11name : CI
22
3+ # Runner provider toggle, read from the CI_PROVIDER repo variable:
4+ #
5+ # gh variable set CI_PROVIDER --body github # fall back to GitHub-hosted
6+ # gh variable delete CI_PROVIDER # back to Blacksmith (default)
7+ #
8+ # A repo variable, not a committed value: during a Blacksmith outage there is no
9+ # working CI to merge a switchover through. Only unset/'blacksmith' selects
10+ # Blacksmith; anything unrecognized selects GitHub so a typo can't queue jobs
11+ # against the provider you're escaping. Every runs-on and both composite actions
12+ # share this predicate and must change together.
13+ #
14+ # GitHub mode is break-glass, not a peer — cold layers, slower runs. The app image
15+ # is the one job on a paid larger runner: next build needs ~32 GB and OOM-kills
16+ # (exit 137) on the free 16 GB runners at any heap ceiling.
17+
318on :
419 push :
520 branches : [main, staging, dev]
2843 # Detect if this is a version release commit (e.g., "v0.5.24: ...")
2944 detect-version :
3045 name : Detect Version
31- runs-on : blacksmith-4vcpu-ubuntu-2404
46+ runs-on : ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == ' blacksmith') && 'blacksmith -4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
3247 timeout-minutes : 5
3348 if : github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging' || github.ref == 'refs/heads/dev')
3449 outputs :
8196 name : Build Dev ECR
8297 needs : [detect-version, migrate-dev]
8398 if : github.event_name == 'push' && github.ref == 'refs/heads/dev'
84- runs-on : blacksmith-8vcpu-ubuntu-2404
99+ runs-on : ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == ' blacksmith') && 'blacksmith -8vcpu-ubuntu-2404' || matrix.gh_runner }}
85100 timeout-minutes : 30
86101 permissions :
87102 contents : read
@@ -90,14 +105,20 @@ jobs:
90105 fail-fast : false
91106 matrix :
92107 include :
108+ # Only the app image needs the paid 8-core/32 GB runner: next build
109+ # exhausts the free 16 GB one (exit 137). The others build in <5 min.
93110 - dockerfile : ./docker/app.Dockerfile
94111 ecr_repo_secret : ECR_APP
112+ gh_runner : linux-x64-8-core
95113 - dockerfile : ./docker/db.Dockerfile
96114 ecr_repo_secret : ECR_MIGRATIONS
115+ gh_runner : ubuntu-latest
97116 - dockerfile : ./docker/realtime.Dockerfile
98117 ecr_repo_secret : ECR_REALTIME
118+ gh_runner : ubuntu-latest
99119 - dockerfile : ./docker/pii.Dockerfile
100120 ecr_repo_secret : ECR_PII
121+ gh_runner : ubuntu-latest
101122 steps :
102123 - name : Checkout code
103124 uses : actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
@@ -118,25 +139,19 @@ jobs:
118139 username : ${{ secrets.DOCKERHUB_USERNAME }}
119140 password : ${{ secrets.DOCKERHUB_TOKEN }}
120141
121- - name : Set up Docker Buildx
122- uses : useblacksmith/setup-docker-builder@ab5c1da94f53f5cd75c1038092aa276dddfccbba # v1
123-
124142 - name : Resolve ECR repo name
125143 id : ecr-repo
126144 run : echo "name=$ECR_REPO" >> $GITHUB_OUTPUT
127145 env :
128146 ECR_REPO : ${{ matrix.ecr_repo_secret == 'ECR_APP' && secrets.ECR_APP || matrix.ecr_repo_secret == 'ECR_MIGRATIONS' && secrets.ECR_MIGRATIONS || matrix.ecr_repo_secret == 'ECR_REALTIME' && secrets.ECR_REALTIME || matrix.ecr_repo_secret == 'ECR_PII' && secrets.ECR_PII || '' }}
129147
130148 - name : Build and push
131- uses : useblacksmith/build-push-action@fb9e3e6a9299c78462bfadd0d93352c316adc9b8 # v2
149+ uses : ./.github/actions/docker-build
132150 with :
133- context : .
151+ provider : ${{ vars.CI_PROVIDER }}
134152 file : ${{ matrix.dockerfile }}
135153 platforms : linux/amd64
136- push : true
137154 tags : ${{ steps.login-ecr.outputs.registry }}/${{ steps.ecr-repo.outputs.name }}:dev
138- provenance : false
139- sbom : false
140155
141156 # Dev: deploy Trigger.dev background tasks to the preview "dev-sim" branch.
142157 # Gated after migrate-dev for the same reason as build-dev — the new task
@@ -145,7 +160,7 @@ jobs:
145160 name : Deploy Trigger.dev (Dev)
146161 needs : [migrate-dev]
147162 if : github.event_name == 'push' && github.ref == 'refs/heads/dev'
148- runs-on : blacksmith-4vcpu-ubuntu-2404
163+ runs-on : ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == ' blacksmith') && 'blacksmith -4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
149164 timeout-minutes : 15
150165 steps :
151166 - name : Checkout code
@@ -192,7 +207,7 @@ jobs:
192207 if : >-
193208 github.event_name == 'push' &&
194209 (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging')
195- runs-on : blacksmith-8vcpu-ubuntu-2404
210+ runs-on : ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == ' blacksmith') && 'blacksmith -8vcpu-ubuntu-2404' || matrix.gh_runner }}
196211 timeout-minutes : 30
197212 permissions :
198213 contents : read
@@ -205,15 +220,19 @@ jobs:
205220 - dockerfile : ./docker/app.Dockerfile
206221 ghcr_image : ghcr.io/simstudioai/simstudio
207222 ecr_repo_secret : ECR_APP
223+ gh_runner : linux-x64-8-core
208224 - dockerfile : ./docker/db.Dockerfile
209225 ghcr_image : ghcr.io/simstudioai/migrations
210226 ecr_repo_secret : ECR_MIGRATIONS
227+ gh_runner : ubuntu-latest
211228 - dockerfile : ./docker/realtime.Dockerfile
212229 ghcr_image : ghcr.io/simstudioai/realtime
213230 ecr_repo_secret : ECR_REALTIME
231+ gh_runner : ubuntu-latest
214232 - dockerfile : ./docker/pii.Dockerfile
215233 ghcr_image : ghcr.io/simstudioai/pii
216234 ecr_repo_secret : ECR_PII
235+ gh_runner : ubuntu-latest
217236 steps :
218237 - name : Checkout code
219238 uses : actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
@@ -242,9 +261,6 @@ jobs:
242261 username : ${{ github.repository_owner }}
243262 password : ${{ secrets.GITHUB_TOKEN }}
244263
245- - name : Set up Docker Buildx
246- uses : useblacksmith/setup-docker-builder@ab5c1da94f53f5cd75c1038092aa276dddfccbba # v1
247-
248264 - name : Resolve ECR repo name
249265 id : ecr-repo
250266 run : echo "name=$ECR_REPO" >> $GITHUB_OUTPUT
@@ -270,15 +286,12 @@ jobs:
270286 echo "tags=${TAGS}" >> $GITHUB_OUTPUT
271287
272288 - name : Build and push images
273- uses : useblacksmith/build-push-action@fb9e3e6a9299c78462bfadd0d93352c316adc9b8 # v2
289+ uses : ./.github/actions/docker-build
274290 with :
275- context : .
291+ provider : ${{ vars.CI_PROVIDER }}
276292 file : ${{ matrix.dockerfile }}
277293 platforms : linux/amd64
278- push : true
279294 tags : ${{ steps.meta.outputs.tags }}
280- provenance : false
281- sbom : false
282295
283296 # Promote the sha-tagged ECR images to the deploy tags once tests and
284297 # migrations pass. Pushing the ECR latest/staging tag is what triggers
@@ -292,7 +305,7 @@ jobs:
292305 if : >-
293306 github.event_name == 'push' &&
294307 (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging')
295- runs-on : blacksmith-2vcpu-ubuntu-2404
308+ runs-on : ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == ' blacksmith') && 'blacksmith -2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
296309 timeout-minutes : 10
297310 permissions :
298311 contents : read
@@ -362,7 +375,7 @@ jobs:
362375 # never moves a documented tag.
363376 build-ghcr-arm64 :
364377 name : Build ARM64 (GHCR Only)
365- runs-on : blacksmith-8vcpu-ubuntu-2404-arm
378+ runs-on : ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == ' blacksmith') && 'blacksmith -8vcpu-ubuntu-2404-arm' || matrix.gh_runner }}
366379 timeout-minutes : 30
367380 if : github.event_name == 'push' && github.ref == 'refs/heads/main'
368381 permissions :
@@ -374,12 +387,16 @@ jobs:
374387 include :
375388 - dockerfile : ./docker/app.Dockerfile
376389 image : ghcr.io/simstudioai/simstudio
390+ gh_runner : linux-arm64-8-core
377391 - dockerfile : ./docker/db.Dockerfile
378392 image : ghcr.io/simstudioai/migrations
393+ gh_runner : ubuntu-24.04-arm
379394 - dockerfile : ./docker/realtime.Dockerfile
380395 image : ghcr.io/simstudioai/realtime
396+ gh_runner : ubuntu-24.04-arm
381397 - dockerfile : ./docker/pii.Dockerfile
382398 image : ghcr.io/simstudioai/pii
399+ gh_runner : ubuntu-24.04-arm
383400
384401 steps :
385402 - name : Checkout code
@@ -392,26 +409,20 @@ jobs:
392409 username : ${{ github.repository_owner }}
393410 password : ${{ secrets.GITHUB_TOKEN }}
394411
395- - name : Set up Docker Buildx
396- uses : useblacksmith/setup-docker-builder@ab5c1da94f53f5cd75c1038092aa276dddfccbba # v1
397-
398412 - name : Build and push ARM64 to GHCR
399- uses : useblacksmith/build-push-action@fb9e3e6a9299c78462bfadd0d93352c316adc9b8 # v2
413+ uses : ./.github/actions/docker-build
400414 with :
401- context : .
415+ provider : ${{ vars.CI_PROVIDER }}
402416 file : ${{ matrix.dockerfile }}
403417 platforms : linux/arm64
404- push : true
405418 tags : ${{ matrix.image }}:${{ github.sha }}-arm64
406- provenance : false
407- sbom : false
408419
409420 # Publish all mutable GHCR tags (latest, latest-amd64/arm64, version tags)
410421 # and the multi-arch manifests from the immutable sha tags — only on main,
411422 # after the deploy gate (promote-images) and the ARM64 build both pass.
412423 create-ghcr-manifests :
413424 name : Create GHCR Manifests
414- runs-on : blacksmith-2vcpu-ubuntu-2404
425+ runs-on : ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == ' blacksmith') && 'blacksmith -2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
415426 timeout-minutes : 10
416427 needs : [promote-images, build-ghcr-arm64, detect-version]
417428 if : github.event_name == 'push' && github.ref == 'refs/heads/main'
@@ -477,7 +488,7 @@ jobs:
477488 # Check if docs changed
478489 check-docs-changes :
479490 name : Check Docs Changes
480- runs-on : blacksmith-4vcpu-ubuntu-2404
491+ runs-on : ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == ' blacksmith') && 'blacksmith -4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
481492 timeout-minutes : 5
482493 if : github.event_name == 'push' && github.ref == 'refs/heads/main'
483494 outputs :
@@ -506,7 +517,7 @@ jobs:
506517 # Create GitHub Release (only for version commits on main, after all builds complete)
507518 create-release :
508519 name : Create GitHub Release
509- runs-on : blacksmith-4vcpu-ubuntu-2404
520+ runs-on : ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == ' blacksmith') && 'blacksmith -4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
510521 timeout-minutes : 10
511522 needs : [create-ghcr-manifests, detect-version]
512523 if : needs.detect-version.outputs.is_release == 'true'
0 commit comments