From e5a35bac6e1cec0dbd8c8da72f7de05eac17ea32 Mon Sep 17 00:00:00 2001
From: Russell McGuire <russell.w.mcguire@intel.com>
Date: Wed, 7 Oct 2026 20:38:05 -0700
Subject: [PATCH] CI: publish Linux CI images built from public bases only

New ci-images.yml builds .github/docker/ci/* (Ubuntu, UBI+EPEL, SUSE BCI),
verifies each compiles the loader, and pushes to ghcr.io/<repo>/ci/*.

Signed-off-by: Russell McGuire <russell.w.mcguire@intel.com>
---
 .github/docker/ci/rhel.Dockerfile   | 27 +++++++++
 .github/docker/ci/sles.Dockerfile   | 23 ++++++++
 .github/docker/ci/ubuntu.Dockerfile | 59 ++++++++++++++++++
 .github/workflows/ci-images.yml     | 92 +++++++++++++++++++++++++++++
 4 files changed, 201 insertions(+)
 create mode 100644 .github/docker/ci/rhel.Dockerfile
 create mode 100644 .github/docker/ci/sles.Dockerfile
 create mode 100644 .github/docker/ci/ubuntu.Dockerfile
 create mode 100644 .github/workflows/ci-images.yml

diff --git a/.github/docker/ci/rhel.Dockerfile b/.github/docker/ci/rhel.Dockerfile
new file mode 100644
index 00000000..307690ce
--- /dev/null
+++ b/.github/docker/ci/rhel.Dockerfile
@@ -0,0 +1,27 @@
+# syntax=docker/dockerfile:1.4
+
+ARG VMAJ
+ARG VMIN
+# Public base image only; see .github/workflows/ci-images.yml.
+FROM registry.access.redhat.com/ubi${VMAJ}/ubi:${VMAJ}.${VMIN}
+
+ARG VMAJ
+
+SHELL ["/bin/bash", "-e", "-c"]
+
+# UBI repos lack ninja-build and ccache; EPEL provides both.
+RUN <<EOF2
+dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-${VMAJ}.noarch.rpm
+dnf -y install \
+  ccache \
+  cmake \
+  file \
+  gcc \
+  gcc-c++ \
+  git \
+  make \
+  ninja-build \
+  python3 \
+  rpm-build
+dnf clean all
+EOF2
diff --git a/.github/docker/ci/sles.Dockerfile b/.github/docker/ci/sles.Dockerfile
new file mode 100644
index 00000000..afb7ffe6
--- /dev/null
+++ b/.github/docker/ci/sles.Dockerfile
@@ -0,0 +1,23 @@
+# syntax=docker/dockerfile:1.4
+
+ARG VMAJ
+ARG VMIN
+# Public base image only; see .github/workflows/ci-images.yml.
+FROM registry.suse.com/bci/bci-base:${VMAJ}.${VMIN}
+
+SHELL ["/bin/bash", "-e", "-c"]
+
+RUN <<EOF2
+zypper -n install \
+  ccache \
+  cmake \
+  file \
+  gcc \
+  gcc-c++ \
+  git \
+  make \
+  ninja \
+  python3 \
+  rpm-build
+zypper clean -a
+EOF2
diff --git a/.github/docker/ci/ubuntu.Dockerfile b/.github/docker/ci/ubuntu.Dockerfile
new file mode 100644
index 00000000..c1a525ce
--- /dev/null
+++ b/.github/docker/ci/ubuntu.Dockerfile
@@ -0,0 +1,59 @@
+# syntax=docker/dockerfile:1.4
+
+ARG VMAJ
+ARG VMIN
+# Public base image only; see .github/workflows/ci-images.yml.
+FROM ubuntu:${VMAJ}.${VMIN}
+
+ARG VMAJ
+ARG VMIN
+
+SHELL ["/bin/bash", "-e", "-c"]
+
+RUN <<EOF
+source /etc/lsb-release
+if ((VMAJ < 24)); then
+    sed -i 's/^deb/deb [arch=amd64]/' /etc/apt/sources.list
+    cat >> /etc/apt/sources.list <<EOF2
+deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports/ ${DISTRIB_CODENAME} main restricted universe multiverse
+deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports/ ${DISTRIB_CODENAME}-updates main restricted universe multiverse
+deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports/ ${DISTRIB_CODENAME}-security main restricted universe multiverse
+deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports/ ${DISTRIB_CODENAME}-backports main restricted universe multiverse
+EOF2
+else
+    sed -i '/^Components:/a Architectures: amd64' /etc/apt/sources.list.d/ubuntu.sources
+    cat >> /etc/apt/sources.list.d/ubuntu.sources <<EOF2
+
+types: deb
+URIs: http://ports.ubuntu.com/ubuntu-ports/
+Suites: ${DISTRIB_CODENAME} ${DISTRIB_CODENAME}-updates ${DISTRIB_CODENAME}-security ${DISTRIB_CODENAME}-backports
+Components: main universe restricted multiverse
+Architectures: arm64
+Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+EOF2
+fi
+dpkg --add-architecture arm64
+EOF
+
+ENV DEBIAN_FRONTEND=noninteractive
+# /etc/apt/apt.conf.d/docker-clean doesn't work on older versions of docker for U2204 containers
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
+rm /etc/apt/apt.conf.d/docker-clean
+apt-get update
+apt-get install -y \
+  build-essential \
+  ccache \
+  cmake \
+  universal-ctags \
+  curl \
+  elfutils \
+  file \
+  gcc-aarch64-linux-gnu \
+  g++-aarch64-linux-gnu \
+  libc6:arm64 \
+  libstdc++6:arm64 \
+  git \
+  ninja-build \
+  python3
+rm -rf /var/lib/apt/lists/*
+EOF
\ No newline at end of file
diff --git a/.github/workflows/ci-images.yml b/.github/workflows/ci-images.yml
new file mode 100644
index 00000000..b78ffe23
--- /dev/null
+++ b/.github/workflows/ci-images.yml
@@ -0,0 +1,92 @@
+name: CI Images
+
+# Builds the Linux CI images from public base images only (Docker Hub ubuntu,
+# Red Hat UBI + EPEL, SUSE BCI) and publishes them to
+# ghcr.io/<repo>/ci/<distro>:<version>. Pull requests build and verify the
+# images without publishing; the weekly run picks up base image updates.
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '23 2 * * 1'
+  push:
+    branches: [ master ]
+    paths:
+      - '.github/docker/ci/**'
+      - '.github/workflows/ci-images.yml'
+  pull_request:
+    branches: [ master ]
+    paths:
+      - '.github/docker/ci/**'
+      - '.github/workflows/ci-images.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: ${{ matrix.os.name }}-${{ matrix.os.vmaj }}.${{ matrix.os.vmin }}
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'oneapi-src'
+    permissions:
+      contents: read
+      # Needed to publish the images to ghcr.io.
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [
+          {name: ubuntu, vmaj: 22, vmin: '04'},
+          {name: ubuntu, vmaj: 24, vmin: '04'},
+          {name: ubuntu, vmaj: 26, vmin: '04'},
+          {name: sles, vmaj: 15, vmin: 4},
+          {name: sles, vmaj: 15, vmin: 6},
+          {name: sles, vmaj: 15, vmin: 7},
+          {name: rhel, vmaj: 8, vmin: 6},
+          {name: rhel, vmaj: 8, vmin: 10},
+          {name: rhel, vmaj: 9, vmin: 6}
+        ]
+    env:
+      IMAGE: ghcr.io/${{ github.repository }}/ci/${{ matrix.os.name }}:${{ matrix.os.vmaj }}.${{ matrix.os.vmin }}
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
+
+    - name: Build image
+      # Retry to ride out transient registry timeouts on the public base images.
+      run: |
+        for attempt in 1 2 3; do
+          docker build \
+            --platform linux/amd64 \
+            --pull \
+            --build-arg VMAJ=${{ matrix.os.vmaj }} \
+            --build-arg VMIN=${{ matrix.os.vmin }} \
+            --label org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }} \
+            --tag "${IMAGE}" \
+            - < .github/docker/ci/${{ matrix.os.name }}.Dockerfile && exit 0
+          echo "docker build attempt ${attempt} failed; retrying in $((attempt*15))s" >&2
+          sleep $((attempt*15))
+        done
+        exit 1
+
+    - name: Verify the image builds the loader
+      run: |
+        docker run --rm -v "${{ github.workspace }}":/src:ro "${IMAGE}" bash -e -x -c '
+          cp -r /src /tmp/l0 && cd /tmp/l0 && mkdir build && cd build
+          gcc --version | head -1
+          cmake -G Ninja \
+            -D CMAKE_C_COMPILER_LAUNCHER=ccache \
+            -D CMAKE_CXX_COMPILER_LAUNCHER=ccache \
+            -D CMAKE_BUILD_TYPE=Release \
+            -D CMAKE_INSTALL_PREFIX=../install ..
+          cmake --build . --target install'
+
+    - name: Publish image
+      if: github.event_name != 'pull_request'
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        GH_ACTOR: ${{ github.actor }}
+      run: |
+        echo "${GH_TOKEN}" | docker login ghcr.io -u "${GH_ACTOR}" --password-stdin
+        docker push "${IMAGE}"