Carpentries build workflows

.github/workbench-docker-version.txt

@@ -1 +1 @@
-v0.2.8
+v0.2.9

.github/workflows/README.md

@@ -196,12 +196,17 @@ Repository-level variables for this workflow are:
   - Force a reset of previously build markdown files
   - Setting this variable value to `true` will force sandpaper to delete any previously build markdown files
   - Default is unset or `false`
+- OMIT_PR_CONTAINER_VERSION_UPDATE
+  - Control raise behaviour of the workbench-docker version update PR
+  - When a new workbench Docker image version is detected, usually after a sandpaper, varnish, or pegboard update, its version number will be incremented
+  - If a newer version is available, a PR will be raised that updates the `.github/workbench-docker-version.txt` file
+  - To not raise this PR set this to `true`
+  - Default is unset or `false`
 - AUTO_MERGE_WORKBENCH_VERSION_UPDATE
   - Control merge behaviour of the workbench-docker version update PR
-  - When a new workbench Docker image version is detected, usually after a sandpaper, varnish, or pegboard update, its version number will be incremented
-  - If a newer version is available, a PR will be auto-generated that updates the `.github/workbench-docker-version.txt` file, and this PR will be auto-merged
-  - To not auto-merge this PR and to choose when to update the Docker version used, set this to `false`.
-  - Default is unset or `true`
+  - If OMIT_PR_CONTAINER_VERSION_UPDATE is `true` this option does nothing
+  - To auto-merge this PR, set this to `true`
+  - Default is unset or `false`
 - LANG_CODE
   - Two-letter language code that triggers the use of Joel Nitta's {dovetail} package for lesson translation
   - This is used in the internationalisation repos of the main Carpentry lesson programs

.github/workflows/docker_apply_cache.yaml

@@ -0,0 +1,190 @@
+name: "03 Maintain: Apply Package Cache"
+description: "Build and publish the lesson dependency image after a pull request has been merged or via manual trigger"
+on:
+  workflow_dispatch:
+    inputs:
+      name:
+        description: 'Who triggered this build?'
+        required: true
+        default: 'Maintainer (via GitHub)'
+      force-dependency-image-rebuild:
+        description: 'Rebuild the dependency image layer even if one already exists?'
+        required: false
+        default: false
+        type: boolean
+      prune-keep-count:
+        description: 'How many existing dependency image layers to keep?'
+        required: false
+        default: 1
+        type: number
+  pull_request:
+    types:
+      - closed
+    branches:
+      - main
+
+# queue cache runs
+concurrency:
+  group: docker-apply-cache
+  cancel-in-progress: false
+
+jobs:
+  preflight:
+    name: "Preflight: PR or Manual Trigger?"
+    runs-on: ubuntu-latest
+    outputs:
+      do-apply: ${{ steps.check.outputs.merged_or_manual }}
+    steps:
+      - name: "Should we run cache application?"
+        id: check
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ||
+                ("${{ github.ref }}" == "refs/heads/main" && "${{ github.event.action }}" == "closed" && "${{ github.event.pull_request.merged }}" == "true") ]]; then
+            echo "merged_or_manual=true" >> $GITHUB_OUTPUT
+          else
+            echo "This was not a manual trigger and no PR was merged. No action taken."
+            echo "merged_or_manual=false" >> $GITHUB_OUTPUT
+          fi
+        shell: bash
+
+  check-renv:
+    name: "Check If We Need {renv}"
+    runs-on: ubuntu-latest
+    needs: preflight
+    if: needs.preflight.outputs.do-apply == 'true'
+    outputs:
+      renv-needed: ${{ steps.check-for-renv.outputs.renv-needed }}
+      renv-cache-hashsum: ${{ steps.check-for-renv.outputs.renv-cache-hashsum }}
+    steps:
+      - name: "Check for renv"
+        id: check-for-renv
+        uses: carpentries/actions/renv-checks@v1
+        with:
+          WORKBENCH_TAG: ${{ vars.WORKBENCH_TAG || 'latest' }}
+          skip-cache-check: true
+
+  no-renv-cache-used:
+    name: "No renv package dependency image needed"
+    runs-on: ubuntu-latest
+    needs: check-renv
+    if: needs.check-renv.outputs.renv-needed != 'true'
+    steps:
+      - name: "No dependency image needed"
+        run: echo "No renv dependency image needed for this lesson"
+
+  update-renv-cache:
+    name: "Publish renv package dependency image"
+    runs-on: ubuntu-latest
+    needs: check-renv
+    if: needs.check-renv.outputs.renv-needed == 'true'
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: "Get Container Version Used"
+        id: wb-vers
+        uses: carpentries/actions/container-version@v1
+        with:
+          WORKBENCH_TAG: ${{ vars.WORKBENCH_TAG }}
+          renv-needed: ${{ needs.check-renv.outputs.renv-needed }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set dependency image tags
+        id: image
+        env:
+          IMAGE_OWNER: ${{ github.repository_owner }}
+          IMAGE_NAME: ${{ github.event.repository.name }}
+          WB_VERSION: ${{ steps.wb-vers.outputs.container-version }}
+          RENV_HASH: ${{ needs.check-renv.outputs.renv-cache-hashsum }}
+        run: |
+          set -euo pipefail
+          exact_image="ghcr.io/${IMAGE_OWNER}/${IMAGE_NAME}-deps:${WB_VERSION}_renv-${RENV_HASH}"
+          latest_image="ghcr.io/${IMAGE_OWNER}/${IMAGE_NAME}-deps:latest"
+
+          # lowercaseify
+          echo "exact_image=${exact_image,,}" >> "$GITHUB_OUTPUT"
+          echo "latest_image=${latest_image,,}" >> "$GITHUB_OUTPUT"
+        shell: bash
+
+      - name: Check for existing dependency image tag
+        id: image-exists
+        env:
+          EXACT_IMAGE: ${{ steps.image.outputs.exact_image }}
+        run: |
+          set -euo pipefail
+          if docker manifest inspect "${EXACT_IMAGE}" >/dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+            echo "## ⚠️ Dependency image already exists" >> $GITHUB_STEP_SUMMARY
+            echo "Dependency image already exists for this renv hash: ${EXACT_IMAGE}" >> $GITHUB_STEP_SUMMARY
+            echo "Dependency image already exists for this renv hash: ${EXACT_IMAGE}"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+            echo "No existing dependency image found for this renv hash: ${EXACT_IMAGE}"
+          fi
+        shell: bash
+
+      - name: Build and push dependency image layer
+        id: build-push-deps-layer
+        if: |
+          steps.image-exists.outputs.exists != 'true' ||
+          (
+            github.event_name == 'workflow_dispatch' &&
+            github.event.inputs.force-dependency-image-rebuild == 'true'
+          )
+        uses: carpentries/actions/build-dependency-image@v1
+        with:
+          workbench-tag: ${{ vars.WORKBENCH_TAG || 'latest' }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          github-repository: ${{ github.repository }}
+          github-sha: ${{ github.sha }}
+          exact-image: ${{ steps.image.outputs.exact_image }}
+          latest-image: ${{ steps.image.outputs.latest_image }}
+          build-context: ${{ github.workspace }}
+
+  prune-dependency-images:
+    name: "Prune Dependency Images"
+    runs-on: ubuntu-latest
+    needs: check-renv
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Prune any old dependency image layers
+        uses: carpentries/actions/prune-dependency-images@v1
+        if: needs.check-renv.outputs.renv-needed == 'true'
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          owner: ${{ github.repository_owner }}
+          owner-type: ${{ github.event.repository.owner.type }}
+          repository: ${{ github.event.repository.name }}
+          package-name: ${{ github.event.repository.name }}-deps
+          keep-count: ${{ github.event.inputs.prune-keep-count }}
+        continue-on-error: true
+
+  record-cache-result:
+    name: "Record Caching Status"
+    runs-on: ubuntu-latest
+    needs: [check-renv, update-renv-cache]
+    if: always()
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: "Record cache result"
+        run: |
+          echo "${{ needs.check-renv.outputs.renv-needed != 'true' || needs.update-renv-cache.result == 'success' }}" > ${{ github.workspace }}/apply-cache-result
+        shell: bash
+
+      - name: "Upload cache result"
+        uses: actions/upload-artifact@v7
+        with:
+          name: apply-cache-result
+          path: ${{ github.workspace }}/apply-cache-result