From ca851a923843df6fb9f96e934cb9a69d18455b17 Mon Sep 17 00:00:00 2001 From: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com> Date: Mon, 9 Nov 2026 07:44:48 -0600 Subject: [PATCH] Miscellaneous Fixes (#24914) * strip intel media driver on install The manually built iHD_drv_video.so was installed with full debug info, making it 513 MB in the image instead of 41 MB stripped. Installing with install/strip removes about 240 MB from the compressed amd64 image. * remove rjsf 6.11.0 dependabot hold The hold covered the GenAI form refilling the saved model after a provider switch. That was a GenAIModelWidget bug that rjsf 6.11 exposed, and it was fixed with the 6.11.1 bump in #24901, so no rjsf version needs holding. * strip intel media driver after install install/strip skipped iHD_drv_video.so because media-driver installs it with install(PROGRAMS), not as a target. Strip it directly instead. * bump dev docs version in header * attest published images with github build provenance Published images carried unsigned BuildKit provenance, so nothing tied an image digest to the commit it was built from. Each published image (the default multi-arch build and the six variants) now gets an actions/attest provenance attestation pushed to GHCR, verifiable with gh attestation verify. Release tags are skopeo copies with the same digest, so they're covered too. Storage records are off because they require an org-owned repo. --- .github/actions/setup/action.yml | 2 + .github/dependabot.yml | 3 - .github/workflows/ci.yml | 86 +++++++++++++++++++++++++ docker/main/build_intel_media_driver.sh | 1 + docs/docusaurus.config.ts | 2 +- 5 files changed, 90 insertions(+), 4 deletions(-) diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml index d2c643b626..98d564c8f5 100644 --- a/.github/actions/setup/action.yml +++ b/.github/actions/setup/action.yml @@ -4,6 +4,8 @@ inputs: GITHUB_TOKEN: required: true outputs: + image-repo: + value: ghcr.io/${{ steps.lowercaseRepo.outputs.lowercase }} image-name: value: ghcr.io/${{ steps.lowercaseRepo.outputs.lowercase }}:${{ steps.create-short-sha.outputs.SHORT_SHA }} cache-name: diff --git a/.github/dependabot.yml b/.github/dependabot.yml index bbb30a6911..197715769d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -136,9 +136,6 @@ updates: # Later versions need Node 22 and extract false keys - dependency-name: "i18next-cli" versions: [">1.5.11"] - # 6.11.0 refills the saved model in the GenAI settings form - - dependency-name: "@rjsf/*" - versions: ["6.11.0"] - package-ecosystem: "npm" directory: "/docs" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index aee4b4828d..f5ba321130 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -423,6 +423,11 @@ jobs: run: docker rm -f frigate || true arm64_build: runs-on: ubuntu-22.04-arm + permissions: + contents: read + packages: write + attestations: write + id-token: write name: ARM Build steps: - name: Check out code @@ -435,6 +440,7 @@ jobs: with: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Build and push arm64 standard build + id: standard-arm64 uses: docker/build-push-action@v7 with: context: . @@ -445,6 +451,13 @@ jobs: tags: | ${{ steps.setup.outputs.image-name }}-standard-arm64 cache-from: type=registry,ref=${{ steps.setup.outputs.cache-name }}-arm64 + - name: Attest arm64 standard build + uses: actions/attest@v4 + with: + subject-name: ${{ steps.setup.outputs.image-repo }} + subject-digest: ${{ steps.standard-arm64.outputs.digest }} + push-to-registry: true + create-storage-record: false - name: Build and push RPi build uses: docker/bake-action@v7 with: @@ -458,6 +471,11 @@ jobs: *.cache-to=type=registry,ref=${{ steps.setup.outputs.cache-name }}-arm64,mode=max jetson_jp6_build: runs-on: ubuntu-22.04-arm + permissions: + contents: read + packages: write + attestations: write + id-token: write name: Jetson Jetpack 6 steps: - name: Check out code @@ -470,6 +488,7 @@ jobs: with: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Build and push TensorRT (Jetson, Jetpack 6) + id: tensorrt-jp6 env: ARCH: arm64 BASE_IMAGE: nvcr.io/nvidia/tensorrt:23.12-py3-igpu @@ -485,8 +504,20 @@ jobs: tensorrt.tags=${{ steps.setup.outputs.image-name }}-tensorrt-jp6 *.cache-from=type=registry,ref=${{ steps.setup.outputs.cache-name }}-jp6 *.cache-to=type=registry,ref=${{ steps.setup.outputs.cache-name }}-jp6,mode=max + - name: Attest TensorRT (Jetson, Jetpack 6) + uses: actions/attest@v4 + with: + subject-name: ${{ steps.setup.outputs.image-repo }} + subject-digest: ${{ fromJSON(steps.tensorrt-jp6.outputs.metadata)['tensorrt']['containerimage.digest'] }} + push-to-registry: true + create-storage-record: false amd64_extra_builds: runs-on: ubuntu-22.04 + permissions: + contents: read + packages: write + attestations: write + id-token: write name: AMD64 Extra Build needs: - amd64_build @@ -501,6 +532,7 @@ jobs: with: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Build and push TensorRT (x86 GPU) + id: tensorrt env: COMPUTE_LEVEL: "50 60 70 80 90" uses: docker/bake-action@v7 @@ -513,7 +545,15 @@ jobs: tensorrt.tags=${{ steps.setup.outputs.image-name }}-tensorrt *.cache-from=type=registry,ref=${{ steps.setup.outputs.cache-name }}-tensorrt *.cache-to=type=registry,ref=${{ steps.setup.outputs.cache-name }}-tensorrt,mode=max + - name: Attest TensorRT (x86 GPU) + uses: actions/attest@v4 + with: + subject-name: ${{ steps.setup.outputs.image-repo }} + subject-digest: ${{ fromJSON(steps.tensorrt.outputs.metadata)['tensorrt']['containerimage.digest'] }} + push-to-registry: true + create-storage-record: false - name: AMD/ROCm general build + id: rocm env: HSA_OVERRIDE: 0 uses: docker/bake-action@v7 @@ -526,8 +566,20 @@ jobs: rocm.tags=${{ steps.setup.outputs.image-name }}-rocm *.cache-to=type=registry,ref=${{ steps.setup.outputs.cache-name }}-rocm,mode=max *.cache-from=type=registry,ref=${{ steps.setup.outputs.cache-name }}-rocm + - name: Attest AMD/ROCm general build + uses: actions/attest@v4 + with: + subject-name: ${{ steps.setup.outputs.image-repo }} + subject-digest: ${{ fromJSON(steps.rocm.outputs.metadata)['rocm']['containerimage.digest'] }} + push-to-registry: true + create-storage-record: false arm64_extra_builds: runs-on: ubuntu-22.04-arm + permissions: + contents: read + packages: write + attestations: write + id-token: write name: ARM Extra Build needs: - arm64_build @@ -542,6 +594,7 @@ jobs: with: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Build and push Rockchip build + id: rk uses: docker/bake-action@v7 with: source: . @@ -551,8 +604,20 @@ jobs: set: | rk.tags=${{ steps.setup.outputs.image-name }}-rk *.cache-from=type=gha + - name: Attest Rockchip build + uses: actions/attest@v4 + with: + subject-name: ${{ steps.setup.outputs.image-repo }} + subject-digest: ${{ fromJSON(steps.rk.outputs.metadata)['rk']['containerimage.digest'] }} + push-to-registry: true + create-storage-record: false synaptics_build: runs-on: ubuntu-22.04-arm + permissions: + contents: read + packages: write + attestations: write + id-token: write name: Synaptics Build needs: - arm64_build @@ -567,6 +632,7 @@ jobs: with: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Build and push Synaptics build + id: synaptics uses: docker/bake-action@v7 with: source: . @@ -576,10 +642,22 @@ jobs: set: | synaptics.tags=${{ steps.setup.outputs.image-name }}-synaptics *.cache-from=type=gha + - name: Attest Synaptics build + uses: actions/attest@v4 + with: + subject-name: ${{ steps.setup.outputs.image-repo }} + subject-digest: ${{ fromJSON(steps.synaptics.outputs.metadata)['synaptics']['containerimage.digest'] }} + push-to-registry: true + create-storage-record: false # The majority of users running arm64 are rpi users, so the rpi # build should be the primary arm64 image assemble_default_build: runs-on: ubuntu-22.04 + permissions: + contents: read + packages: write + attestations: write + id-token: write name: Assemble and push default build needs: - amd64_build @@ -598,8 +676,16 @@ jobs: - name: Create short sha run: echo "SHORT_SHA=${GITHUB_SHA::7}" >> $GITHUB_ENV - uses: int128/docker-manifest-create-action@v2 + id: manifest with: tags: ghcr.io/${{ steps.lowercaseRepo.outputs.lowercase }}:${{ env.SHORT_SHA }} sources: | ghcr.io/${{ steps.lowercaseRepo.outputs.lowercase }}:${{ env.SHORT_SHA }}-amd64 ghcr.io/${{ steps.lowercaseRepo.outputs.lowercase }}:${{ env.SHORT_SHA }}-rpi + - name: Attest default build + uses: actions/attest@v4 + with: + subject-name: ghcr.io/${{ steps.lowercaseRepo.outputs.lowercase }} + subject-digest: ${{ steps.manifest.outputs.digest }} + push-to-registry: true + create-storage-record: false diff --git a/docker/main/build_intel_media_driver.sh b/docker/main/build_intel_media_driver.sh index acc9caf09d..d7906408d6 100755 --- a/docker/main/build_intel_media_driver.sh +++ b/docker/main/build_intel_media_driver.sh @@ -46,3 +46,4 @@ make -C /tmp/media-driver/build -j"$(nproc)" # Install driver to rootfs for COPY --from make -C /tmp/media-driver/build install DESTDIR=/rootfs +strip --strip-unneeded /rootfs/usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so diff --git a/docs/docusaurus.config.ts b/docs/docusaurus.config.ts index 862db4518f..7fcf61dbb0 100644 --- a/docs/docusaurus.config.ts +++ b/docs/docusaurus.config.ts @@ -4,7 +4,7 @@ import type { Config, PluginConfig } from "@docusaurus/types"; import type * as OpenApiPlugin from "docusaurus-plugin-openapi-docs"; // Bump when a new stable release ships -const STABLE_VERSION = "0.18"; +const STABLE_VERSION = "0.19"; const config: Config = { title: "Frigate",