group: Abuild
steps:
  - label: ":docker: Build image"
    key: image-build
    depends_on: []
    timeout_in_minutes: 600
    commands:
    - if [[ "$BUILDKITE_BRANCH" == "main" ]]; then .buildkite/image_build/image_build.sh $REGISTRY $REPO $BUILDKITE_COMMIT $BRANCH $IMAGE_TAG $IMAGE_TAG_LATEST; else .buildkite/image_build/image_build.sh $REGISTRY $REPO $BUILDKITE_COMMIT $BRANCH $IMAGE_TAG; fi
    retry:
      automatic:
        - exit_status: -1  # Agent was lost
          limit: 2
        - exit_status: -10  # Agent was lost
          limit: 2

  - label: ":docker: :smoking: Non-root smoke tests"
    key: image-build-smoke-test
    depends_on:
      - image-build
    commands:
    # Smoke 1: the default (root) image must still be importable
    # under a non-root UID via `--user 2000:0`. Validates the `vllm` passwd
    # entry + group-0-writable /home/vllm + uv path cleanup from #31959.
    # Uses `import vllm` rather than `vllm serve --help` because the latter
    # instantiates `VllmConfig` which requires a GPU attached to the
    # container.
    - docker run --rm --user 2000:0 --entrypoint python3 "$IMAGE_TAG" -c "import vllm; print(vllm.__version__)"
    # Smoke 2: assert the non-root enabling invariants are baked
    # into the image. Runs as UID 2000:0 via a shell so we can verify
    # filesystem perms + passwd/group file state + wrapper presence without
    # triggering vLLM's GPU-requiring config-init path. The opt-in
    # `vllm-openai-nonroot` target adds only `USER vllm`, `WORKDIR
    # /home/vllm`, and an `ENTRYPOINT` override on top of these invariants;
    # its build correctness is reviewed at the Dockerfile level. Wrapper
    # logic is covered separately by the pre-commit hook
    # `test-nonroot-entrypoint` (see .pre-commit-config.yaml).
    - |
      docker run --rm --user 2000:0 --entrypoint /bin/sh "$IMAGE_TAG" -ec '
        if ! getent passwd 2000 | grep -q ^vllm:; then
          echo FAIL: UID 2000 != vllm
          exit 1
        fi
        if ! id -gn 2>/dev/null | grep -qx root; then
          echo FAIL: GID 0 not root group
          exit 1
        fi
        touch /home/vllm/.smoke && rm /home/vllm/.smoke
        touch /opt/uv/cache/.smoke && rm /opt/uv/cache/.smoke
        if ! test -x /usr/local/bin/vllm-nonroot-entrypoint.sh; then
          echo FAIL: wrapper missing
          exit 1
        fi
        if ! test -w /etc/passwd; then
          echo FAIL: /etc/passwd not group-writable
          exit 1
        fi
        if ! test -w /etc/group; then
          echo FAIL: /etc/group not group-writable
          exit 1
        fi
        echo non-root invariants OK
      '
    retry:
      automatic:
        - exit_status: -1  # Agent was lost
          limit: 2
        - exit_status: -10  # Agent was lost
          limit: 2

  - label: ":docker: Build CPU image"
    key: image-build-cpu
    depends_on: []
    commands:
    - .buildkite/image_build/image_build_cpu.sh $REGISTRY $REPO $BUILDKITE_COMMIT
    env:
      DOCKER_BUILDKIT: "1"
    retry:
      automatic:
        - exit_status: -1  # Agent was lost
          limit: 2
        - exit_status: -10  # Agent was lost
          limit: 2

  - label: ":docker: Build HPU image"
    soft_fail: true
    depends_on: []
    key: image-build-hpu
    commands:
    - .buildkite/image_build/image_build_hpu.sh $REGISTRY $REPO $BUILDKITE_COMMIT
    env:
      DOCKER_BUILDKIT: "1"
    retry:
      automatic:
        - exit_status: -1  # Agent was lost
          limit: 2
        - exit_status: -10  # Agent was lost
          limit: 2

  - label: ":docker: Build CPU arm64 image"
    key: cpu-arm64-image-build
    depends_on: []
    optional: true
    commands:
    - .buildkite/image_build/image_build_cpu_arm64.sh $REGISTRY $REPO $BUILDKITE_COMMIT
    env:
      DOCKER_BUILDKIT: "1"
    retry:
      automatic:
        - exit_status: -1  # Agent was lost
          limit: 2
        - exit_status: -10  # Agent was lost
          limit: 2

  - label: ":docker: Build arm64 image"
    key: arm64-image-build
    depends_on: []
    source_file_dependencies:
      - ".buildkite/image_build/image_build.yaml"
      - ".buildkite/image_build/image_build_arm64.sh"
      - "docker/Dockerfile"
    commands:
    - .buildkite/image_build/image_build_arm64.sh $REGISTRY $REPO $BUILDKITE_COMMIT
    env:
      DOCKER_BUILDKIT: "1"
    retry:
      automatic:
        - exit_status: -1  # Agent was lost
          limit: 2
        - exit_status: -10  # Agent was lost
          limit: 2
