ci: build and push the cms mlflow ui image

Author: baixiac

.github/workflows/docker-extra.yaml

@@ -0,0 +1,83 @@
+name: docker extra
+
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'docker/mlflow/**'
+  pull_request:
+    branches: [ master ]
+    paths:
+      - 'docker/mlflow/**'
+
+env:
+  REGISTRY: docker.io
+  DOCKER_IMAGE_NAME: cogstacksystems/cogstack-mlflow-ui
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    container: hadolint/hadolint:latest-debian
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Lint
+        run: hadolint --ignore DL3008 --ignore DL3013 --ignore DL3003 --ignore DL4006 docker/mlflow/**/Dockerfile*
+
+  build-and-push:
+    needs: lint
+    if: |
+      github.repository == 'CogStack/CogStack-ModelServe' &&
+      github.ref == 'refs/heads/master' &&
+      github.event_name == 'push'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+    concurrency: build-and-push
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      
+      - name: Cache Docker layers
+        uses: actions/cache@v4
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-
+
+      - name: Build and push MLflow UI
+        uses: docker/build-push-action@v6
+        id: build_and_push_mlflow_ui
+        with:
+          platforms: linux/amd64,linux/arm64
+          context: .
+          file: docker/mlflow/server/Dockerfile
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.DOCKER_IMAGE_NAME }}:dev
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache,mode=max
+      
+      - name: Attest image artifacts
+        uses: actions/attest-build-provenance@v2
+        id: attest
+        with:
+            subject-name: ${{ env.REGISTRY }}/${{ env.DOCKER_IMAGE_NAME }}
+            subject-digest: ${{ steps.build_and_push_mlflow_ui.outputs.digest }}
+            push-to-registry: true

.github/workflows/docker.yaml

@@ -7,6 +7,7 @@ on:
     branches: [ master ]
 
 env:
+  REGISTRY: docker.io
   DOCKER_IMAGE_NAME: cogstacksystems/cogstack-modelserve
 
 jobs:
@@ -17,7 +18,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Lint
-        run: hadolint --ignore DL3008 --ignore DL3013 --ignore DL3003 --ignore DL4006 docker/Dockerfile* docker/**/Dockerfile* docker/mlflow/**/Dockerfile*
+        run: hadolint --ignore DL3008 --ignore DL3013 --ignore DL3003 --ignore DL4006 docker/Dockerfile* docker/**/Dockerfile*
 
   build-and-push:
     needs: lint
@@ -26,6 +27,11 @@ jobs:
       github.ref == 'refs/heads/master' &&
       github.event_name == 'push'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
     concurrency: build-and-push
     steps:
       - uses: actions/checkout@v4
@@ -39,6 +45,7 @@ jobs:
       - name: Login to Docker Hub
         uses: docker/login-action@v3
         with:
+          registry: ${{ env.REGISTRY }}
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
@@ -50,14 +57,23 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-buildx-
 
-      - name: Build and push
+      - name: Build and push CMS
         uses: docker/build-push-action@v6
+        id: build_and_push_cms
         with:
           platforms: linux/amd64,linux/arm64
           context: .
           file: docker/Dockerfile
           push: true
           tags: |
-            ${{ env.DOCKER_IMAGE_NAME }}:dev
+            ${{ env.REGISTRY }}/${{ env.DOCKER_IMAGE_NAME }}:dev
           cache-from: type=local,src=/tmp/.buildx-cache
           cache-to: type=local,dest=/tmp/.buildx-cache,mode=max
+
+      - name: Attest image artifacts
+        uses: actions/attest-build-provenance@v2
+        id: attest
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.DOCKER_IMAGE_NAME }}
+          subject-digest: ${{ steps.build_and_push_cms.outputs.digest }}
+          push-to-registry: true