From 8fb8d80d947dafbc11678edc2c89e6e6eb6a3b5d Mon Sep 17 00:00:00 2001
From: Brian Bjarke Jensen <bbj@skov.dk>
Date: Fri, 3 Oct 2025 23:35:32 +0200
Subject: [PATCH] updated workflow to check for base image digest of
 mlflow-full

---
 .gitea/workflows/update.yml | 73 +++++++++++++++++++++++++++++--------
 1 file changed, 57 insertions(+), 16 deletions(-)

diff --git a/.gitea/workflows/update.yml b/.gitea/workflows/update.yml
index 7ac8212..74c34b8 100644
--- a/.gitea/workflows/update.yml
+++ b/.gitea/workflows/update.yml
@@ -10,7 +10,7 @@ jobs:
   check-images:
     runs-on: ubuntu-latest
     outputs:
-      base_image_digest: ${{ steps.mlflow-base.outputs.base_image_digest }}
+      base_image_digest: ${{ steps.mlflow-base.outputs.digest }}
       should_build: ${{ steps.decision.outputs.should_build }}
     steps:
     - name: Log in to Gitea Container Registry
@@ -18,31 +18,66 @@ jobs:
         mkdir -p ~/.docker
         echo '{"insecure-registries": ["10.0.0.2:3000"]}' > ~/.docker/config.json
         echo "${{ secrets.CI_RUNNER_TOKEN }}" | docker login 10.0.0.2:3000 --username "${{ gitea.actor }}" --password-stdin
-    - name: Check MLflow-full image
+    - name: Check MLflow-full base image digest
       id: mlflow-full
       run: |
         MANIFEST=$(docker manifest inspect "gitea.gt-proj.com/brian/mlflow-full:latest" 2>/dev/null || echo "{}")
-        if [ "$MANIFEST" != "{}" ]; then
-          DIGEST=$(echo "$MANIFEST" | jq -r '.manifests[]? | select(.platform.architecture == "amd64" and .platform.os == "linux") | .digest // empty')
-          echo "digest=$DIGEST" >> $GITHUB_OUTPUT
-          echo "manifest_found=true" >> $GITHUB_OUTPUT
-          echo "Manifest found for MLflow-full image with digest: $DIGEST"
-        else
-          echo "manifest_found=false" >> $GITHUB_OUTPUT
-          echo "MLflow-full image not found"
+        if [ "$MANIFEST" == "{}" ]; then
+          echo "digest_found=false" >> $GITHUB_OUTPUT
+          echo "MLflow-full manifest not found"
+          exit 1
         fi
-    - name: Check MLflow base image
+        # Extract digest for linux/amd64 platform
+        DIGEST=$(echo "$MANIFEST" | jq -r '.manifests[]? | select(.platform.architecture == "amd64" and .platform.os == "linux") | .digest // empty')
+        if [ -z "$DIGEST" ]; then
+          echo "digest_found=false" >> $GITHUB_OUTPUT
+          echo "No suitable manifest found for linux/amd64"
+          exit 1
+        fi
+        # Get the manifest for the specific platform
+        PLATFORM_MANIFEST=$(curl -s -H "Accept: application/vnd.docker.distribution.manifest.v2+json" \
+          "http://gitea.gt-proj.com/v2/brian/mlflow-full/manifests/$DIGEST" 2>/dev/null || echo "{}")
+        if [ "$PLATFORM_MANIFEST" == "{}" ]; then
+          echo "digest_found=false" >> $GITHUB_OUTPUT
+          echo "Failed to fetch platform-specific manifest"
+          exit 1
+        fi
+        # Extract config blob digest
+        CONFIG_DIGEST=$(echo "$PLATFORM_MANIFEST" | jq -r '.config.digest // empty')
+        if [ -z "$CONFIG_DIGEST" ]; then
+          echo "digest_found=false" >> $GITHUB_OUTPUT
+          echo "No config digest found in platform manifest"
+          exit 1
+        fi
+        # Fetch the configuration blob to get labels
+        CONFIG_BLOB=$(curl -s "http://gitea.gt-proj.com/v2/brian/mlflow-full/blobs/$CONFIG_DIGEST" 2>/dev/null || echo "{}")
+        if [ "$CONFIG_BLOB" == "{}" ]; then
+          echo "digest_found=false" >> $GITHUB_OUTPUT
+          echo "Failed to fetch config blob"
+          exit 1
+        fi
+        # Extract base image digest label from config
+        BASE_IMAGE_DIGEST=$(echo "$CONFIG_BLOB" | jq -r '.config.Labels["base-image.digest"] // empty')
+        if [ -z "$BASE_IMAGE_DIGEST" ]; then
+          echo "digest_found=false" >> $GITHUB_OUTPUT
+          echo "No base-image.digest label found in MLflow-full image"
+          exit 1
+        fi
+        echo "base_image_digest=$BASE_IMAGE_DIGEST" >> $GITHUB_OUTPUT
+        echo "digest_found=true" >> $GITHUB_OUTPUT
+        echo "Base image digest from MLflow-full image: $BASE_IMAGE_DIGEST"
+    - name: Check MLflow base image digest
       id: mlflow-base
-      if: steps.mlflow-full.outputs.manifest_found == 'true'
+      if: steps.mlflow-full.outputs.digest_found == 'true'
       run: |
         MANIFEST=$(docker manifest inspect ghcr.io/mlflow/mlflow:latest 2>/dev/null || echo "{}")
         if [ "$MANIFEST" != "{}" ]; then
           DIGEST=$(echo "$MANIFEST" | jq -r '.manifests[]? | select(.platform.architecture == "amd64" and .platform.os == "linux") | .digest // empty')
           echo "digest=$DIGEST" >> $GITHUB_OUTPUT
-          echo "manifest_found=true" >> $GITHUB_OUTPUT
-          echo "Manifest found for MLflow base image with digest: $DIGEST"
+          echo "digest_found=true" >> $GITHUB_OUTPUT
+          echo "Digest found for MLflow base image: $DIGEST"
         else
-          echo "manifest_found=false" >> $GITHUB_OUTPUT
+          echo "digest_found=false" >> $GITHUB_OUTPUT
           echo "MLflow base image not found"
         fi
     - name: Build decision
@@ -51,7 +86,13 @@ jobs:
         if [ "${{ steps.mlflow-base.outputs.manifest_found }}" == "true" ] && \
            [ "${{ steps.mlflow-full.outputs.manifest_found }}" == "true" ]; then
           echo "✅ Both MLflow base and MLflow-full images found"
-          echo "should_build=true" >> $GITHUB_OUTPUT
+          if [ "${{ steps.mlflow-base.outputs.digest }}" != "${{ steps.mlflow-full.outputs.base_image_digest }}" ]; then
+            echo "Base image digest has changed"
+            echo "should_build=true" >> $GITHUB_OUTPUT
+          else
+            echo "Base image digest is unchanged"
+            echo "should_build=false" >> $GITHUB_OUTPUT
+          fi
         elif [ "${{ steps.mlflow-base.outputs.manifest_found }}" != "true" ]; then
           echo "❌ MLflow base image not found"
           echo "should_build=false" >> $GITHUB_OUTPUT