chore: consolidate docker files into a single location and more services

.github/actions/changes/action.yaml

@@ -25,6 +25,9 @@ outputs:
   web-studio:
     description: "'true' if any web files changed"
     value: ${{ steps.filter.outputs.web-studio }}
+  docker:
+    description: "'true' if any Docker build files changed"
+    value: ${{ steps.filter.outputs.docker }}
 
 runs:
   using: "composite"
@@ -56,3 +59,7 @@ runs:
             - 'tools/**'
           web-studio:
             - 'web/**'
+          docker:
+            - 'docker-bake.hcl'
+            - 'docker/**'
+            - 'Makefile'

.github/workflows/ci.yaml

@@ -30,6 +30,7 @@ jobs:
       docs: ${{ steps.changes.outputs.docs }}
       web-studio: ${{ steps.changes.outputs.web-studio }}
       tools: ${{ steps.changes.outputs.tools }}
+      docker: ${{ steps.changes.outputs.docker }}
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/changes
@@ -56,6 +57,31 @@ jobs:
         run: |
           "${RUNNER_TEMP}/actionlint/actionlint"
 
+  docker-bake-graph:
+    name: Docker bake graph
+    needs: [changes]
+    if: >
+      !cancelled() && (
+        github.event_name == 'workflow_dispatch' ||
+        needs.changes.outputs.docker == 'true'
+      )
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Print bake groups
+        shell: bash
+        run: |
+          make docker-print TARGET=docker-cpu
+          make docker-print TARGET=docker-gpu
+          make docker-print TARGET=docker-auditor
+          make docker-print TARGET=docker-python-base
+          make docker-print TARGET=gpu-wheels
+          make docker-print TARGET=nmp-automodel
+          make docker-print TARGET=nmp-unsloth
+
   lint:
     name: Lint all
     runs-on: ubuntu-latest
@@ -755,6 +781,7 @@ jobs:
     needs:
       - changes
       - actionlint
+      - docker-bake-graph
       - lint
       - policy-wasm
       - python-unit-test-tools
@@ -797,4 +824,3 @@ jobs:
 
           printf '%s\n' "${NEEDS_JSON}" \
             | jq -e 'to_entries | map(.value.result) | all(. as $result | ["success", "skipped"] | any($result == .))'
-

Makefile

@@ -29,6 +29,31 @@ help:
 	@echo "Makefile commands:"
 	@grep -E '^[a-zA-Z_-][a-zA-Z0-9_/-]*:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
 
+DOCKER_BAKE_FILE ?= docker-bake.hcl
+DOCKER_TARGET ?= $(if $(TARGET),$(TARGET),docker-cpu)
+DOCKER_PLATFORMS ?= $(BUILD_ARCH)
+DOCKER_PLATFORM_SET = $(if $(DOCKER_PLATFORMS),--set "*.platform=$(DOCKER_PLATFORMS)",)
+
+.PHONY: docker-list-targets
+docker-list-targets: ## List Docker bake targets
+	docker buildx bake -f $(DOCKER_BAKE_FILE) --list=targets
+
+.PHONY: docker-print
+docker-print: ## Print Docker bake graph for TARGET, default docker-cpu
+	docker buildx bake -f $(DOCKER_BAKE_FILE) --print $(DOCKER_TARGET)
+
+.PHONY: docker-build
+docker-build: ## Build Docker bake TARGET without pushing, default docker-cpu
+	docker buildx bake -f $(DOCKER_BAKE_FILE) $(DOCKER_TARGET)
+
+.PHONY: docker-load
+docker-load: ## Build and load single-platform Docker bake TARGET, default docker-cpu
+	docker buildx bake -f $(DOCKER_BAKE_FILE) $(DOCKER_TARGET) $(DOCKER_PLATFORM_SET) --load
+
+.PHONY: docker-push
+docker-push: ## Build and push Docker bake TARGET, default docker-cpu
+	docker buildx bake -f $(DOCKER_BAKE_FILE) $(DOCKER_TARGET) --push
+
 .PHONY: refresh-openapi
 refresh-openapi:  ## Generate the OpenAPI specification
 	uv run --frozen script/generate-openapi-spec.sh