ParseBench-Version-Lab/.github/workflows/pymupdf-source-stack-environment.yml at main · pymupdf/ParseBench-Version-Lab · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
name: Build ParseBench Version Lab Environment

run-name: ENV publish · workflow@${{ github.ref_name }}

on:
  workflow_dispatch:

permissions:
  contents: read
  packages: write

env:
  ENVIRONMENT_IMAGE: ghcr.io/pymupdf/parsebench-source-stack-env
  ENVIRONMENT_VERSION_TAG: ubuntu24-python3.12.13-20260716-r3

jobs:
  build_environment:
    name: Build, test and publish environment image
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    concurrency:
      group: parsebench-source-stack-environment-publisher
      cancel-in-progress: false

    steps:
      - name: Require the default branch for container publishing
        if: ${{ github.ref_name != github.event.repository.default_branch }}
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: |
          echo "Container publishing is restricted to the default branch: ${DEFAULT_BRANCH}" >&2
          exit 1

      - name: Checkout environment definition
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.workflow_sha }}
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f

      - name: Define candidate image tag
        id: candidate
        run: echo "tag=${ENVIRONMENT_IMAGE}:run-${GITHUB_RUN_ID}-attempt-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_OUTPUT"

      - name: Build candidate environment image
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
        with:
          context: .
          file: .github/docker/pymupdf-source-stack/Dockerfile
          load: true
          platforms: linux/amd64
          tags: ${{ steps.candidate.outputs.tag }}
          labels: |
            org.opencontainers.image.revision=${{ github.workflow_sha }}
            org.opencontainers.image.version=${{ env.ENVIRONMENT_VERSION_TAG }}

      - name: Smoke-test candidate environment image
        env:
          IMAGE_TAG: ${{ steps.candidate.outputs.tag }}
        run: |
          docker run --rm --volume "$GITHUB_WORKSPACE:/workspace:ro" "$IMAGE_TAG" bash -euo pipefail -c '
            set -x
            test "$(python --version)" = "Python 3.12.13"
            test "$(uv --version | cut -d" " -f2)" = "0.11.29"
            test "$(dpkg-query -W -f="\${Version}" libgl1)" = "1.7.0-1build1"
            test "$(dpkg-query -W -f="\${Version}" libglib2.0-0t64)" = "2.80.0-6ubuntu1"
            test "$(dpkg-query -W -f="\${Version}" swig)" = "4.2.0-2ubuntu1"
            test "$(dpkg-query -W -f="\${Version}" tesseract-ocr)" = "5.3.4-1build5"
            test "$(dpkg-query -W -f="\${Version}" tesseract-ocr-eng)" = "1:4.1.0-2"
            test "$(dpkg-query -W -f="\${Version}" unzip)" = "6.0-28ubuntu4.1"
            tesseract --list-langs | grep -Fx eng
            unzip -v | sed -n "1p"
            python -c "import bz2, ctypes, curses, dbm, lzma, readline, sqlite3, ssl, uuid, zlib; print(ssl.OPENSSL_VERSION)"
            cc --version
            swig -version
            cat /usr/local/share/parsebench/environment.txt
            UV_PROJECT_ENVIRONMENT=/tmp/rapidocr-smoke \
              uv sync --project /workspace/tools/version_lab --locked \
                --no-install-project --no-install-package parse-bench
            /tmp/rapidocr-smoke/bin/python -c \
              "from importlib.metadata import version; from rapidocr import RapidOCR; import onnxruntime; print(version(\"rapidocr\"), onnxruntime.__version__, RapidOCR)"
          '

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Publish run-specific and version tags
        id: publish-image
        env:
          IMAGE_TAG: ${{ steps.candidate.outputs.tag }}
        run: |
          docker push "$IMAGE_TAG"
          version_tag="${ENVIRONMENT_IMAGE}:${ENVIRONMENT_VERSION_TAG}"
          docker tag "$IMAGE_TAG" "$version_tag"
          docker push "$version_tag"

          repository_digest="$(docker image inspect --format='{{index .RepoDigests 0}}' "$IMAGE_TAG")"
          digest="${repository_digest#*@}"
          image_ref="${ENVIRONMENT_IMAGE}@${digest}"
          echo "digest=${digest}" >> "$GITHUB_OUTPUT"
          echo "image_ref=${image_ref}" >> "$GITHUB_OUTPUT"

      - name: Add published image to workflow summary
        env:
          DIGEST: ${{ steps.publish-image.outputs.digest }}
          IMAGE_REF: ${{ steps.publish-image.outputs.image_ref }}
        run: |
          {
            echo "## Published environment image"
            echo
            echo "- Version tag: \`${ENVIRONMENT_IMAGE}:${ENVIRONMENT_VERSION_TAG}\`"
            echo "- Digest: \`${DIGEST}\`"
            echo "- Immutable reference: \`${IMAGE_REF}\`"
            echo "- Platform: \`linux/amd64\`"
            echo
            echo "This publisher validates the environment only. Before changing the benchmark's pinned digest, run the 15-case RapidOCR benchmark on PyMuPDF main against the candidate and review its compatibility report and scores."
          } >> "$GITHUB_STEP_SUMMARY"