Build on depot.dev instead by EngHabu · Pull Request #7306 · flyteorg/flyte

EngHabu · 2026-04-28T18:43:57Z

Signed-off-by: Haytham Abuelfutuh haytham@afutuh.com

Tracking issue

Why are the changes needed?

What changes were proposed in this pull request?

How was this patch tested?

Labels

Please add one or more of the following labels to categorize your PR:

added: For new features.
changed: For changes in existing functionality.
deprecated: For soon-to-be-removed features.
removed: For features being removed.
fixed: For any bug fixed.
security: In case of vulnerabilities

This is important to improve the readability of release notes.

Setup process

Screenshots

Check all the applicable boxes

I updated the documentation accordingly.
All new and existing tests passed.
All commits are signed-off.

Related PRs

Stack

If you do use git town to manage PR Stacks, the stack relevant to this PR
will show below. Otherwise, you can ignore this section.

Docs link

Signed-off-by: Haytham Abuelfutuh <haytham@afutuh.com>

pingsutw · 2026-04-28T18:47:33Z

            BASE_IMAGE=base
          push: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
-          cache-from: type=gha,scope=demo-gpu
-          cache-to: type=gha,mode=max,scope=demo-gpu


does depot cache it automatically?

Yes — Depot persists Docker layer cache to NVMe storage per project automatically, shared across all builds in the project (across runs, branches, PRs). That's why this PR drops all the cache-from: type=gha / cache-to: type=gha and registry buildcache plumbing — it's redundant on Depot.

Ref: https://depot.dev/docs/container-builds/overview ("Persistent shared caching … available across builds")

Copilot

Pull request overview

Switches GitHub Actions Docker builds from local Buildx/QEMU to Depot (OIDC-authenticated), aiming to build multi-arch images natively and simplify caching configuration.

Changes:

Replace docker/setup-buildx-action + docker/build-push-action with depot/setup-action + depot/build-push-action.
Add id-token: write job permissions for Depot OIDC auth and update docker/login-action to v3.
Remove explicit GHA/registry cache configuration in favor of Depot’s per-project persistent cache.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

File	Description
.github/workflows/flyte-binary-v2.yml	Migrates multi-arch image export/push steps to Depot and adds OIDC permissions.
.github/workflows/build-ci-image.yml	Migrates CI image build/push to Depot, adds OIDC permissions, and removes Buildx caching plumbing.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

      - name: Export ARM64 Image
-        uses: docker/build-push-action@v6
+        uses: depot/build-push-action@v1
        with:
+          project: ${{ vars.DEPOT_PROJECT_ID }}
          context: .


    permissions:
      contents: read
      packages: write
      pull-requests: write
+      id-token: write  # required for Depot OIDC auth


-        uses: docker/build-push-action@v6
+        uses: depot/build-push-action@v1
        with:
+          project: ${{ vars.DEPOT_PROJECT_ID }}


github-actions · 2026-04-28T19:38:30Z

🐳 Docker CI Image Built

The CI Docker image has been built and pushed for this PR!

Image: ghcr.io/flyteorg/flyte/ci:pr-7306

This image will be automatically used by CI workflows in this PR.

To test locally:

make gen DOCKER_CI_IMAGE=ghcr.io/flyteorg/flyte/ci:pr-7306

- Hoist DEPOT_PROJECT_ID to workflow-level env to deduplicate plumbing - Add fail-fast validation when the repo variable is missing - Fix broken digest reference (metadata-action doesn't expose digest; read it from the build step output instead) - Drop unused packages: write from flyte-binary-v2 jobs (they auth to GHCR via FLYTE_BOT_PAT, not GITHUB_TOKEN) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

This PR updates the repository’s CI image build pipelines to use Depot (depot.dev) for native multi-architecture Docker builds, and adds a README sponsor acknowledgment for Depot’s support.

Changes:

Switch multi-arch Docker builds in GitHub Actions workflows from Buildx/QEMU to depot/setup-action + depot/build-push-action.
Introduce DEPOT_PROJECT_ID workflow env wiring + a guard step to fail fast if the repo variable is missing.
Add a “Sponsors” section to README acknowledging Depot.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
`README.md`	Adds sponsor acknowledgement and a “Built with Depot” badge.
`.github/workflows/flyte-binary-v2.yml`	Migrates Flyte v2 image builds to Depot; removes Buildx/QEMU setup and GHA cache plumbing; adds OIDC permission for Depot auth.
`.github/workflows/build-ci-image.yml`	Migrates CI image build workflow to Depot; wires `DEPOT_PROJECT_ID`; updates digest output source; adds OIDC permission for Depot auth.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+    permissions:
+      contents: read
+      id-token: write  # required for Depot OIDC auth (GHCR auth uses FLYTE_BOT_PAT)
    steps:


    permissions:
      contents: read
      packages: write
      pull-requests: write
+      id-token: write  # required for Depot OIDC auth



+      - name: Validate Depot project id
+        run: |
+          if [ -z "${DEPOT_PROJECT_ID}" ]; then
+            echo "::error::DEPOT_PROJECT_ID repo variable is not set. Add it under Settings → Secrets and variables → Actions → Variables." >&2
+            exit 1
+          fi
+
+      - name: Set up Depot
+        uses: depot/setup-action@v1


+    permissions:
+      contents: read
+      id-token: write  # required for Depot OIDC auth (GHCR auth uses FLYTE_BOT_PAT)
    steps:


Signed-off-by: Haytham Abuelfutuh <haytham@afutuh.com>

Copilot

Pull request overview

This PR updates the repository’s CI Docker build pipelines to run on depot.dev (native multi-arch builds with persistent caching), and adjusts branch triggers accordingly. It also adds a README acknowledgment for the CI build sponsorship.

Changes:

Switch Docker image build steps in GitHub Actions from Docker Buildx/QEMU to Depot (depot/setup-action, depot/build-push-action) and add OIDC permissions + DEPOT_PROJECT_ID plumbing.
Change workflow branch triggers to main (removing v2 from some workflows).
Add a “Sponsors” section to the README crediting Depot.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 7 comments.

File	Description
README.md	Adds a Sponsors section acknowledging Depot sponsorship for CI image builds.
.github/workflows/go-tests.yml	Updates Go tests workflow to run on `main` pushes (drops `v2`).
.github/workflows/flyte-binary-v2.yml	Migrates multi-arch image builds to Depot and changes workflow triggers to `main`.
.github/workflows/build-ci-image.yml	Migrates CI image build/push workflow to Depot and removes `v2` from push trigger branches.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

          allow: "security.insecure"
-          platforms: linux/arm64, linux/amd64
+          platforms: linux/arm64,linux/amd64
          tags: ${{ steps.image-names.outputs.tags }}
          build-args: "FLYTE_DEVBOX_VERSION=${{ env.FLYTE_DEVBOX_VERSION }}"
          push: true


          build-args: |
            FLYTE_DEVBOX_VERSION=${{ env.FLYTE_DEVBOX_VERSION }}
            BASE_IMAGE=base
-          push: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
-          cache-from: type=gha,scope=demo-gpu
-          cache-to: type=gha,mode=max,scope=demo-gpu
+          push: true


 on:
  push:
-    branches: [v2, main]
+    branches: [main]


 on:
  push:
    branches:
-      - v2
+      - main
  pull_request:
    branches:
-      - v2
+      - main


@@ -64,16 +76,17 @@
          tags: |
            type=raw,value=nightly,enable=${{ github.event_name == 'pull_request' && github.ref == 'refs/heads/master' }}


          tags: |
            type=raw,value=nightly,enable=${{ github.event_name == 'push' && github.ref == 'refs/heads/v2' }}
            type=raw,value=latest,enable=${{ github.event_name == 'workflow_dispatch' }}
            type=sha,format=long,


buildx refuses local OCI export for multi-node multi-arch builds (error: "oci for multi-node builds currently not supported"), and Depot intentionally uses one native node per platform. Switch the CPU build to Depot's ephemeral registry via `save: true` and a unique per-run tag, and have the GPU build resolve `FROM` directly from `registry.depot.dev/<project>:<tag>` — auth is implicit since both builds run in the same Depot project. Drops the OCI tarball extract step and the build-contexts indirection. Refs: docker/buildx#2351 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Lets a maintainer push test images from a PR by applying the `test-push-image` label, and removes the temporary push: true hacks. The gate is hoisted to a single workflow-level PUSH_IMAGES env that all push/if checks read. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Updates GitHub Actions CI image build pipelines to use Depot for faster native multi-arch builds and adds a sponsor acknowledgement in the README.

Changes:

Add a Sponsors section to the README recognizing Depot’s CI build sponsorship.
Switch container image build workflows from Docker Buildx/QEMU to Depot (OIDC auth + Depot build action).
Adjust workflow triggers/conditions to focus on main and add repo-variable validation for DEPOT_PROJECT_ID.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
README.md	Adds Depot sponsorship acknowledgement and badge.
.github/workflows/go-tests.yml	Limits push-triggered Go tests to `main`.
.github/workflows/flyte-binary-v2.yml	Migrates multi-arch image build/export/push to Depot and adds gating/validation logic.
.github/workflows/build-ci-image.yml	Migrates CI Docker image build/push to Depot with OIDC and project-id validation.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@@ -64,16 +79,17 @@ jobs:
          tags: |
            type=raw,value=nightly,enable=${{ github.event_name == 'pull_request' && github.ref == 'refs/heads/master' }}


            type=raw,value=latest,enable=${{ github.event_name == 'workflow_dispatch' }}
            type=sha,format=long,


            type=raw,value=gpu-latest,enable=${{ github.event_name == 'workflow_dispatch' }}
            type=sha,format=long,prefix=gpu-


The preload step ran rootless podman inside a RUN to fetch and save image tarballs, which required `--security=insecure` and a daemon configured with `--allow-insecure-entitlement security.insecure`. Depot's hosted builders refuse that entitlement. Skopeo does the same job (pull + retag + save as docker-archive) as a privilege-free registry client, so the entitlement isn't needed anywhere now. Drop it from the workflow steps and the local Makefile builder config too. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The GPU build's `FROM registry.depot.dev/<project>:cpu-build-...` was 401-ing because cross-build auth in Depot's registry is not implicit — even within the same project. Generate a short-lived pull-token via the Depot CLI and `docker login` so the runner's docker config (forwarded to remote BuildKit by depot/build-push-action) can resolve the saved CPU base. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

This PR migrates the repository’s CI container-image build pipeline to Depot (native multi-arch builds + persistent caching) and updates the devbox image preloading mechanism accordingly.

Changes:

Switch devbox image preloading from podman pull/tag/save to skopeo copy and remove insecure BuildKit entitlements.
Update GitHub Actions workflows to build with Depot (depot/setup-action, depot/build-push-action) and adjust branch triggers to main.
Add a README Sponsors section acknowledging Depot’s CI build sponsorship.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
docker/devbox-bundled/images/preload	Replaces Podman-based image export with Skopeo archive export.
docker/devbox-bundled/Makefile	Removes `security.insecure` allowances from local buildx flows.
docker/devbox-bundled/Dockerfile	Uses `quay.io/skopeo/stable` for preloading and removes insecure RUN.
README.md	Adds Depot sponsorship note + badge.
.github/workflows/go-tests.yml	Limits push-triggered Go tests to `main`.
.github/workflows/flyte-binary-v2.yml	Migrates builds to Depot; adds Depot project validation and conditional push behavior.
.github/workflows/build-ci-image.yml	Migrates CI image build to Depot; adds Depot project validation and OIDC permissions.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

            ghcr.io/${{ github.repository_owner }}/flyte-sandbox-v2
          tags: |
            type=raw,value=gpu-nightly,enable=${{ github.event_name == 'push' && github.ref == 'refs/heads/v2' }}
            type=raw,value=gpu-latest,enable=${{ github.event_name == 'workflow_dispatch' }}
            type=sha,format=long,prefix=gpu-


+          # ephemeral registry above. Auth is implicit because both builds
+          # run in the same Depot project.


@@ -64,16 +79,17 @@
          tags: |
            type=raw,value=nightly,enable=${{ github.event_name == 'pull_request' && github.ref == 'refs/heads/master' }}


            ghcr.io/${{ github.repository_owner }}/flyte-sandbox-v2
          tags: |
            type=raw,value=nightly,enable=${{ github.event_name == 'push' && github.ref == 'refs/heads/v2' }}
            type=raw,value=latest,enable=${{ github.event_name == 'workflow_dispatch' }}
            type=sha,format=long,


Signed-off-by: Haytham Abuelfutuh <haytham@afutuh.com>

Build on depot.dev instead

3d7dba6

Signed-off-by: Haytham Abuelfutuh <haytham@afutuh.com>

Copilot AI review requested due to automatic review settings April 28, 2026 18:43

Copilot started reviewing on behalf of EngHabu April 28, 2026 18:44 View session

pingsutw previously approved these changes Apr 28, 2026

View reviewed changes

pingsutw reviewed Apr 28, 2026

View reviewed changes

Copilot AI reviewed Apr 28, 2026

View reviewed changes

EngHabu dismissed pingsutw’s stale review via d3cbfa1 April 28, 2026 20:13

README: credit Depot for sponsoring CI image builds

7957c20

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings April 28, 2026 20:21

Copilot started reviewing on behalf of EngHabu April 28, 2026 20:22 View session

Copilot AI reviewed Apr 28, 2026

View reviewed changes

pingsutw assigned EngHabu Apr 29, 2026

pingsutw added the flyte2 label Apr 29, 2026

pingsutw previously approved these changes Apr 29, 2026

View reviewed changes

EngHabu added 3 commits April 29, 2026 10:13

use the same style of conditions for pushing the images

2d1e5f6

Signed-off-by: Haytham Abuelfutuh <haytham@afutuh.com>

temporarily push in PR so I can test depot.dev-built images

92a9cfb

Signed-off-by: Haytham Abuelfutuh <haytham@afutuh.com>

Merge branch 'main' into enghabu/depot-dev

6158ee4

EngHabu dismissed pingsutw’s stale review via 6158ee4 April 29, 2026 17:14

EngHabu added 2 commits April 29, 2026 17:34

Fix branch names

c6f388d

Signed-off-by: Haytham Abuelfutuh <haytham@afutuh.com>

Merge branch 'main' into enghabu/depot-dev

33d85da

Copilot AI review requested due to automatic review settings April 30, 2026 00:34

Copilot started reviewing on behalf of EngHabu April 30, 2026 00:35 View session

Copilot AI reviewed Apr 30, 2026

View reviewed changes

EngHabu and others added 2 commits April 29, 2026 20:03

Copilot AI review requested due to automatic review settings April 30, 2026 03:15

Copilot started reviewing on behalf of EngHabu April 30, 2026 03:16 View session

Copilot AI reviewed Apr 30, 2026

View reviewed changes

EngHabu and others added 2 commits April 29, 2026 21:27

Copilot AI review requested due to automatic review settings April 30, 2026 06:05

Copilot started reviewing on behalf of EngHabu April 30, 2026 06:06 View session

Copilot AI reviewed Apr 30, 2026

View reviewed changes

EngHabu added the test-push-image Pushes binary images on PR label Apr 30, 2026

EngHabu added 2 commits April 29, 2026 23:17

bump

e79caf0

Signed-off-by: Haytham Abuelfutuh <haytham@afutuh.com>

Merge branch 'main' into enghabu/depot-dev

8e6982d

pingsutw approved these changes Apr 30, 2026

View reviewed changes

pingsutw added this pull request to the merge queue Apr 30, 2026

Merged via the queue into main with commit 51364bd Apr 30, 2026
21 checks passed

pingsutw deleted the enghabu/depot-dev branch April 30, 2026 06:41

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Build on depot.dev instead#7306

Build on depot.dev instead#7306
pingsutw merged 14 commits intomainfrom
enghabu/depot-dev

EngHabu commented Apr 28, 2026

Uh oh!

pingsutw Apr 28, 2026

Uh oh!

EngHabu Apr 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 28, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -64,16 +76,17 @@
		tags: \|
		type=raw,value=nightly,enable=${{ github.event_name == 'pull_request' && github.ref == 'refs/heads/master' }}

		@@ -64,16 +79,17 @@ jobs:
		tags: \|
		type=raw,value=nightly,enable=${{ github.event_name == 'pull_request' && github.ref == 'refs/heads/master' }}

		type=raw,value=latest,enable=${{ github.event_name == 'workflow_dispatch' }}
		type=sha,format=long,

		type=raw,value=gpu-latest,enable=${{ github.event_name == 'workflow_dispatch' }}
		type=sha,format=long,prefix=gpu-

		# ephemeral registry above. Auth is implicit because both builds
		# run in the same Depot project.

		@@ -64,16 +79,17 @@
		tags: \|
		type=raw,value=nightly,enable=${{ github.event_name == 'pull_request' && github.ref == 'refs/heads/master' }}

Conversation

EngHabu commented Apr 28, 2026

Tracking issue

Why are the changes needed?

What changes were proposed in this pull request?

How was this patch tested?

Labels

Setup process

Screenshots

Check all the applicable boxes

Related PRs

Stack

Docs link

Uh oh!

pingsutw Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

EngHabu Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🐳 Docker CI Image Built

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Apr 28, 2026 •

edited

Loading