From 249cada6bb7c54c97c38ef871dde6af85bde90e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89rico=20Nogueira?= <erico.rolim@lnls.br>
Date: Fri, 15 Dec 2023 12:02:34 -0300
Subject: [PATCH 01/13] Post-release development version bump.

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 6e52160..72768c3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 ARG DEBIAN_VERSION=11.7
 
-FROM ghcr.io/cnpem/lnls-debian-11-epics-7:v0.6.0 AS build-image
+FROM ghcr.io/cnpem/lnls-debian-11-epics-7:v0.6.0-dev AS build-image
 
 FROM debian:${DEBIAN_VERSION}-slim AS base
 

From 33eac6843d24989c066c22418c55c26511112e0c Mon Sep 17 00:00:00 2001
From: "Henrique F. Simoes" <henrique.simoes@lnls.br>
Date: Tue, 19 Dec 2023 12:50:26 -0300
Subject: [PATCH 02/13] base: use the accepted patch for nanohttp_stream.

We now use the merged version of the patch and follow the backport
filename convention to make it explicit it can be removed when failing
to be applied.

To follow how other patches are applied, the `patch` utility is used
instead of git-apply.
---
 base/Dockerfile                                            | 2 +-
 ...http_stream.patch => backport-adsupport-nanohttp.patch} | 7 +++----
 base/install_area_detector.sh                              | 2 +-
 3 files changed, 5 insertions(+), 6 deletions(-)
 rename base/{nanohttp_stream.patch => backport-adsupport-nanohttp.patch} (88%)

diff --git a/base/Dockerfile b/base/Dockerfile
index 87d098b..c33524a 100644
--- a/base/Dockerfile
+++ b/base/Dockerfile
@@ -58,7 +58,7 @@ WORKDIR ${EPICS_MODULES_PATH}
 COPY install_modules.sh .
 RUN ./install_modules.sh
 
-COPY nanohttp_stream.patch .
+COPY backport-adsupport-nanohttp.patch .
 COPY install_area_detector.sh .
 RUN ./install_area_detector.sh
 
diff --git a/base/nanohttp_stream.patch b/base/backport-adsupport-nanohttp.patch
similarity index 88%
rename from base/nanohttp_stream.patch
rename to base/backport-adsupport-nanohttp.patch
index b3ba853..ac162e0 100644
--- a/base/nanohttp_stream.patch
+++ b/base/backport-adsupport-nanohttp.patch
@@ -1,5 +1,4 @@
-From https://github.com/areaDetector/ADSupport/pull/41
-From 0ecb38c9b8981b4e92c2ebbdff5503052a5c0ba9 Mon Sep 17 00:00:00 2001
+From 9326adbf88b7e4501b4ba1b53d267c2c3f921c78 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?=C3=89rico=20Nogueira?= <erico.rolim@lnls.br>
 Date: Thu, 3 Aug 2023 08:16:00 -0300
 Subject: [PATCH] Fix nanohttp_stream build with external libxml2.
@@ -16,14 +15,14 @@ only define IN_LIBXML in that case.
  2 files changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/supportApp/xml2Src/Makefile b/supportApp/xml2Src/Makefile
-index 1ba2696..1a0c189 100644
+index 1ba2696..b855c48 100644
 --- a/supportApp/xml2Src/Makefile
 +++ b/supportApp/xml2Src/Makefile
 @@ -123,6 +123,7 @@ ifeq ($(XML2_EXTERNAL),NO)
    LIB_SRCS += xmlstring.c
  
    nanohttp_stream_LIBS += xml2
-+  USR_CFLAGS = -DIN_LIBXML
++  nanohttp_stream_CFLAGS += -DIN_LIBXML
  
  else 
    nanohttp_stream_SYS_LIBS += xml2
diff --git a/base/install_area_detector.sh b/base/install_area_detector.sh
index 5812ae0..6d25735 100755
--- a/base/install_area_detector.sh
+++ b/base/install_area_detector.sh
@@ -94,7 +94,7 @@ ARAVIS_INCLUDE=$(pkg-config --cflags-only-I aravis-0.8 | sed -e "s|-I||g")
 
 cd -
 
-git apply --directory ADSupport ${EPICS_MODULES_PATH}/nanohttp_stream.patch
+patch -d ADSupport -Np1 < ${EPICS_MODULES_PATH}/backport-adsupport-nanohttp.patch
 
 make -j${JOBS}
 make clean

From 3de4386ce90cfc7f364a1cd1a0d07b907f41fb65 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89rico=20Nogueira?= <erico.rolim@lnls.br>
Date: Mon, 18 Dec 2023 08:40:23 -0300
Subject: [PATCH 03/13] base: update CALC version.

Only contains documentation changes, updating to avoid others having to
decide whether the update is worth it or not.
---
 base/.env | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/base/.env b/base/.env
index bc00e1c..735346b 100644
--- a/base/.env
+++ b/base/.env
@@ -4,7 +4,7 @@ ALPINE_VERSION=3.18.4
 EPICS7_BASE_VERSION=7.0.7
 
 SEQUENCER_VERSION=2.2.9
-CALC_VERSION=R3-7-4
+CALC_VERSION=R3-7-5
 ASYN_VERSION=R4-44-2
 STREAMDEVICE_VERSION=2.8.24
 BUSY_VERSION=R1-7-4

From 752b42d44dd622363a020e5860642076121d3a65 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89rico=20Nogueira?= <erico.rolim@lnls.br>
Date: Mon, 18 Dec 2023 08:42:14 -0300
Subject: [PATCH 04/13] base: update SSCAN version.

Per [1], might require changes to some IOCs, but we don't really have
users for this module, and no references to the changed file could be
found on our internal repositories.

[1] https://github.com/epics-modules/sscan/releases/tag/R2-11-6
---
 base/.env | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/base/.env b/base/.env
index 735346b..aff70f7 100644
--- a/base/.env
+++ b/base/.env
@@ -9,7 +9,7 @@ ASYN_VERSION=R4-44-2
 STREAMDEVICE_VERSION=2.8.24
 BUSY_VERSION=R1-7-4
 AUTOSAVE_VERSION=R5-10-2
-SSCAN_VERSION=R2-11-5
+SSCAN_VERSION=R2-11-6
 RECCASTER_VERSION=1.5
 IPAC_VERSION=2.16
 CAPUTLOG_VERSION=R4.0

From 7d36484627db20e7c202b424fb8b265685641560 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89rico=20Nogueira?= <erico.rolim@lnls.br>
Date: Mon, 18 Dec 2023 08:53:58 -0300
Subject: [PATCH 05/13] base: update AUTOSAVE version.

---
 CHANGES.md | 6 ++++++
 base/.env  | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/CHANGES.md b/CHANGES.md
index 6eb3512..f5f727c 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+### Bug fixes
+
+* base: update modules. by @ericonr in
+  https://github.com/cnpem/epics-in-docker/pull/43
+  * This updates the autosave module and removes some resource leaks.
+
 ## v0.6.0
 
 Users interested in the retools module should update to this release.
diff --git a/base/.env b/base/.env
index aff70f7..30fe9d9 100644
--- a/base/.env
+++ b/base/.env
@@ -8,7 +8,7 @@ CALC_VERSION=R3-7-5
 ASYN_VERSION=R4-44-2
 STREAMDEVICE_VERSION=2.8.24
 BUSY_VERSION=R1-7-4
-AUTOSAVE_VERSION=R5-10-2
+AUTOSAVE_VERSION=R5-11
 SSCAN_VERSION=R2-11-6
 RECCASTER_VERSION=1.5
 IPAC_VERSION=2.16

From ff373f70613267fd2869a636e6e51aa6dc85d459 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89rico=20Nogueira?= <erico.rolim@lnls.br>
Date: Mon, 18 Dec 2023 08:35:05 -0300
Subject: [PATCH 06/13] base: add PVXS module.

Allow users to build IOCs with QSRV2. Most of the IOCs we deploy aren't
using EPICS4 modules from epics-base, so trying out QSRV2 directly seems
reasonable, even though it isn't fully tested.
---
 CHANGES.md                   | 5 +++++
 base/.env                    | 1 +
 base/Dockerfile              | 2 ++
 base/docker-compose.yml      | 1 +
 base/install_modules.sh      | 4 ++++
 base/musl/Dockerfile         | 1 +
 base/musl/docker-compose.yml | 1 +
 7 files changed, 15 insertions(+)

diff --git a/CHANGES.md b/CHANGES.md
index f5f727c..02ecaf6 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -2,6 +2,11 @@
 
 ## Unreleased
 
+### New features
+
+* base: add PVXS module. by @ericonr in
+  https://github.com/cnpem/epics-in-docker/pull/42
+
 ### Bug fixes
 
 * base: update modules. by @ericonr in
diff --git a/base/.env b/base/.env
index 30fe9d9..09a0182 100644
--- a/base/.env
+++ b/base/.env
@@ -2,6 +2,7 @@ DEBIAN_VERSION=11.7
 ALPINE_VERSION=3.18.4
 
 EPICS7_BASE_VERSION=7.0.7
+PVXS_VERSION=1.3.1
 
 SEQUENCER_VERSION=2.2.9
 CALC_VERSION=R3-7-5
diff --git a/base/Dockerfile b/base/Dockerfile
index c33524a..1cbf43c 100644
--- a/base/Dockerfile
+++ b/base/Dockerfile
@@ -11,6 +11,7 @@ RUN apt update -y && \
         build-essential \
         git \
         libaravis-dev \
+        libevent-dev \
         libreadline-dev \
         libssh2-1-dev \
         libtiff-dev \
@@ -35,6 +36,7 @@ COPY backport-epics-base-musl.patch .
 COPY install_epics.sh .
 RUN ./install_epics.sh
 
+ARG PVXS_VERSION
 ARG SEQUENCER_VERSION
 ARG CALC_VERSION
 ARG ASYN_VERSION
diff --git a/base/docker-compose.yml b/base/docker-compose.yml
index bd68363..16e8757 100644
--- a/base/docker-compose.yml
+++ b/base/docker-compose.yml
@@ -12,6 +12,7 @@ services:
         JOBS: ${JOBS:-1}
         DEBIAN_VERSION: ${DEBIAN_VERSION}
         EPICS_BASE_VERSION: ${EPICS7_BASE_VERSION}
+        PVXS_VERSION: ${PVXS_VERSION}
         SEQUENCER_VERSION: ${SEQUENCER_VERSION}
         CALC_VERSION: ${CALC_VERSION}
         ASYN_VERSION: ${ASYN_VERSION}
diff --git a/base/install_modules.sh b/base/install_modules.sh
index 89c9a0a..a84207b 100755
--- a/base/install_modules.sh
+++ b/base/install_modules.sh
@@ -4,6 +4,10 @@ set -ex
 
 . /opt/epics/install-functions.sh
 
+install_github_module mdavidsaver pvxs PVXS $PVXS_VERSION "
+EPICS_BASE = ${EPICS_BASE_PATH}
+"
+
 # Build seq first since it doesn't depend on anything
 lnls-get-n-unpack -l "https://static.erico.dev/seq-$SEQUENCER_VERSION.tar.gz"
 mv seq-$SEQUENCER_VERSION seq
diff --git a/base/musl/Dockerfile b/base/musl/Dockerfile
index 1bd07c6..e7734bb 100644
--- a/base/musl/Dockerfile
+++ b/base/musl/Dockerfile
@@ -39,6 +39,7 @@ COPY backport-epics-base-musl.patch .
 COPY install_epics.sh .
 RUN ./install_epics.sh
 
+ARG PVXS_VERSION
 ARG SEQUENCER_VERSION
 ARG CALC_VERSION
 ARG ASYN_VERSION
diff --git a/base/musl/docker-compose.yml b/base/musl/docker-compose.yml
index cbdb133..1f7f52a 100644
--- a/base/musl/docker-compose.yml
+++ b/base/musl/docker-compose.yml
@@ -12,6 +12,7 @@ services:
         JOBS: ${JOBS:-1}
         ALPINE_VERSION: ${ALPINE_VERSION}
         EPICS_BASE_VERSION: ${EPICS7_BASE_VERSION}
+        PVXS_VERSION: ${PVXS_VERSION}
         SEQUENCER_VERSION: ${SEQUENCER_VERSION}
         CALC_VERSION: ${CALC_VERSION}
         ASYN_VERSION: ${ASYN_VERSION}

From a2096baee404ce724eb0cf91eda57d98fce059b7 Mon Sep 17 00:00:00 2001
From: "Henrique F. Simoes" <henrique.simoes@lnls.br>
Date: Wed, 7 Feb 2024 14:28:15 -0300
Subject: [PATCH 07/13] base: build CALC with Sequencer support.

Calc module conditionally adds support to Sequencer based on the
definition of SNCSEQ and not SEQ.

Fixes: 0183021d7f32 ("base: initial commit.")
---
 CHANGES.md              | 2 ++
 base/install_modules.sh | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGES.md b/CHANGES.md
index 02ecaf6..f632e6e 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -12,6 +12,8 @@
 * base: update modules. by @ericonr in
   https://github.com/cnpem/epics-in-docker/pull/43
   * This updates the autosave module and removes some resource leaks.
+* base: build CALC with Sequencer support. by @henriquesimoes in
+  https://github.com/cnpem/epics-in-docker/pull/48
 
 ## v0.6.0
 
diff --git a/base/install_modules.sh b/base/install_modules.sh
index a84207b..7dc383d 100755
--- a/base/install_modules.sh
+++ b/base/install_modules.sh
@@ -18,7 +18,7 @@ EPICS_BASE = ${EPICS_BASE_PATH}
 install_github_module epics-modules calc CALC $CALC_VERSION "
 EPICS_BASE = ${EPICS_BASE_PATH}
 
-SEQ = ${EPICS_MODULES_PATH}/seq
+SNCSEQ = ${EPICS_MODULES_PATH}/seq
 "
 
 # Build asyn without seq since it's only needed for testIPServer

From 28644064b1004ee3955c11c30e92ddf59c007bf4 Mon Sep 17 00:00:00 2001
From: "Henrique F. Simoes" <henrique.simoes@lnls.br>
Date: Mon, 8 Jan 2024 17:35:52 -0300
Subject: [PATCH 08/13] base: use RELEASE to determine module paths.

Right after being installed, each module adds its own path to the
RELEASE file. Therefore, it is possible to use the RELEASE file as the
source of truth for our dependencies' paths. Since a module cannot be
built without its dependency already built, this does not limit our
installation scripts.

This removes duplication of several module paths, which may now be
changed more easily.

If a non-existent dependency is provided and errexit (-e) bash option is
set, the script will fail during the get_module_path's grep call due to
its non-zero exit code.
---
 base/install-functions.sh     | 13 +++++++++--
 base/install_area_detector.sh | 23 +++++++++-----------
 base/install_modules.sh       | 41 +++++++++++++++--------------------
 base/install_motor.sh         | 22 +++++++++----------
 4 files changed, 50 insertions(+), 49 deletions(-)

diff --git a/base/install-functions.sh b/base/install-functions.sh
index 3752625..c29cab6 100644
--- a/base/install-functions.sh
+++ b/base/install-functions.sh
@@ -1,3 +1,11 @@
+get_module_path() {
+    for module in $@; do
+        if [ -n "$module" ]; then
+            grep -E "^$module=" $EPICS_RELEASE_FILE
+        fi
+    done
+}
+
 download_github_module() {
     github_org=$1
     module_name=$2
@@ -11,10 +19,11 @@ download_github_module() {
 install_module() {
     module_name=$1
     dependency_name=$2
-    release_content="$3"
+    release_modules="$3"
 
     cd $module_name
-    echo "$release_content" > configure/RELEASE
+    get_module_path "$release_modules" > configure/RELEASE
+
     if [ -n "$NEEDS_TIRPC" ]; then
         echo "TIRPC=YES" >> configure/CONFIG_SITE
     fi
diff --git a/base/install_area_detector.sh b/base/install_area_detector.sh
index 6d25735..1fa6c08 100755
--- a/base/install_area_detector.sh
+++ b/base/install_area_detector.sh
@@ -29,15 +29,13 @@ ADCORE=${EPICS_MODULES_PATH}/areaDetector/ADCore
 
 echo "$module_releases" >> ${EPICS_RELEASE_FILE}
 
-echo "
-EPICS_BASE=${EPICS_BASE_PATH}
-
-$module_releases
-
-ASYN=${EPICS_MODULES_PATH}/asyn
-BUSY=${EPICS_MODULES_PATH}/busy
-SSCAN=${EPICS_MODULES_PATH}/sscan
+get_module_path "
+EPICS_BASE
+ASYN
+BUSY
+SSCAN
 " > RELEASE.local
+echo "$module_releases" >> RELEASE.local
 
 ln -s RELEASE.local RELEASE_PRODS.local
 ln -s RELEASE.local RELEASE_LIBS.local
@@ -105,9 +103,8 @@ download_github_module cnpem ssc-pimega $LIBSSCPIMEGA_VERSION
 make -C ssc-pimega/c install
 
 install_github_module cnpem NDSSCPimega NDSSCPIMEGA $NDSSCPIMEGA_VERSION "
-EPICS_BASE = ${EPICS_BASE_PATH}
-
-ASYN=${EPICS_MODULES_PATH}/asyn
-AREA_DETECTOR=${EPICS_MODULES_PATH}/areaDetector
-ADCORE=${EPICS_MODULES_PATH}/areaDetector/ADCore
+EPICS_BASE
+ASYN
+AREA_DETECTOR
+ADCORE
 "
diff --git a/base/install_modules.sh b/base/install_modules.sh
index 7dc383d..e7a62fa 100755
--- a/base/install_modules.sh
+++ b/base/install_modules.sh
@@ -5,65 +5,60 @@ set -ex
 . /opt/epics/install-functions.sh
 
 install_github_module mdavidsaver pvxs PVXS $PVXS_VERSION "
-EPICS_BASE = ${EPICS_BASE_PATH}
+EPICS_BASE
 "
 
 # Build seq first since it doesn't depend on anything
 lnls-get-n-unpack -l "https://static.erico.dev/seq-$SEQUENCER_VERSION.tar.gz"
 mv seq-$SEQUENCER_VERSION seq
 install_module seq SNCSEQ "
-EPICS_BASE = ${EPICS_BASE_PATH}
+EPICS_BASE
 "
 
 install_github_module epics-modules calc CALC $CALC_VERSION "
-EPICS_BASE = ${EPICS_BASE_PATH}
-
-SNCSEQ = ${EPICS_MODULES_PATH}/seq
+EPICS_BASE
+SNCSEQ
 "
 
 # Build asyn without seq since it's only needed for testIPServer
 install_github_module epics-modules asyn ASYN $ASYN_VERSION "
-EPICS_BASE = ${EPICS_BASE_PATH}
-
-CALC = ${EPICS_MODULES_PATH}/calc
+EPICS_BASE
+CALC
 "
 
 install_github_module paulscherrerinstitute StreamDevice STREAM $STREAMDEVICE_VERSION "
-EPICS_BASE = ${EPICS_BASE_PATH}
-
-ASYN = ${EPICS_MODULES_PATH}/asyn
-CALC = ${EPICS_MODULES_PATH}/calc
+EPICS_BASE
+ASYN
+CALC
 "
 
 install_github_module epics-modules busy BUSY $BUSY_VERSION "
-EPICS_BASE = ${EPICS_BASE_PATH}
-
-ASYN = ${EPICS_MODULES_PATH}/asyn
+EPICS_BASE
+ASYN
 "
 
 install_github_module epics-modules autosave AUTOSAVE $AUTOSAVE_VERSION "
-EPICS_BASE = ${EPICS_BASE_PATH}
+EPICS_BASE
 "
 
 install_github_module epics-modules sscan SSCAN $SSCAN_VERSION "
-EPICS_BASE = ${EPICS_BASE_PATH}
-
-SNCSEQ = ${EPICS_MODULES_PATH}/seq
+EPICS_BASE
+SNCSEQ
 "
 
 download_github_module ChannelFinder recsync $RECCASTER_VERSION
 install_module recsync/client RECCASTER "
-EPICS_BASE = ${EPICS_BASE_PATH}
+EPICS_BASE
 "
 
 install_github_module epics-modules ipac IPAC $IPAC_VERSION "
-EPICS_BASE = ${EPICS_BASE_PATH}
+EPICS_BASE
 "
 
 install_github_module epics-modules caPutLog CAPUTLOG $CAPUTLOG_VERSION "
-EPICS_BASE = ${EPICS_BASE_PATH}
+EPICS_BASE
 "
 
 install_github_module brunoseivam retools RETOOLS $RETOOLS_VERSION "
-EPICS_BASE = ${EPICS_BASE_PATH}
+EPICS_BASE
 "
diff --git a/base/install_motor.sh b/base/install_motor.sh
index d257e6e..d57be47 100755
--- a/base/install_motor.sh
+++ b/base/install_motor.sh
@@ -20,12 +20,12 @@ echo "$module_releases" >> ${EPICS_RELEASE_FILE}
 
 cd ../configure
 
-echo "
-EPICS_BASE=${EPICS_BASE_PATH}
-ASYN=${EPICS_MODULES_PATH}/asyn
-SNCSEQ=${EPICS_MODULES_PATH}/seq
-BUSY=${EPICS_MODULES_PATH}/busy
-IPAC=${EPICS_MODULES_PATH}/ipac
+get_module_path "
+EPICS_BASE
+ASYN
+SNCSEQ
+BUSY
+IPAC
 " > RELEASE.local
 
 echo "
@@ -57,9 +57,9 @@ WITH_BOOST = NO
 " >> pmac/configure/CONFIG_SITE
 
 JOBS=1 install_module pmac PMAC "
-EPICS_BASE=${EPICS_BASE_PATH}
-ASYN=${EPICS_MODULES_PATH}/asyn
-CALC=${EPICS_MODULES_PATH}/calc
-MOTOR=${EPICS_MODULES_PATH}/motor
-BUSY=${EPICS_MODULES_PATH}/busy
+EPICS_BASE
+ASYN
+CALC
+MOTOR
+BUSY
 "

From 4cd38931ca05cbeaa0a9bdd5ffbde71cfaf97572 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89rico=20Nogueira?= <erico.rolim@lnls.br>
Date: Wed, 17 Jan 2024 14:00:26 -0300
Subject: [PATCH 09/13] ci: add reusable job for IOC images.

---
 .github/workflows/ioc-images.yml | 35 ++++++++++++++++++++++++++++++++
 CHANGES.md                       |  2 ++
 2 files changed, 37 insertions(+)
 create mode 100644 .github/workflows/ioc-images.yml

diff --git a/.github/workflows/ioc-images.yml b/.github/workflows/ioc-images.yml
new file mode 100644
index 0000000..cdc4c22
--- /dev/null
+++ b/.github/workflows/ioc-images.yml
@@ -0,0 +1,35 @@
+name: Build image
+on:
+  workflow_call:
+
+jobs:
+  build_and_push:
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
+    env:
+      REGISTRY: ghcr.io/${{ github.repository_owner }}
+      SOURCE: https://github.com/${{ github.repository }}
+      TAG: ${{ github.ref_name }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - uses: docker/setup-buildx-action@v3
+      - name: Log in to registry
+        if: github.event_name == 'push'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push tagged image
+        uses: docker/bake-action@v4
+        with:
+          workdir: ./
+          files: docker-compose.yml
+          set: |
+            *.cache-from=type=gha
+            *.cache-to=type=gha,mode=max
+          push: ${{ github.event_name == 'push' && github.ref_type == 'tag' }}
diff --git a/CHANGES.md b/CHANGES.md
index f632e6e..43d205d 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -6,6 +6,8 @@
 
 * base: add PVXS module. by @ericonr in
   https://github.com/cnpem/epics-in-docker/pull/42
+* ci: add reusable job for IOC images. by @ericonr in
+  https://github.com/cnpem/epics-in-docker/pull/49
 
 ### Bug fixes
 

From 7b01e955aa7bd2732bb8ef53c24efad9d6347aaa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89rico=20Nogueira?= <erico.rolim@lnls.br>
Date: Mon, 5 Feb 2024 14:07:50 -0300
Subject: [PATCH 10/13] README: document CI workflow for IOC images.

---
 README.md | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/README.md b/README.md
index 9121d19..e37ac43 100644
--- a/README.md
+++ b/README.md
@@ -64,6 +64,11 @@ Packages essential to all (or most) IOCs should be added to [this repository's
 The template above assumes the containers will be uploaded to the GitHub
 registry.
 
+`:${TAG}` adds versioning to images using [our CI workflows](#ci-workflows),
+and when building images locally and exporting the `TAG` environment variable.
+If there is no interest in using versioned images and the resulting container
+image should be tagged as `latest`, `:${TAG}` can simply be omitted.
+
 ### areaDetector IOCs
 
 `areaDetector` IOCs must be built with target `dynamic-link`. In addition, they
@@ -80,6 +85,34 @@ module depends on it.
 Known build and runtime issues are documented in the [SwC
 wiki](http://swc.lnls.br/).
 
+## CI Workflows
+
+Users of this repository for building IOC images can also take advantage of
+pre-defined continuous integration workflows in order to verify that images are
+built correctly after changes, and for uploading container images to the
+desired registry on Git tag creation.
+
+### GitHub Actions
+
+A YAML file must be added to the repository's `.github/workflows/` directory
+(e.g. `.github/workflows/build.yml`), with the following contents:
+
+```
+name: Build image
+on:
+  push:
+    tags:
+      - 'v*'
+  pull_request:
+
+jobs:
+  build_and_push:
+    permissions:
+      packages: write
+      contents: read
+    uses: cnpem/epics-in-docker/.github/workflows/ioc-images.yml
+```
+
 ## Containers
 
 ### Accessing `iocsh` inside containers

From f9a17fcd150f6f670a06b67e9c04cd7fc5259a0e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89rico=20Nogueira?= <erico.rolim@lnls.br>
Date: Tue, 20 Feb 2024 14:13:30 -0300
Subject: [PATCH 11/13] README: fix GitHub Actions job definition.

The version in a "uses" key is mandatory.

Fixes: 7b01e955aa7bd2732bb8ef53c24efad9d6347aaa
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index e37ac43..ef25a75 100644
--- a/README.md
+++ b/README.md
@@ -110,7 +110,7 @@ jobs:
     permissions:
       packages: write
       contents: read
-    uses: cnpem/epics-in-docker/.github/workflows/ioc-images.yml
+    uses: cnpem/epics-in-docker/.github/workflows/ioc-images.yml@main
 ```
 
 ## Containers

From 95df0a597bf9cb2c658645439984e4a4a8c64ce2 Mon Sep 17 00:00:00 2001
From: "Henrique F. Simoes" <henrique.simoes@lnls.br>
Date: Tue, 29 Aug 2023 10:46:32 -0300
Subject: [PATCH 12/13] base: use official Sequencer package source.

Sequencer is now mirrored on GitHub [1]. Tags now have the same format
as other EPICS modules.

[1]: https://epics.anl.gov/tech-talk/2024/msg00316.php
---
 base/.env               | 2 +-
 base/install_modules.sh | 5 +----
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/base/.env b/base/.env
index 09a0182..ee947ff 100644
--- a/base/.env
+++ b/base/.env
@@ -4,7 +4,7 @@ ALPINE_VERSION=3.18.4
 EPICS7_BASE_VERSION=7.0.7
 PVXS_VERSION=1.3.1
 
-SEQUENCER_VERSION=2.2.9
+SEQUENCER_VERSION=R2-2-9
 CALC_VERSION=R3-7-5
 ASYN_VERSION=R4-44-2
 STREAMDEVICE_VERSION=2.8.24
diff --git a/base/install_modules.sh b/base/install_modules.sh
index e7a62fa..af74a15 100755
--- a/base/install_modules.sh
+++ b/base/install_modules.sh
@@ -8,10 +8,7 @@ install_github_module mdavidsaver pvxs PVXS $PVXS_VERSION "
 EPICS_BASE
 "
 
-# Build seq first since it doesn't depend on anything
-lnls-get-n-unpack -l "https://static.erico.dev/seq-$SEQUENCER_VERSION.tar.gz"
-mv seq-$SEQUENCER_VERSION seq
-install_module seq SNCSEQ "
+install_github_module epics-modules sequencer SNCSEQ $SEQUENCER_VERSION "
 EPICS_BASE
 "
 

From d595fd14ff4b331e43a8e8a8ff3199f02c1d7c73 Mon Sep 17 00:00:00 2001
From: "Henrique F. Simoes" <henrique.simoes@lnls.br>
Date: Wed, 13 Mar 2024 15:19:16 -0300
Subject: [PATCH 13/13] ci: use valid tag name for pull request events.

GitHub context variable `ref_name` has an invalid pattern (`<pr>/merge`)
for container image tags when events are generated by pull requests. In
such cases, `head_ref` should be used in the IOC build workflow instead.

Fixes: 4cd3893 ("ci: add reusable job for IOC images.")
---
 .github/workflows/ioc-images.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ioc-images.yml b/.github/workflows/ioc-images.yml
index cdc4c22..1dd3a74 100644
--- a/.github/workflows/ioc-images.yml
+++ b/.github/workflows/ioc-images.yml
@@ -11,7 +11,7 @@ jobs:
     env:
       REGISTRY: ghcr.io/${{ github.repository_owner }}
       SOURCE: https://github.com/${{ github.repository }}
-      TAG: ${{ github.ref_name }}
+      TAG: ${{ github.event_name == 'push' && github.ref_name || github.head_ref }}
     steps:
       - uses: actions/checkout@v4
         with: