#244 - Add CI workflow to publish container images to NGC staging - #245
Open
chloecrozier wants to merge 4 commits into
Open
#244 - Add CI workflow to publish container images to NGC staging#245chloecrozier wants to merge 4 commits into
chloecrozier wants to merge 4 commits into
Conversation
Building and pushing the container to nvcr.io/nvstaging/holoscan/daqiri required two machines and a manual manifest merge, which already produced one release whose two architectures came from different source revisions. Build both arches natively on tag, then join them into a single tag. The workflow calls scripts/build-container.sh rather than repeating its build args so CI and local builds cannot drift, and verifies the git tag matches VERSION before publishing. Signed-off-by: Chloe Crozier <[email protected]>
A build-only dry run failed on repositories without the NGC_API_KEY secret, even though nothing is pushed. The CUDA base image pulls anonymously, so gate the login on the same condition as the push. Signed-off-by: Chloe Crozier <[email protected]>
Contributor
|
| Filename | Overview |
|---|---|
| .github/workflows/container-publish.yml | Adds the multi-architecture NGC publishing workflow and resolves both prior findings by strictly rejecting malformed release tags before normalization and pinning checkout to an immutable commit. |
Reviews (3): Last reviewed commit: "#244 - Pin actions/checkout to a commit ..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
The version guard normalized tag fields with awk %d, which reads only a leading integer. A prerelease tag such as v2026.07.00-rc1 therefore compared equal to VERSION and published over the stable 2026.7.0 image, since the image tag is derived from VERSION rather than from the tag. Short tags (v2026.7) and trailing junk (v2026.7.0abc) passed the same way. Require the full vYYYY.MM.PATCH form before comparing, and validate VERSION itself since it becomes the published tag verbatim. Signed-off-by: Chloe Crozier <[email protected]>
These jobs are the first in the repo to hold a registry credential, so resolve the action by commit instead of by the mutable v4 tag. v4 currently points at this commit, so the pinned version is unchanged. Signed-off-by: Chloe Crozier <[email protected]>
RamyaGuru
approved these changes
Aug 17, 2026
cliffburdick
approved these changes
Aug 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #244
Builds the container on Intel and ARM machines when a release is tagged, uploads both, and joins them into a single tag. Replaces the current manual two-machine process.
Next steps: uploading requires an
NGC_API_KEYrepository secret (Settings → Secrets and variables → Actions) with write access tonvstaging. Build-only runs work without it.