juaml/junifer
Watch
3
0
Fork
You've already forked junifer
 0
Code Issues 14 Pull requests 2 Packages Activity Actions

[CI]: Fix junifer-ci Docker image #468

Merged
synchon merged 13 commits from fix/ci-image into main 2025-09-22 15:00:15 +00:00
Conversation 2 Commits 13 Files changed 6 +99 -164
6 changed files with 99 additions and 164 deletions
Download patch file Download diff file Expand all files Collapse all files

4
.github/workflows/ci.yml vendored
View file

@ -13,6 +13,7 @@ on:
- '.github/workflows/**'
- 'tox.ini'
- 'pyproject.toml'
workflow_dispatch: {}
jobs:
run-tests:
@ -24,7 +25,6 @@ jobs:
fail-fast: false
matrix:
python-version: ['3.9', '3.10', '3.11', '3.12']
steps:
- run: df -h
- name: Clean runner
@ -32,7 +32,7 @@ jobs:
rm -rf /usr/share/dotnet \
/usr/local/lib/android \
/opt/ghc \
/opt/hostedtoolcache/CodeQL
/opt/hostedtoolcache
- run: df -h
- name: Check ANTs
run: |

64
.github/workflows/docker-ci-publish.yml vendored
View file

@ -1,83 +1,58 @@
name: Docker for CI
# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.
on:
push:
# Only run when the file is edited on main
branches: [ "main" ]
paths: [ "Dockerfile-ci" ]
pull_request:
# Only run when the file is edited on main
branches: [ "main" ]
paths: [ "Dockerfile-ci" ]
workflow_dispatch: {}
env:
# Use docker.io for Docker Hub if empty
REGISTRY: ghcr.io
# github.repository as <account>/<repo>
IMAGE_NAME: ${{ github.repository }}-ci
jobs:
build:
runs-on: ubuntu-24.04
permissions:
contents: read
packages: write
# This is used to complete the identity challenge
# with sigstore/fulcio when running outside of PRs.
id-token: write
steps:
# Taken from https://github.com/orgs/community/discussions/25678#discussioncomment-5242449
- name: Delete huge unnecessary tools folder
run: rm -rf /opt/hostedtoolcache
- run: df -h
- name: Clean runner
run: |
sudo rm -rf /usr/share/dotnet \
/usr/local/lib/android \
/opt/ghc \
/opt/hostedtoolcache
sudo docker image prune --all --force
sudo docker builder prune -a
- run: df -h
- name: Checkout repository
uses: actions/checkout@v5
# Install the cosign tool except on PR
# https://github.com/sigstore/cosign-installer
- name: Install cosign
if: github.event_name != 'pull_request'
uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 #v3.10.0
with:
cosign-release: 'v2.2.4'
# Set up BuildKit Docker container builder to be able to build
# multi-platform images and export cache
# https://github.com/docker/setup-buildx-action
uses: sigstore/cosign-installer@v3.10.0
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
# Login against a Docker registry except on PR
# https://github.com/docker/login-action
uses: docker/setup-buildx-action@v3.11.1
- name: Log into registry ${{ env.REGISTRY }}
if: github.event_name != 'pull_request'
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
uses: docker/login-action@v3.5.0
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
# Extract metadata (tags, labels) for Docker
# https://github.com/docker/metadata-action
- name: Extract Docker metadata
id: meta
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
uses: docker/metadata-action@v5.8.0
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
# Build and push Docker image with Buildx (don't push on PR)
# https://github.com/docker/build-push-action
- name: Build and push Docker image
id: build-and-push
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
uses: docker/build-push-action@v6.18.0
with:
context: .
file: Dockerfile-ci
@ -86,18 +61,9 @@ jobs:
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
# Sign the resulting Docker image digest except on PRs.
# This will only write to the public Rekor transparency log when the Docker
# repository is public to avoid leaking data. If you would like to publish
# transparency data even for private images, pass --force to cosign below.
# https://github.com/sigstore/cosign
- name: Sign the published Docker image
if: ${{ github.event_name != 'pull_request' }}
env:
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
TAGS: ${{ steps.meta.outputs.tags }}
DIGEST: ${{ steps.build-and-push.outputs.digest }}
# This step uses the identity token to provision an ephemeral certificate
# against the sigstore community Fulcio instance.
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

61
.github/workflows/docker-docs-publish.yml vendored
View file

@ -1,80 +1,58 @@
name: Docker for docs
# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.
on:
push:
# Only run when the file is edited on main
branches: [ "main" ]
paths: [ "Dockerfile-docs" ]
pull_request:
# Only run when the file is edited on main
branches: [ "main" ]
paths: [ "Dockerfile-docs" ]
workflow_dispatch: {}
env:
# Use docker.io for Docker Hub if empty
REGISTRY: ghcr.io
# github.repository as <account>/<repo>
IMAGE_NAME: ${{ github.repository }}-docs
jobs:
build:
runs-on: ubuntu-24.04
permissions:
contents: read
packages: write
# This is used to complete the identity challenge
# with sigstore/fulcio when running outside of PRs.
id-token: write
steps:
- run: df -h
- name: Clean runner
run: |
rm -rf /usr/share/dotnet \
/usr/local/lib/android \
/opt/ghc \
/opt/hostedtoolcache
docker image prune --all --force
docker builder prune -a
- run: df -h
- name: Checkout repository
uses: actions/checkout@v5
# Install the cosign tool except on PR
# https://github.com/sigstore/cosign-installer
- name: Install cosign
if: github.event_name != 'pull_request'
uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 #v3.10.0
with:
cosign-release: 'v2.2.4'
# Set up BuildKit Docker container builder to be able to build
# multi-platform images and export cache
# https://github.com/docker/setup-buildx-action
uses: sigstore/cosign-installer@v3.10.0
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
# Login against a Docker registry except on PR
# https://github.com/docker/login-action
uses: docker/setup-buildx-action@v3.11.1
- name: Log into registry ${{ env.REGISTRY }}
if: github.event_name != 'pull_request'
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
uses: docker/login-action@v3.5.0
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
# Extract metadata (tags, labels) for Docker
# https://github.com/docker/metadata-action
- name: Extract Docker metadata
id: meta
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
uses: docker/metadata-action@v5.8.0
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
# Build and push Docker image with Buildx (don't push on PR)
# https://github.com/docker/build-push-action
- name: Build and push Docker image
id: build-and-push
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
uses: docker/build-push-action@v6.18.0
with:
context: .
file: Dockerfile-docs
@ -83,18 +61,9 @@ jobs:
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
# Sign the resulting Docker image digest except on PRs.
# This will only write to the public Rekor transparency log when the Docker
# repository is public to avoid leaking data. If you would like to publish
# transparency data even for private images, pass --force to cosign below.
# https://github.com/sigstore/cosign
- name: Sign the published Docker image
if: ${{ github.event_name != 'pull_request' }}
env:
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
TAGS: ${{ steps.meta.outputs.tags }}
DIGEST: ${{ steps.build-and-push.outputs.digest }}
# This step uses the identity token to provision an ephemeral certificate
# against the sigstore community Fulcio instance.
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

17
Dockerfile-ci
View file

@ -1,6 +1,6 @@
# syntax=docker/dockerfile:1
FROM python:3.12-slim
FROM python:3.12-slim-bookworm
LABEL org.opencontainers.image.source=https://github.com/juaml/junifer
LABEL org.opencontainers.image.description="Junifer CI container image"
@ -60,14 +60,13 @@ ENV PATH="/opt/afni/bin:$PATH"
# Patch gsl
RUN ln -s /usr/lib/x86_64-linux-gnu/libgsl.so.27 /usr/lib/x86_64-linux-gnu/libgsl.so.23
# disabled as standard github runner fails to install due to insufficient space on device
# # Add FSL
# RUN curl https://fsl.fmrib.ox.ac.uk/fsldownloads/fslconda/releases/fslinstaller.py | \
# python - -d /opt/fsl/ --skip_registration
# # Set env vars for FSL
# ENV FSLDIR=/opt/fsl \
# FSLOUTPUTTYPE=NIFTI_GZ \
# PATH="/opt/fsl/share/fsl/bin:$PATH"
# Add FSL
RUN curl https://fsl.fmrib.ox.ac.uk/fsldownloads/fslconda/releases/fslinstaller.py | \
python - -d /opt/fsl/ --skip_registration
# Set env vars for FSL
ENV FSLDIR=/opt/fsl \
FSLOUTPUTTYPE=NIFTI_GZ \
PATH="/opt/fsl/share/fsl/bin:$PATH"
# Clean apt cache
RUN apt-get autoremove --purge && apt-get clean

2
docs/changes/newsfragments/467.misc
View file

@ -1 +1 @@
Disable FSL installation for `junifer-ci` Docker image build with `junifer-data` v4 by `Synchon Mandal`_
Disable FSL installation for ``junifer-ci`` Docker image build with ``junifer-data`` v4 by `Synchon Mandal`_

1
docs/changes/newsfragments/468.misc Normal file
View file

@ -0,0 +1 @@
Pin ``junifer-ci`` Docker image to ``python:3.12-slim-bookworm`` and re-enable FSL installation by `Synchon Mandal`_