OpenLLM/.github/workflows/build-embedding.yml

name: Build Embedding Bentos
on:
  workflow_dispatch:
  push:
    branches:
      - 'main'
    tags:
      - '*'
    paths:
      - '.github/workflows/build-embedding.yml'
      - 'openllm-python/src/openllm/**'
      - 'openllm-core/src/openllm_core/**'
      - 'openllm-client/src/openllm_client/**'
  pull_request:
    branches:
      - 'main'
    paths:
      - '.github/workflows/build-embedding.yml'
      - 'openllm-python/src/openllm/**'
      - 'openllm-core/src/openllm_core/**'
      - 'openllm-client/src/openllm_client/**'
    types: [labeled, opened, synchronize, reopened]
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#defaultsrun
defaults:
  run:
    shell: bash --noprofile --norc -exo pipefail {0}
env:
  LINES: 120
  COLUMNS: 120
  AWS_REGION: us-east-1
  OPENLLM_OPT_MODEL_ID: facebook/opt-125m
  BENTOML_HOME: ${{ github.workspace }}/bentoml
  OPENLLM_DEV_BUILD: True
  OPENLLM_DO_NOT_TRACK: True
concurrency:
  group: ${{ github.workflow }}-${{ github.job }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true
jobs:
  get_commit_message:
    name: Get commit message
    runs-on: ubuntu-latest
    if: "github.repository == 'bentoml/OpenLLM'" # Don't run on fork repository
    outputs:
      message: ${{ steps.commit_message.outputs.message }}
    steps:
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # ratchet:actions/checkout@v4
        # Gets the correct commit message for pull request
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Get commit message
        id: commit_message
        run: |
          set -xe
          COMMIT_MSG=$(git log --no-merges -1 --oneline)
          echo "message=$COMMIT_MSG" >> $GITHUB_OUTPUT
          echo github.ref ${{ github.ref }}
  start-runner:
    name: Start self-hosted EC2 runner
    runs-on: ubuntu-latest
    needs: get_commit_message
    if: >-
      contains(needs.get_commit_message.outputs.message, '[ec2 build]') || github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, '00 - EC2 Build')) || (github.event_name == 'push' && (startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/heads/main')))
    env:
      EC2_INSTANCE_TYPE: t3.2xlarge
      EC2_AMI_ID: ami-0fc9d48803f691665
      EC2_SUBNET_ID: subnet-0f3cfaf555c0fe5d7,subnet-03c02763156f1c011,subnet-01e191856710e5205,subnet-06caca1b04878bf17,subnet-0ec43be52d7ca5619,subnet-0f23c41d786013d15
      EC2_SECURITY_GROUP: sg-0b84a8e57c4524eb9
    outputs:
      label: ${{ steps.start-ec2-runner.outputs.label }}
      ec2-instance-id: ${{ steps.start-ec2-runner.outputs.ec2-instance-id }}
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@8c3f20df09ac63af7b3ae3d7c91f105f857d8497 # ratchet:aws-actions/configure-aws-credentials@v4.0.0
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}
      - name: Start EC2 Runner
        id: start-ec2-runner
        uses: aarnphm/ec2-github-runner@main # ratchet:exclude
        with:
          mode: start
          github-token: ${{ secrets.OPENLLM_PAT }}
          ec2-region: ${{ env.AWS_REGION }}
          ec2-image-id: ${{ env.EC2_AMI_ID }}
          ec2-instance-type: ${{ env.EC2_INSTANCE_TYPE }}
          subnet-id: ${{ env.EC2_SUBNET_ID }}
          security-group-id: ${{ env.EC2_SECURITY_GROUP }}
  build-and-push-embedding-bento:
    name: Build embedding container
    needs: start-runner
    runs-on: ${{ needs.start-runner.outputs.label }} # run the job on the newly created runner
    permissions:
      contents: write
      packages: write
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write
      security-events: write
    steps:
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # ratchet:actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: bentoml/setup-bentoml-action@862aa8fa0e0c3793fcca4bfe7a62717a497417e4 # ratchet:bentoml/setup-bentoml-action@v1
        with:
          bentoml-version: 'main'
          python-version: '3.11'
      - name: Inject slug/short variables
        uses: rlespinasse/github-slug-action@102b1a064a9b145e56556e22b18b19c624538d94 # ratchet:rlespinasse/github-slug-action@v4.4.1
      - name: Set up QEMU
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # ratchet:docker/setup-qemu-action@v3.0.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # ratchet:docker/setup-buildx-action@v3.0.0
        with:
          install: true
          driver-opts: |
            image=moby/buildkit:master
            network=host
      - name: Install cosign
        if: github.event_name != 'pull_request'
        uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # ratchet:sigstore/cosign-installer@v3.1.2
        with:
          cosign-release: 'v2.1.1'
      - name: Login to GitHub Container Registry
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # ratchet:docker/login-action@v3.0.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata tags and labels on PRs
        if: github.event_name == 'pull_request'
        id: meta-pr
        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # ratchet:docker/metadata-action@v5.0.0
        with:
          images: ghcr.io/bentoml/openllm-embedding
          tags: |
            type=raw,value=sha-${{ env.GITHUB_SHA_SHORT }}
      - name: Extract metadata tags and labels for main, release or tag
        if: github.event_name != 'pull_request'
        id: meta
        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # ratchet:docker/metadata-action@v5.0.0
        with:
          flavor: latest=auto
          images: ghcr.io/bentoml/openllm-embedding
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
            type=raw,value=sha-${{ env.GITHUB_SHA_SHORT }}
      - name: Build OPT Bento with base embeddings
        id: bento-tag
        run: |
          bash local.sh
          pip install 'build[virtualenv]==0.10.0'
          openllm build opt --serialisation legacy --bento-version sha-${{ env.GITHUB_SHA_SHORT }} --machine --dockerfile-template - <<EOF
            {% extends "python_debian.j2" %}
            {% block SETUP_BENTO_BASE_IMAGE %}
            FROM python:3.11-slim as base-container

            ENV LANG=C.UTF-8
            ENV LC_ALL=C.UTF-8
            ENV PYTHONIOENCODING=UTF-8
            ENV PYTHONUNBUFFERED=1

            USER root
            ENV DEBIAN_FRONTEND=noninteractive
            RUN rm -f /etc/apt/apt.conf.d/docker-clean; echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache
            {% call common.RUN(__enable_buildkit__) -%} {{ common.mount_cache(__lib_apt__) }} {{ common.mount_cache(__cache_apt__) }} {% endcall -%} set -eux && \
                apt-get update -y && \
                apt-get install -q -y --no-install-recommends --allow-remove-essential \
                    ca-certificates gnupg2 bash build-essential {% if __options__system_packages is not none %}{{ __options__system_packages | join(' ') }}{% endif -%}
            {% endblock %}
          EOF
          bento_tag=$(python -c "import openllm;print(str(openllm.build('opt',bento_version='sha-${{ env.GITHUB_SHA_SHORT }}',serialisation='legacy').tag))")
          echo "tag=$bento_tag" >> $GITHUB_OUTPUT
      - name: Build and push Embedding Bento
        id: build-and-push
        uses: bentoml/containerize-push-action@main # ratchet:exclude
        with:
          bento-tag: ${{ steps.bento-tag.outputs.tag }}
          platforms: linux/amd64
          push: true
          build-args: |
            GIT_SHA=${{ env.GITHUB_SHA }}
            DOCKER_LABEL=sha-${{ env.GITHUB_SHA_SHORT }}
          tags: ${{ steps.meta.outputs.tags || steps.meta-pr.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels || steps.meta-pr.outputs.labels }}
      - name: Sign the released image
        if: ${{ github.event_name != 'pull_request' }}
        env:
          COSIGN_EXPERIMENTAL: 'true'
        run: echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign --yes {}@${{ steps.build-and-push.outputs.digest }}
      - name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
        uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # ratchet:aquasecurity/trivy-action@master
        if: ${{ github.event_name != 'pull_request' }}
        with:
          image-ref: 'ghcr.io/bentoml/openllm-embedding:sha-${{ env.GITHUB_SHA_SHORT }}'
          format: 'github'
          output: 'dependency-results.sbom.json'
          github-pat: ${{ secrets.UI_GITHUB_TOKEN }}
          scanners: 'vuln'
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # ratchet:aquasecurity/trivy-action@master
        if: ${{ github.event_name != 'pull_request' }}
        with:
          image-ref: 'ghcr.io/bentoml/openllm-embedding:sha-${{ env.GITHUB_SHA_SHORT }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL'
          scanners: 'vuln'
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@00e563ead9f72a8461b24876bee2d0c2e8bd2ee8 # ratchet:github/codeql-action/upload-sarif@v2
        if: ${{ github.event_name != 'pull_request' }}
        with:
          sarif_file: 'trivy-results.sarif'
  stop-runner:
    name: Stop self-hosted EC2 runner
    needs:
      - start-runner
      - build-and-push-embedding-bento
      - get_commit_message
    runs-on: ubuntu-latest
    if: >-
      (contains(needs.get_commit_message.outputs.message, '[ec2 build]') || github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, '00 - EC2 Build')) || (github.event_name == 'push' && (startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/heads/main')))) && always()
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@8c3f20df09ac63af7b3ae3d7c91f105f857d8497 # ratchet:aws-actions/configure-aws-credentials@v4.0.0
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}
      - name: Stop EC2 runner
        uses: aarnphm/ec2-github-runner@af796d217e24ecbbc5a2c49e780cd90616e2b962 # ratchet:aarnphm/ec2-github-runner@main
        with:
          mode: stop
          github-token: ${{ secrets.OPENLLM_PAT }}
          ec2-region: ${{ env.AWS_REGION }}
          label: ${{ needs.start-runner.outputs.label }}
          ec2-instance-id: ${{ needs.start-runner.outputs.ec2-instance-id }}