 | + if: always() | ||
| 91 | + steps: | ||
| 92 | + - name: Download results | ||
| 93 | + uses: actions/download-artifact@v4 | ||
| 94 | + with: | ||
| 95 | + pattern: result-* | ||
| 96 | + path: /tmp/results | ||
| 97 | + merge-multiple: true | ||
| 98 | + | ||
| 99 | + - name: Generate summary | ||
| 100 | + run: | | ||
| 101 | + echo "## Docker Image Build Summary" >> $GITHUB_STEP_SUMMARY | ||
| 102 | + echo "" >> $GITHUB_STEP_SUMMARY | ||
| 103 | + echo "| # | Image | Pull Command |" >> $GITHUB_STEP_SUMMARY | ||
| 104 | + echo "|---|-------|-------------|" >> $GITHUB_STEP_SUMMARY | ||
| 105 | + | ||
| 106 | + if [ -d /tmp/results ] && [ "$(ls -A /tmp/results 2>/dev/null)" ]; then | ||
| 107 | + COUNT=1 | ||
| 108 | + for f in /tmp/results/*.txt; do | ||
| 109 | + IMAGE=$(cat "$f") | ||
| 110 | + echo "| ${COUNT} | \`${IMAGE##*:}\` | \`docker pull ${IMAGE}\` |" >> $GITHUB_STEP_SUMMARY | ||
| 111 | + COUNT=$((COUNT + 1)) | ||
| 112 | + done | ||
| 113 | + else | ||
| 114 | + echo "| - | No images built | - |" >> $GITHUB_STEP_SUMMARY | ||
| 115 | + fi | ||
| 116 | + | ||
| 117 | + echo "" >> $GITHUB_STEP_SUMMARY | ||
| 118 | + echo "**Registry:** \`${{ env.REGISTRY }}/${{ env.SWR_ORG }}/${{ env.IMAGE_NAME }}\`" >> $GITHUB_STEP_SUMMARY | ||
🟡 Medium Priority
在
buildjob 的run:块中，${{ matrix.tag }}未经任何转义或校验就直接嵌入 shell 命令行。当用户通过workflow_dispatch手动触发并提供一个包含 shell 元字符（如;、$()、反引号）的tag值时，该值将流经matrixjob 的输出 →fromJSON→matrix.tag，最终在三个位置造成注入：./docker_build.sh ${{ matrix.tag }}— 若 tag 为foo; echo hacked，则echo hacked会作为独立命令执行。IMAGE_TAG="${{ matrix.tag }}-${TIMESTAMP}"— 若 tag 中含$(...)，会在变量赋值时触发命令替换。"/tmp/result/${{ matrix.tag }}.txt"— 若 tag 中含/，会导致文件路径错误、写入失败。虽然只有具备仓库写权限的用户才能触发
workflow_dispatch，但作为纵深防御，不应信任该输入。这也会导致误输入特殊字符时工作流行为异常（而非给出清晰的报错）。建议：将
matrix.tag通过环境变量传入 shell，避免直接拼接。在run:块开头添加MATRIX_TAG="${{ matrix.tag }}"并用 shell 变量替换后续三处引用：第 69 行改为./docker_build.sh "${MATRIX_TAG}"，第 71 行改为IMAGE_TAG="${MATRIX_TAG}-${TIMESTAMP}"，第 76 行改为echo "${REMOTE_IMAGE}" > "/tmp/result/${MATRIX_TAG}.txt"。同时在 matrix job 中对inputs.tag做基本校验（如仅允许字母、数字、连字符、点号），对非法输入直接 fail-fast。