From 946d2a56b726acf76a8c0e612e3ea16683bba086 Mon Sep 17 00:00:00 2001
From: manzuoni-astera <me.anzuoni@gmail.com>
Date: Mon, 27 Jul 2026 13:22:48 -0400
Subject: [PATCH] ci: validate Dockerfile on PRs via source-check build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The full image build-and-push (checkpoints + all pixi envs) only runs on
main/tags in docker.yml, so a broken Dockerfile — a bad COPY path, a dropped
env in the hardcoded `pixi install -e` list, a broken pixi bootstrap — isn't
caught until after merge. Add a paths-filtered workflow that builds the
Dockerfile's existing `source-check` stage (base + source COPY only; no
checkpoint pull, no env installs, no push) on PRs touching Dockerfile*,
pyproject.toml, pixi.lock, or the wrapper scripts.
---
 .github/workflows/docker-validate.yml | 71 +++++++++++++++++++++++++++
 1 file changed, 71 insertions(+)
 create mode 100644 .github/workflows/docker-validate.yml

diff --git a/.github/workflows/docker-validate.yml b/.github/workflows/docker-validate.yml
new file mode 100644
index 00000000..b3659a32
--- /dev/null
+++ b/.github/workflows/docker-validate.yml
@@ -0,0 +1,71 @@
+name: Validate Dockerfile
+
+# Fast, push-free Dockerfile validation for pull requests. The heavy
+# build-and-push (checkpoints + all pixi envs) only runs on main/tags in
+# docker.yml; this catches Dockerfile breakage — a bad COPY path, a dropped env
+# in the install list, a broken pixi bootstrap — before it reaches main.
+#
+# It builds the Dockerfile's `source-check` stage, which stops after the base
+# image and source COPY: no checkpoint pull, no `pixi install -e <env>`, no
+# push. That keeps it cheap while still exercising the parts of the Dockerfile
+# that change most often.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'Dockerfile'
+      - 'Dockerfile.astera'
+      - 'docker-entrypoint.sh'
+      - 'pyproject.toml'
+      - 'pixi.lock'
+      - 'run_grid_search.py'
+      - 'run_experiments'
+      - 'run_experiments.sh'
+      - 'run_all_models.sh'
+      - '.github/workflows/docker-validate.yml'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'Dockerfile'
+      - 'Dockerfile.astera'
+      - 'docker-entrypoint.sh'
+      - 'pyproject.toml'
+      - 'pixi.lock'
+      - 'run_grid_search.py'
+      - 'run_experiments'
+      - 'run_experiments.sh'
+      - 'run_all_models.sh'
+      - '.github/workflows/docker-validate.yml'
+  workflow_dispatch:
+
+concurrency:
+  group: docker-validate-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  source-check:
+    name: Dockerfile source-check (no push)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build source-check stage
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile
+          target: source-check
+          push: false
+          cache-from: type=gha
+          cache-to: type=gha,mode=max