name: dogfood

on:

push:

branches:

- main

paths:

- "dogfood/**"

- ".github/workflows/dogfood.yaml"

- "flake.lock"

- "flake.nix"

pull_request:

paths:

- "dogfood/**"

- ".github/workflows/dogfood.yaml"

- "flake.lock"

- "flake.nix"

workflow_dispatch:

permissions:

contents: read

jobs:

build_image:

strategy:

fail-fast: false

matrix:

image-version: ["22.04", "26.04", "nix"]

if: github.actor != 'dependabot[bot]' # Skip Dependabot PRs

runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-4' || 'ubuntu-latest' }}

steps:

- name: Harden Runner

uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1

with:

egress-policy: audit

- name: Checkout

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

with:

persist-credentials: false

- name: Setup Nix

uses: nixbuild/nix-quick-install-action@2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035 # v34

with:

# Pinning to 2.28 here, as Nix gets a "error: [json.exception.type_error.302] type must be array, but is string"

# on version 2.29 and above.

nix_version: "2.28.5"

if: matrix.image-version == 'nix'

- uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2

with:

# restore and save a cache using this key

primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}

# if there's no cache hit, restore a cache by this prefix

restore-prefixes-first-match: nix-${{ runner.os }}-

# collect garbage until Nix store size (in bytes) is at most this number

# before trying to save a new cache

# 1G = 1073741824

gc-max-store-size-linux: 5G

# do purge caches

purge: true

# purge all versions of the cache

purge-prefixes: nix-${{ runner.os }}-

# created more than this number of seconds ago relative to the start of the `Post Restore` phase

purge-created: 0

# except the version with the `primary-key`, if it exists

purge-primary-key: never

if: matrix.image-version == 'nix'

- name: Get branch name

id: branch-name

uses: tj-actions/branch-names@5250492686b253f06fa55861556d1027b067aeb5 # v9.0.2

- name: "Branch name to Docker tag name"

id: docker-tag-name

run: |

# Replace / with --, e.g. user/feature => user--feature.

tag=${BRANCH_NAME//\//--}

echo "tag=${tag}" >> "$GITHUB_OUTPUT"

env:

BRANCH_NAME: ${{ steps.branch-name.outputs.current_branch }}

- name: Set up Depot CLI

uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.7.1

if: matrix.image-version != 'nix'

- name: Set up Docker Buildx

uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

if: matrix.image-version != 'nix'

- name: Login to DockerHub

if: github.ref == 'refs/heads/main'

uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0

with:

username: ${{ secrets.DOCKERHUB_USERNAME }}

password: ${{ secrets.DOCKERHUB_PASSWORD }}

- name: Build and push Ubuntu 22.04 image

uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0

with:

project: b4q6ltmpzh

token: ${{ secrets.DEPOT_TOKEN }}

buildx-fallback: true

context: "{{defaultContext}}:dogfood/coder/ubuntu-22.04"

pull: true

save: true

push: ${{ github.ref == 'refs/heads/main' }}

# TODO: move the `latest` tag to 26.04 soon. we don't want to transition

# it immediately because that would make workspaces switch to it

# automatically without any grace period.

tags: "codercom/oss-dogfood:${{ steps.docker-tag-name.outputs.tag }},codercom/oss-dogfood:22.04,codercom/oss-dogfood:latest"

if: matrix.image-version == '22.04'

- name: Build and push Ubuntu 26.04 image

uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0

with:

project: b4q6ltmpzh

token: ${{ secrets.DEPOT_TOKEN }}

buildx-fallback: true

context: "{{defaultContext}}:dogfood/coder/ubuntu-26.04"

pull: true

save: true

push: ${{ github.ref == 'refs/heads/main' }}

tags: "codercom/oss-dogfood:${{ steps.docker-tag-name.outputs.tag }},codercom/oss-dogfood:26.04"

if: matrix.image-version == '26.04'

- name: Build and push vscode-coder image

uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0

with:

project: b4q6ltmpzh

token: ${{ secrets.DEPOT_TOKEN }}

buildx-fallback: true

context: "{{defaultContext}}:dogfood/vscode-coder"

pull: true

save: true

push: ${{ github.ref == 'refs/heads/main' }}

tags: "codercom/oss-dogfood-vscode-coder:${{ steps.docker-tag-name.outputs.tag }},codercom/oss-dogfood-vscode-coder:latest"

if: matrix.image-version == '22.04'

- name: Build Nix image

run: nix build .#dev_image

if: matrix.image-version == 'nix'

- name: Push Nix image

if: matrix.image-version == 'nix' && github.ref == 'refs/heads/main'

run: |

docker load -i result

CURRENT_SYSTEM=$(nix eval --impure --raw --expr 'builtins.currentSystem')

docker image tag "codercom/oss-dogfood-nix:latest-$CURRENT_SYSTEM" "codercom/oss-dogfood-nix:${DOCKER_TAG}"

docker image push "codercom/oss-dogfood-nix:${DOCKER_TAG}"

docker image tag "codercom/oss-dogfood-nix:latest-$CURRENT_SYSTEM" "codercom/oss-dogfood-nix:latest"

docker image push "codercom/oss-dogfood-nix:latest"

env:

DOCKER_TAG: ${{ steps.docker-tag-name.outputs.tag }}

deploy_template:

needs: build_image

runs-on: ubuntu-latest

permissions:

# Necessary for GCP authentication (https://github.com/google-github-actions/setup-gcloud#usage)

id-token: write

steps:

- name: Harden Runner

uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1

with:

egress-policy: audit

- name: Checkout

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

with:

persist-credentials: false

- name: Setup Terraform

uses: ./.github/actions/setup-tf

- name: Authenticate to Google Cloud

uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0

with:

workload_identity_provider: ${{ vars.GCP_WORKLOAD_ID_PROVIDER }}

service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}

- name: Terraform init and validate

run: |

pushd dogfood/

terraform init

terraform validate

popd

pushd dogfood/coder

terraform init

terraform validate

popd

pushd dogfood/coder-envbuilder

terraform init

terraform validate

popd

pushd dogfood/vscode-coder

terraform init

terraform validate

popd

- name: Get short commit SHA

if: github.ref == 'refs/heads/main'

id: vars

run: echo "sha_short=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"

- name: Get latest commit title

if: github.ref == 'refs/heads/main'

id: message

run: echo "pr_title=$(git log --format=%s -n 1 ${{ github.sha }})" >> "$GITHUB_OUTPUT"

- name: "Push template"

if: github.ref == 'refs/heads/main'

run: |

cd dogfood

terraform apply -auto-approve

env:

# Consumed by coderd provider

CODER_URL: https://dev.coder.com

CODER_SESSION_TOKEN: ${{ secrets.CODER_SESSION_TOKEN }}

# Template source & details

TF_VAR_CODER_DOGFOOD_ANTHROPIC_API_KEY: ${{ secrets.CODER_DOGFOOD_ANTHROPIC_API_KEY }}

TF_VAR_CODER_TEMPLATE_NAME: ${{ secrets.CODER_TEMPLATE_NAME }}

TF_VAR_CODER_TEMPLATE_VERSION: ${{ steps.vars.outputs.sha_short }}

TF_VAR_CODER_TEMPLATE_DIR: ./coder

TF_VAR_CODER_TEMPLATE_MESSAGE: ${{ steps.message.outputs.pr_title }}

TF_LOG: info