Skip to content

ci: validate Dockerfile on PRs via source-check build #344

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
manzuoni-astera wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci: validate Dockerfile on PRs via source-check build #344

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
71 changes: 71 additions & 0 deletions .github/workflows/docker-validate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,71 @@
name: Validate Dockerfile

# Fast, push-free Dockerfile validation for pull requests. The heavy
# build-and-push (checkpoints + all pixi envs) only runs on main/tags in
# docker.yml; this catches Dockerfile breakage — a bad COPY path, a dropped env
# in the install list, a broken pixi bootstrap — before it reaches main.
#
# It builds the Dockerfile's `source-check` stage, which stops after the base
# image and source COPY: no checkpoint pull, no `pixi install -e <env>`, no
# push. That keeps it cheap while still exercising the parts of the Dockerfile
# that change most often.

on:
push:
branches: [main]
paths:
- 'Dockerfile'
- 'Dockerfile.astera'

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow files =="
git ls-files .github/workflows || true

echo "== docker-validate workflow =="
if [ -f .github/workflows/docker-validate.yml ]; then
  cat -n .github/workflows/docker-validate.yml
else
  echo "missing"
fi

echo "== docker files in repo =="
git ls-files | grep -E '(^|/)Dockerfile\.' || true

echo "== search Dockerfile.astera references =="
rg -n "Dockerfile\.astera|astera|source-check|docker|buildenv" . --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' || true

Repository: diff-use/sampleworks

Length of output: 10605

Remove Dockerfile.astera from the Dockerfile validation paths.

When only Dockerfile.astera changes, this workflow still runs and builds the public Dockerfile target (file: Dockerfile), so Astera-only Dockerfile changes pass without exercising the overlay Dockerfile. Drop the Dockerfile.astera entries from both on.push.paths and on.pull_request.paths unless a separate workflow is added that can validate Dockerfile.astera’s published base image.

Proposed fix 
-      - 'Dockerfile.astera'

Remove this entry from both trigger lists.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- 'Dockerfile.astera'
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docker-validate.yml at line 18, Remove the
Dockerfile.astera path entry from both the on.push.paths and
on.pull_request.paths trigger lists in the Docker validation workflow, leaving
validation triggered only by paths exercised by the public Dockerfile target.

- 'docker-entrypoint.sh'
- 'pyproject.toml'
Comment on lines +17 to +20
- 'pixi.lock'
- 'run_grid_search.py'
- 'run_experiments'
- 'run_experiments.sh'
- 'run_all_models.sh'
- '.github/workflows/docker-validate.yml'
pull_request:
branches: [main]
paths:
- 'Dockerfile'
- 'Dockerfile.astera'
- 'docker-entrypoint.sh'
- 'pyproject.toml'
- 'pixi.lock'
- 'run_grid_search.py'
- 'run_experiments'
- 'run_experiments.sh'
- 'run_all_models.sh'
- '.github/workflows/docker-validate.yml'
workflow_dispatch:

concurrency:
group: docker-validate-${{ github.ref }}
cancel-in-progress: true

jobs:
source-check:
name: Dockerfile source-check (no push)
runs-on: ubuntu-latest
timeout-minutes: 20
permissions:
contents: read

steps:
- name: Checkout code
uses: actions/checkout@v4
with:
persist-credentials: false

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Build source-check stage
uses: docker/build-push-action@v6
with:
context: .
file: Dockerfile
target: source-check
push: false
cache-from: type=gha
cache-to: type=gha,mode=max
Comment on lines +51 to +71
Comment on lines +63 to +71

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow excerpt =="
sed -n '1,120p' .github/workflows/docker-validate.yml

echo
echo "== search docker build flags =="
rg -n "uses: docker/build-push-action|pull:|build-push-action@v6|docker build" .github/workflows/docker-validate.yml Dockerfile 2>/dev/null || true

echo
echo "== relevant Dockerfile lines =="
sed -n '1,80p' Dockerfile

Repository: diff-use/sampleworks

Length of output: 5409

🌐 Web query:

docker/build-push-action v6 pull option default false cache-from cache-to base image

💡 Result:

In the docker/build-push-action v6 (and other versions), the pull input option defaults to false [1][2][3]. When set to true, this option instructs the action to always attempt to pull all referenced images (such as base images) before the build begins [1][2]. Regarding caching: 1. cache-from: This option is used to specify external cache sources for Buildx (e.g., type=gha, type=registry, or type=local) [4][5]. It tells the builder where to look for existing cache layers to reuse during the build process [4]. 2. cache-to: This option defines the destination where cache artifacts generated during the build should be exported [4]. 3. Interaction with Base Images: The pull option is distinct from caching mechanisms. If you rely on base images, the builder automatically pulls them if they are not present locally. If you want to ensure the latest base image is always used, you can set pull: true [1][2]. However, caching (via cache-from) specifically stores and retrieves intermediate layers produced by your Dockerfile instructions; it does not replace the need for the builder to resolve and pull the specified base image [4]. For optimal performance in CI/CD environments, it is standard practice to combine appropriate cache-from and cache-to configurations (such as type=gha) to persist layers across workflow runs [6][4].

Citations:

Force a base-image pull during validation.

docker/build-push-action defaults pull to false; with GHA cache enabled, a cached build can reuse prior os-base layers and skip checking the current digest-pinned BASE_IMAGE. Keep target: source-check and add pull: true.

Proposed fix 
           file: Dockerfile
           target: source-check
+          pull: true
           push: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Build source-check stage
uses: docker/build-push-action@v6
with:
context: .
file: Dockerfile
target: source-check
push: false
cache-from: type=gha
cache-to: type=gha,mode=max
- name: Build source-check stage
uses: docker/build-push-action@v6
with:
context: .
file: Dockerfile
target: source-check
pull: true
push: false
cache-from: type=gha
cache-to: type=gha,mode=max
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docker-validate.yml around lines 63 - 71, Update the
docker/build-push-action step named “Build source-check stage” to set pull:
true, while preserving target: source-check and the existing cache
configuration.

Loading