Improve GitHub Actions CI (#3464)

* Cleanup temp docker images
* Create the 'latest' image tag
* Fix detection if docker images should be rebuilt
* Use registry and image from non secure context

It must be possible to share docker image name between jobs as
an output, thus it can not match to any strings which are defined
as a repository secrets.

Signed-off-by: Evgeny Mironov <quic_emironov@quicinc.com>

.github/actions/docker-tag/action.yml

@@ -43,12 +43,17 @@ runs:
     - name: "Get list of changes files in the docker build context"
       shell: bash
       run: |
-        git branch --delete --force ${{ github.event.repository.default_branch }} || true
-        git fetch --no-tags --force --prune --no-recurse-submodules --depth=1 origin ${{ github.event.repository.default_branch }}:refs/remotes/origin/${{ github.event.repository.default_branch }}
-        echo "DOCKER_BUILD_CONTEXT_FILES=$(git diff --name-only origin/${{ github.event.repository.default_branch }} -- $DOCKER_BUILD_CONTEXT_FILES | tr '\n' ' ')" >> $GITHUB_ENV
+        # check if any files are changed in docker context unless it is not a default branch.
+        # for the default branch we still rebuild images every time (yet)
+        if [[ "${{ github.ref_name }}" != "${{ github.event.repository.default_branch }}" ]] ; then
+          set -x
+          git config extensions.partialClone true
+          git fetch --no-tags --unshallow --filter=tree:0
+          echo "DOCKER_BUILD_CONTEXT_FILES=$(git diff --name-only $(git merge-base origin/${{ github.event.repository.default_branch }} origin/${{ github.ref_name }})..origin/${{ github.ref_name }} -- $DOCKER_BUILD_CONTEXT_FILES | tr '\n' ' ')" >> $GITHUB_ENV
+        fi
 
     - name: "Set a docker image tag"
       id: tag
       shell: bash
-      run: echo "value=$([[ ! -z \"$DOCKER_BUILD_CONTEXT_FILES\" ]] && echo $(git rev-parse --short HEAD) || echo ${{ inputs.defaulttag }})" >> $GITHUB_OUTPUT
+      run: set -x; echo "value=$([[ \"$DOCKER_BUILD_CONTEXT_FILES\" != \"\" ]] && echo $(git rev-parse --short HEAD) || echo ${{ inputs.defaulttag }})" >> $GITHUB_OUTPUT
 

.github/workflows/ci.yml

@@ -1,6 +1,9 @@
 name: CI pipeline
 
 on:
+  push:
+    branches:
+      - develop
   pull_request:
     branches: [ develop ]
 

.github/workflows/pipeline.yml

@@ -89,8 +89,8 @@ jobs:
           dockerfile: Jenkins/fast-release/Dockerfile.ci
           docker-login: ${{ secrets.DOCKER_LOGIN }}
           docker-password: ${{ secrets.DOCKER_CREDENTIALS }}
-          docker-registry: ${{ secrets.DOCKER_REGISTRY }}
-          image-name: "${{ secrets.DOCKER_IMAGE }}-${{ matrix.id }}"
+          docker-registry: ${{ vars.DOCKER_REGISTRY }}
+          image-name: "${{ vars.DOCKER_IMAGE }}-${{ matrix.id }}"
           image-tag: ${{ needs.docker-tag.outputs.tag }}
           build-args: |
             VER_PYTHON=${{ matrix.VER_PYTHON }}
@@ -99,3 +99,22 @@ jobs:
             VER_TENSORFLOW=${{ matrix.VER_TENSORFLOW }}
             VER_ONNX=${{ matrix.VER_ONNX }}
 
+  docker-push-latest:
+    needs: [docker-tag, variants, docker-build-image]
+    runs-on: ubuntu-latest
+    strategy:
+      matrix: ${{ fromJSON(needs.variants.outputs.matrix) }}
+    steps:
+      - name: Create the 'latest' docker image tag
+        if: ${{ github.ref_name == github.event.repository.default_branch && needs.docker-tag.outputs.tag != 'latest' }}
+        run: curl -k -H "Authorization:Bearer ${{ secrets.DOCKER_CREDENTIALS }}" -X GET "https://${{ vars.DOCKER_REGISTRY }}/v2/${{ vars.DOCKER_IMAGE }}-${{ matrix.id }}/manifests/${{ needs.docker-tag.outputs.tag }}" | curl -k -d "@-" -H "Authorization:Bearer ${{ secrets.DOCKER_CREDENTIALS }}" -X PUT "https://${{ vars.DOCKER_REGISTRY }}/v2/${{ vars.DOCKER_IMAGE }}-${{ matrix.id }}/manifests/latest"
+
+  cleanup:
+    needs: [docker-tag, variants, docker-push-latest]
+    runs-on: ubuntu-latest
+    strategy:
+      matrix: ${{ fromJSON(needs.variants.outputs.matrix) }}
+    steps:
+      - name: Delete temp docker image
+        if: needs.docker-tag.outputs.tag != 'latest'
+        run: curl -k -H "Authorization:Bearer ${{ secrets.DOCKER_CREDENTIALS }}" -X DELETE "https://${{ vars.DOCKER_REGISTRY }}/v2/${{ vars.DOCKER_IMAGE }}-${{ matrix.id }}/manifests/${{ needs.docker-tag.outputs.tag }}" || true