name: rocprofiler-sdk Build CI Docker Images

on:
  workflow_dispatch:
  schedule:
    - cron: '0 7 * * *'
  push:
    branches: [ develop ]
    paths:
      - '.github/workflows/rocprofiler-sdk-build-ci-docker-images.yml'
      - 'projects/rocprofiler-sdk/docker/Dockerfile.ci'
  pull_request:
    paths:
      - '.github/workflows/rocprofiler-sdk-build-ci-docker-images.yml'
      - 'projects/rocprofiler-sdk/docker/Dockerfile.ci'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Needed to push/pull cached Docker layers + GHCR images
permissions:
  contents: read
  packages: write

jobs:
  # -----------------------------------------------------------------------------
  # Build a cached CI base image per OS using Buildx + GHA cache (Item #6)
  # -----------------------------------------------------------------------------
  build-ci-base:
    name: Build CI Base Image • ${{ matrix.gpu }} • ${{ matrix.os }}
    runs-on: azure-linux-scale-rocm
    strategy:
      fail-fast: false
      matrix:
        os: [ 'ubuntu-22.04', 'rhel-8.8', 'rhel-9.5', 'sles-15.6' ]
        gpu: [ 'gfx94X', 'gfx950', 'gfx110X', 'gfx120X' ]
    steps:
      - name: Checkout (shallow)
        uses: actions/checkout@v6
        with:
          sparse-checkout: |
            projects/rocprofiler-sdk/requirements.txt
            projects/rocprofiler-sdk/docker/Dockerfile.ci

      - name: Get the latest therock build
        id: therock
        run: |
          sudo apt-get update
          sudo apt-get install -y python3-pip python3-venv
          python3 -m venv /tmp/awscli-venv
          /tmp/awscli-venv/bin/python -m pip install -U pip awscli
          # Restrict to the standard release tarball under v4/tarball/:
          #  - the --prefix excludes the v4/tarball-asan/ (AddressSanitizer) builds,
          #    which are ~10x larger and ship ASan-instrumented ROCm libraries that
          #    break non-ASan CI test binaries (e.g. rocdecode/rocjpeg tracing).
          #  - !contains(Key, '-tests-') drops the larger test-bundle variant.
          # Without these filters, sort_by(... LastModified)[-1] can pick the ASan
          # tarball for gfx94X/gfx950 (published later in the day than the standard one).
          KEY=$(/tmp/awscli-venv/bin/aws s3api list-objects-v2 \
                --bucket therock-nightly-tarball \
                --no-sign-request \
                --prefix "v4/tarball/" \
                --output json \
                --query "sort_by(Contents[?contains(Key, 'linux-${{ matrix.gpu }}') && !contains(Key, 'asan') && !contains(Key, '-tests-')], &LastModified)[-1].Key")
          KEY=${KEY//\"/}
          # A no-match filter returns the JSON literal "null" (or "None" for text
          # output), which is a non-empty string, so guard against it explicitly.
          if [[ -z "$KEY" || "$KEY" == "null" || "$KEY" == "None" ]]; then
            echo "No ${{ matrix.gpu }} tarball found"; exit 1
          fi
          echo "tarball=${KEY}" >> $GITHUB_OUTPUT

      - name: Login to Docker Hub
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: docker.io
          username: ${{ secrets.ROCPROFILER_AZURE_CI_USER }}
          password: ${{ secrets.ROCPROFILER_AZURE_CI_PASS }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Build & Push (to Docker Hub; cache to GHA)
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
          file: projects/rocprofiler-sdk/docker/Dockerfile.ci
          platforms: linux/amd64
          push: ${{ github.event_name != 'pull_request' }}
          build-args: |
            BASE_TAG=${{ matrix.os }}
            GPU_TYPE=${{ matrix.gpu }}
            GPU_TARBALL=${{ steps.therock.outputs.tarball }}
          tags: |
            docker.io/rocm/rocprofiler-private:${{ matrix.os }}-${{ matrix.gpu }}-latest
          cache-from: type=gha,scope=rocprofiler-ci-${{ matrix.os }}-${{ matrix.gpu }}
          cache-to: type=gha,mode=max,scope=rocprofiler-ci-${{ matrix.os }}-${{ matrix.gpu }}