ci: add container builds and publish workflow #605

andyatmiami · 2025-09-19T21:03:15Z

closes: #606
closes: #607
closes: #608

This commit adds a GHA workflow to support publishing a container image for the workspaces/ components as well as some updates to the Makefiles to establish reasonable (but overridable) defaults.

Key behavior:

Publishes controller + backend + frontend images on any workspaces/ directory change
Builds images with commit SHA tags by default
- "release" images with use the tag as defined by the VERSION file
- a -dirty suffix is added to the tag if the codebase is not porcelain
- no latest tag is ever produced on images
Uses ghcr.io/kubeflow/notebooks registry with configurable naming

example image name from "random" commit:

ghcr.io/kubeflow/notebooks/workspaces-controller:sha-3fa851ab3173942dbaa1a609468e7f9eadf5f4e4
ghcr.io/kubeflow/notebooks/workspaces-backend:sha-3fa851ab3173942dbaa1a609468e7f9eadf5f4e4
ghcr.io/kubeflow/notebooks/workspaces-frontend:sha-3fa851ab3173942dbaa1a609468e7f9eadf5f4e4

example image name from release:

ghcr.io/kubeflow/notebooks/workspaces-controller:2.0.0
ghcr.io/kubeflow/notebooks/workspaces-backend:2.0.0
ghcr.io/kubeflow/notebooks/workspaces-frontend:2.0.0

andyatmiami · 2025-09-19T21:04:44Z

/hold

We want the following PR merged first (which will require a rebase on this PR)

chore: update controller manifests #596

andyatmiami · 2025-09-22T16:49:26Z

Verification on my fork for "typical" code changes:

https://github.com/andyatmiami/kubeflow-notebooks/actions/runs/17922208280/job/50959746582

andyatmiami · 2025-09-22T17:56:50Z

Verification on my fork for "release" code changes:

https://github.com/andyatmiami/kubeflow-notebooks/actions/runs/17922438569/job/50960515083

andyatmiami · 2025-09-22T17:57:27Z

/ok-to-test

andyatmiami · 2025-09-25T20:25:52Z

/unhold

This commit adds a GHA workflow to support publishing a container image for the `workspaces/controller` component as well as some updates to the `Makefile` to establish reasonable (but overridable) defaults. Key behavior: - Publishes controller images on any workspaces/ directory change - Builds images with commit SHA tags by default - "release" images with use the tag as defined by the `VERSION` file - a `-dirty` suffix is added to the tag if the codebase is not `porcelain` - no `latest` tag is ever produced on images - Uses `ghcr.io/kubeflow/notebooks` registry with configurable naming example image name from "random" commit: - `ghcr.io/kubeflow/notebooks/workspaces-controller:sha-3fa851ab3173942dbaa1a609468e7f9eadf5f4e4` example image name from release: - `ghcr.io/kubeflow/notebooks/workspaces-controller:v2.0.0` Signed-off-by: Andy Stoneberg <astonebe@redhat.com>

Signed-off-by: Mathew Wicks <5735406+thesuperzapper@users.noreply.github.com>

thesuperzapper · 2025-09-26T00:45:43Z

@andyatmiami I have pushed a significant change in 288d0cf, which it would be great if you can test in a fork.

It makes lots of improvements, but one of the biggest is also testing the image builds on any PRs to the various components.

It also replaces the need for #611 and #610 by combining them into this PR

andyatmiami

Overall I really like these changes.

The shared Build Image workflow does an excellent job encapsulating this logic to be reused across controller , backend, frontend
I am happy to see us pull the trigger (pun intended!) and abandon the CONTAINER_TOOL Makefile var and simplify/align the container-runtime related commands to be more consistent with how Kubeflow traditionally has implemented them

Review comments I have made are moreso clarifying questions/open statements for discussion - I do NOT feel so strongly on any of them such that they should hold up this PR.

I will now look into testing/validating these changes. Thanks!

.github/workflows/ws-build-image.yml

.github/workflows/ws-publish.yml

andyatmiami

Whoops, forgot to include this comment on prior review 😞

.github/workflows/ws-build-image.yml

andyatmiami

Hehe, ok, yet another comment/discussion point I want to raise around another possible optimization...

.github/workflows/ws-build-image.yml

andyatmiami · 2025-09-29T21:29:21Z

I have confirmed the image-build PR steps work as intended (on my fork)

.github/workflows/ws-build-image.yml

Signed-off-by: Andy Stoneberg <astonebe@redhat.com>

andyatmiami · 2025-10-01T12:14:59Z

Latest Verification

PR image-build checks successful:

Push sha tag build successful (mostly)

Build 'workspaces-controller' image
Build 'workspaces-backend' image
Build 'workspaces-frontend' image
- ⚠️ Run 1 seemed to hang on arm64 step
  - did not observe this hanging behaving on ~10+ other subsequent runs

Push semver tag build successful (no {major}.{minor})

Push semver tag build successful

with.semver_raw has an incorrect reference to version_raw output that results in an empty string always being passed - which prevented semver tags from ever being produced (even when they should be) Signed-off-by: Andy Stoneberg <astonebe@redhat.com>

needs.check_version stores all its 'interesting data' under the 'outputs' attribute. This was not properly reflected in the 'with' block for images job. Signed-off-by: Andy Stoneberg <astonebe@redhat.com>

thesuperzapper · 2025-10-02T18:12:21Z

@andyatmiami thanks for all the back and forward on this, will be great to have container images being published for Notebooks 2.0!

/lgtm
/approve

google-oss-prow · 2025-10-02T18:12:28Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: thesuperzapper

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~.github/workflows/OWNERS~~ [thesuperzapper]
~~workspaces/backend/OWNERS~~ [thesuperzapper]
~~workspaces/controller/OWNERS~~ [thesuperzapper]
~~workspaces/frontend/OWNERS~~ [thesuperzapper]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

github-project-automation bot added this to Kubeflow Notebooks Sep 19, 2025

github-project-automation bot moved this to Needs Triage in Kubeflow Notebooks Sep 19, 2025

google-oss-prow bot added do-not-merge/work-in-progress area/ci area - related to ci labels Sep 19, 2025

google-oss-prow bot requested review from kimwnasptd and thesuperzapper September 19, 2025 21:03

google-oss-prow bot added area/controller area - related to controller components area/v2 area - version - kubeflow notebooks v2 size/L labels Sep 19, 2025

andyatmiami force-pushed the chore/publish_controller_workflow branch from 6b7edf5 to e1b1b05 Compare September 19, 2025 21:03

google-oss-prow bot added the do-not-merge/hold label Sep 19, 2025

google-oss-prow bot added the ok-to-test label Sep 22, 2025

andyatmiami force-pushed the chore/publish_controller_workflow branch from e1b1b05 to d25ab9b Compare September 25, 2025 20:25

google-oss-prow bot added size/M and removed size/L labels Sep 25, 2025

andyatmiami marked this pull request as ready for review September 25, 2025 20:25

google-oss-prow bot removed the do-not-merge/work-in-progress label Sep 25, 2025

google-oss-prow bot removed the do-not-merge/hold label Sep 25, 2025

andyatmiami force-pushed the chore/publish_controller_workflow branch from d25ab9b to bfd6ee6 Compare September 25, 2025 20:35

andyatmiami force-pushed the chore/publish_controller_workflow branch from bfd6ee6 to 828230d Compare September 25, 2025 20:40

mathew: example rewrite 1

288d0cf

Signed-off-by: Mathew Wicks <5735406+thesuperzapper@users.noreply.github.com>

google-oss-prow bot added area/backend area - related to backend components area/frontend area - related to frontend components and removed size/M labels Sep 26, 2025

google-oss-prow bot added the size/L label Sep 26, 2025

This was referenced Sep 26, 2025

ci: add publish workflow for backend #610

Closed

ci: add publish workflow for frontend #611

Closed

andyatmiami commented Sep 29, 2025

View reviewed changes

.github/workflows/ws-build-image.yml Show resolved Hide resolved

.github/workflows/ws-build-image.yml Show resolved Hide resolved

.github/workflows/ws-publish.yml Show resolved Hide resolved

andyatmiami commented Sep 29, 2025

View reviewed changes

.github/workflows/ws-build-image.yml Show resolved Hide resolved

andyatmiami commented Sep 29, 2025

View reviewed changes

.github/workflows/ws-build-image.yml Show resolved Hide resolved

thesuperzapper reviewed Sep 30, 2025

View reviewed changes

.github/workflows/ws-build-image.yml Show resolved Hide resolved

fix registry path to include owner and repo name

225b47d

Signed-off-by: Andy Stoneberg <astonebe@redhat.com>

andyatmiami added 2 commits October 1, 2025 09:38

ci: fix ws-publish.yml

3e2c437

with.semver_raw has an incorrect reference to version_raw output that results in an empty string always being passed - which prevented semver tags from ever being produced (even when they should be) Signed-off-by: Andy Stoneberg <astonebe@redhat.com>

fix: semver with references

284cc8f

needs.check_version stores all its 'interesting data' under the 'outputs' attribute. This was not properly reflected in the 'with' block for images job. Signed-off-by: Andy Stoneberg <astonebe@redhat.com>

thesuperzapper mentioned this pull request Oct 2, 2025

ci: add releasing/version/VERSION file #629

Merged

thesuperzapper changed the title ~~ci: add publish workflow for controller~~ ci: add container builds and publish workflow Oct 2, 2025

google-oss-prow bot assigned thesuperzapper Oct 2, 2025

google-oss-prow bot added the lgtm label Oct 2, 2025

google-oss-prow bot added the approved label Oct 2, 2025

google-oss-prow bot merged commit 1e5c049 into kubeflow:notebooks-v2 Oct 2, 2025
20 of 21 checks passed

github-project-automation bot moved this from Needs Triage to Done in Kubeflow Notebooks Oct 2, 2025

This was referenced Oct 3, 2025

[TASK] GHA workflow to publish controller container image as a GHCR package #606

Closed

[TASK] GHA workflow to publish backend container image as a GHCR package #607

Closed

[TASK] GHA workflow to publish frontend container image as a GHCR package #608

Closed

ci: add container builds and publish workflow #605

ci: add container builds and publish workflow #605

Uh oh!

Conversation

andyatmiami commented Sep 19, 2025 • edited by thesuperzapper Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

andyatmiami commented Sep 19, 2025

Uh oh!

andyatmiami commented Sep 22, 2025

Uh oh!

andyatmiami commented Sep 22, 2025

Uh oh!

andyatmiami commented Sep 22, 2025

Uh oh!

andyatmiami commented Sep 25, 2025

Uh oh!

thesuperzapper commented Sep 26, 2025

Uh oh!

andyatmiami left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

andyatmiami left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

andyatmiami left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

andyatmiami commented Sep 29, 2025

Uh oh!

Uh oh!

andyatmiami commented Oct 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Latest Verification

Uh oh!

thesuperzapper commented Oct 2, 2025

Uh oh!

google-oss-prow bot commented Oct 2, 2025

Uh oh!

Uh oh!

Uh oh!

andyatmiami commented Sep 19, 2025 •

edited by thesuperzapper

Loading

andyatmiami left a comment •

edited

Loading

andyatmiami commented Oct 1, 2025 •

edited

Loading