litellm/.github/workflows/lens-worker.yml

name: Lens Worker Image

on:
  pull_request:
    branches: [main, litellm_oss_branch, "litellm_**"]
    paths:
      - deploy/lens/**
      - litellm-rust/**
      - litellm/proxy/lens/**
      - tests/proxy_behavior/lens/**
      - .github/workflows/lens-worker.yml
  push:
    branches: [main]
    paths:
      - deploy/lens/**
      - litellm-rust/**
      - litellm/proxy/lens/**
      - tests/proxy_behavior/lens/**
      - .github/workflows/lens-worker.yml
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  lens-worker-image:
    permissions:
      contents: read
      packages: write
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            runner: ubuntu-latest
          - arch: arm64
            runner: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          persist-credentials: false
      - name: Build native Lens service
        env:
          RELEASE_TAG: sha-${{ github.sha }}
        run: docker build --build-arg LITELLM_RELEASE_TAG="$RELEASE_TAG" -f deploy/lens/Dockerfile -t lens-worker .
      - name: Verify version and unprivileged runtime
        env:
          RELEASE_TAG: sha-${{ github.sha }}
        run: bash deploy/lens/smoke.sh lens-worker "$RELEASE_TAG"
      - name: Verify confined Python on the native architecture
        env:
          RELEASE_TAG: sha-${{ github.sha }}
        run: |
          docker build --target smoke --build-arg LITELLM_RELEASE_TAG="$RELEASE_TAG" -f deploy/lens/Dockerfile -t lens-smoke .
          docker run --rm --network none --read-only --cap-drop ALL \
            --tmpfs /tmp:rw,noexec,nosuid,size=1g --security-opt no-new-privileges lens-smoke
      - name: Reject custom builds without a matching release tag
        run: |
          if docker build --progress plain -f deploy/lens/Dockerfile -t lens-worker:unversioned . > missing-tag.log 2>&1; then
            echo "::error::An unversioned worker build unexpectedly succeeded"
            exit 1
          fi
          grep -F 'LITELLM_RELEASE_TAG: Pass --build-arg LITELLM_RELEASE_TAG matching the gateway' missing-tag.log
      - name: Publish development architecture
        if: github.event_name != 'pull_request' && github.repository == 'BerriAI/litellm' && github.ref == 'refs/heads/main'
        env:
          REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REGISTRY_USER: ${{ github.actor }}
          IMAGE: ghcr.io/berriai/litellm-lens-worker-dev:sha-${{ github.sha }}-${{ matrix.arch }}
          ARCH: ${{ matrix.arch }}
        run: |
          printf '%s' "$REGISTRY_TOKEN" | docker login ghcr.io -u "$REGISTRY_USER" --password-stdin
          docker tag lens-worker "$IMAGE"
          docker push "$IMAGE"
          mkdir -p digests
          docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE" > "digests/$ARCH"
      - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        if: github.event_name != 'pull_request' && github.repository == 'BerriAI/litellm' && github.ref == 'refs/heads/main'
        with:
          name: lens-digest-${{ matrix.arch }}
          path: digests/
          retention-days: 1

  publish:
    name: Publish Lens development index
    needs: lens-worker-image
    if: github.event_name != 'pull_request' && github.repository == 'BerriAI/litellm' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    permissions:
      packages: write
    steps:
      - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
        with:
          pattern: lens-digest-*
          merge-multiple: true
          path: digests
      - name: Publish both tested architectures
        env:
          REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REGISTRY_USER: ${{ github.actor }}
          IMAGE: ghcr.io/berriai/litellm-lens-worker-dev:sha-${{ github.sha }}
        run: |
          printf '%s' "$REGISTRY_TOKEN" | docker login ghcr.io -u "$REGISTRY_USER" --password-stdin
          docker buildx imagetools create --tag "$IMAGE" "$(cat digests/amd64)" "$(cat digests/arm64)"
          printf 'Lens worker image: `%s`\n' "$IMAGE" >> "$GITHUB_STEP_SUMMARY"