Track the CI image hash with a label instead of a tag

Pushing per-hash tags accumulates multi-GB versions in the registry,
and package cleanup rules can't distinguish the hash tags that the
latest-{arch} tags currently point to from stale ones. Push only
latest-{arch} and record the Dockerfile hash as an image label; the
skip-rebuild check reads the label back via buildx imagetools.

.gitea/workflows/ci.yml

@@ -24,18 +24,14 @@ jobs:
       - name: Build and push image if changed
         run: |
           image=git.weaselab.dev/weaselab/conflict-set-ci
-          tag="$(sha256sum Dockerfile .pre-commit-config.yaml | sha256sum | cut -c 1-16)-${{ matrix.arch }}"
+          hash="$(sha256sum Dockerfile .pre-commit-config.yaml | sha256sum | cut -c 1-16)"
-          latest=latest-${{ matrix.arch }}
+          latest="$image:latest-${{ matrix.arch }}"
-          if docker manifest inspect "$image:$tag" > /dev/null 2>&1; then
+          current="$(docker buildx imagetools inspect "$latest" \
-            if [ "$(docker manifest inspect "$image:$tag")" = "$(docker manifest inspect "$image:$latest" 2> /dev/null)" ]; then
+            --format '{{index .Image.Config.Labels "dev.weaselab.ci-hash"}}' 2> /dev/null || true)"
-              echo "$image:$latest is up to date"
+          if [ "$current" = "$hash" ]; then
+            echo "$latest is up to date"
           else
-              docker pull "$image:$tag"
+            docker build --push --label "dev.weaselab.ci-hash=$hash" -t "$latest" .
-              docker tag "$image:$tag" "$image:$latest"
-              docker push "$image:$latest"
-            fi
-          else
-            docker build --push -t "$image:$tag" -t "$image:$latest" .
           fi
 
   pre-commit:

Dockerfile

@@ -16,6 +16,7 @@ RUN TZ=America/Los_Angeles DEBIAN_FRONTEND=noninteractive apt-get install -y \
     devscripts \
     gcovr \
     git \
+    latexmk \
     libc6-dbg \
     llvm \
     mold \
@@ -23,7 +24,11 @@ RUN TZ=America/Los_Angeles DEBIAN_FRONTEND=noninteractive apt-get install -y \
     pre-commit \
     python3-requests \
     rpm \
-    texlive-full \
+    texlive-bibtex-extra \
+    texlive-fonts-recommended \
+    texlive-latex-extra \
+    texlive-pictures \
+    valgrind \
     wget \
     zstd
 
@@ -31,20 +36,6 @@ RUN TZ=America/Los_Angeles DEBIAN_FRONTEND=noninteractive apt-get install -y \
 RUN curl -Ls "https://dl.min.io/client/mc/release/linux-$(dpkg --print-architecture)/mc" \
     -o /usr/local/bin/mc && chmod +x /usr/local/bin/mc
 
-# Install recent valgrind from source
-RUN curl -Ls https://sourceware.org/pub/valgrind/valgrind-3.22.0.tar.bz2 -o valgrind.tar.bz2 && \
-    echo "c811db5add2c5f729944caf47c4e7a65dcaabb9461e472b578765dd7bf6d2d4c  valgrind.tar.bz2" > valgrind-sha.txt && \
-    sha256sum --quiet -c valgrind-sha.txt && \
-    mkdir valgrind && \
-    tar --strip-components 1 --no-same-owner --no-same-permissions --directory valgrind -xjf valgrind.tar.bz2 && \
-    cd valgrind && \
-    ./configure --enable-only64bit --enable-lto && \
-    make -j`nproc` && \
-    make install && \
-    cd .. && \
-    rm -rf /tmp/*
-
-# Set after building valgrind, which doesn't build with clang for some reason
 ENV CC=clang
 ENV CXX=clang++