update-models.yaml

name: update-models

on:
  workflow_dispatch:

permissions:
  contents: write
  packages: write
  id-token: write

jobs:
 update-models:
    strategy:
      fail-fast: false
      matrix:
        model:
         - llama-2-7b-chat
         - llama-2-13b-chat
         - orca-2-13b
         - llama-2-7b-chat-cuda
         - llama-2-13b-chat-cuda
         - orca-2-13b-cuda
    runs-on: ubuntu-latest
    timeout-minutes: 360
    steps:
      - uses: actions/checkout@v4

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - uses: crazy-max/ghaction-github-runtime@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: parse matrix
        run: |
          echo "MODEL_NAME=$(echo ${{ matrix.model }} | sed -E 's/([a-z]+)-([0-9]+)-.*/\1\2/')" >> $GITHUB_ENV
          echo "MODEL_SIZE=$(echo ${{ matrix.model }} | sed -E 's/[a-z]+-[0-9]+-([0-9]+b).*/\1/')" >> $GITHUB_ENV
          echo "MODEL_TYPE=$(echo ${{ matrix.model }} | sed -E 's/.*-([a-z]+)(-cuda)?$/\1/' | grep -Eo 'chat')" >> $GITHUB_ENV
          echo "MODEL_RUNTIME=-$(echo ${{ matrix.model }} | sed -E 's/.*-(cuda)?$/\1/' | grep -Eo 'cuda')" >> $GITHUB_ENV

      - name: Build and push
        run: |
          if [ "${MODEL_RUNTIME}" == "-" ]; then
            export MODEL_RUNTIME=""
            echo "MODEL_RUNTIME=''" >> $GITHUB_ENV
          fi

          echo MODEL_NAME ${MODEL_NAME}
          echo MODEL_SIZE ${MODEL_SIZE}
          echo MODEL_TYPE ${MODEL_TYPE}
          echo MODEL_RUNTIME ${MODEL_RUNTIME}

          docker buildx build . -t ghcr.io/sozercan/test/${MODEL_NAME}:${MODEL_SIZE}${MODEL_RUNTIME} \
            -f models/${{ matrix.model }}.yaml \
            --push --progress plain \
            --cache-from=type=gha,scope=${MODEL_NAME}-${MODEL_SIZE} \
            --cache-to=type=gha,scope=${MODEL_NAME}-${MODEL_SIZE},mode=max
          echo "DIGEST=$(cosign triangulate ghcr.io/sozercan/${MODEL_NAME}:${MODEL_SIZE}${MODEL_RUNTIME} --type digest)" >> $GITHUB_ENV

      - name: Sign the images with GitHub OIDC Token
        run: cosign sign --yes ${DIGEST}

      - name: Verify image signature
        run: |
          cosign verify ${DIGEST} \
            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
            --certificate-identity https://github.com/sozercan/aikit/.github/workflows/update-models.yaml@refs/heads/main