Track the CI image hash with a label instead of a tag

Pushing per-hash tags accumulates multi-GB versions in the registry, and package cleanup rules can't distinguish the hash tags that the latest-{arch} tags currently point to from stale ones. Push only latest-{arch} and record the Dockerfile hash as an image label; the skip-rebuild check reads the label back via buildx imagetools.
Shrink the CI image
2026-06-12 12:16:34 -04:00 · 2026-06-12 12:12:10 -04:00
2 changed files with 13 additions and 26 deletions
@@ -24,18 +24,14 @@ jobs:
      - name: Build and push image if changed
        run: |
          image=git.weaselab.dev/weaselab/conflict-set-ci
-          tag="$(sha256sum Dockerfile .pre-commit-config.yaml | sha256sum | cut -c 1-16)-${{ matrix.arch }}"
-          latest=latest-${{ matrix.arch }}
-          if docker manifest inspect "$image:$tag" > /dev/null 2>&1; then
-            if [ "$(docker manifest inspect "$image:$tag")" = "$(docker manifest inspect "$image:$latest" 2> /dev/null)" ]; then
-              echo "$image:$latest is up to date"
+          hash="$(sha256sum Dockerfile .pre-commit-config.yaml | sha256sum | cut -c 1-16)"
+          latest="$image:latest-${{ matrix.arch }}"
+          current="$(docker buildx imagetools inspect "$latest" \
+            --format '{{index .Image.Config.Labels "dev.weaselab.ci-hash"}}' 2> /dev/null || true)"
+          if [ "$current" = "$hash" ]; then
+            echo "$latest is up to date"
          else
-              docker pull "$image:$tag"
-              docker tag "$image:$tag" "$image:$latest"
-              docker push "$image:$latest"
-            fi
-          else
-            docker build --push -t "$image:$tag" -t "$image:$latest" .
+            docker build --push --label "dev.weaselab.ci-hash=$hash" -t "$latest" .
          fi

  pre-commit:
@@ -16,6 +16,7 @@ RUN TZ=America/Los_Angeles DEBIAN_FRONTEND=noninteractive apt-get install -y \
    devscripts \
    gcovr \
    git \
+    latexmk \
    libc6-dbg \
    llvm \
    mold \
@@ -23,7 +24,11 @@ RUN TZ=America/Los_Angeles DEBIAN_FRONTEND=noninteractive apt-get install -y \
    pre-commit \
    python3-requests \
    rpm \
-    texlive-full \
+    texlive-bibtex-extra \
+    texlive-fonts-recommended \
+    texlive-latex-extra \
+    texlive-pictures \
+    valgrind \
    wget \
    zstd

@@ -31,20 +36,6 @@ RUN TZ=America/Los_Angeles DEBIAN_FRONTEND=noninteractive apt-get install -y \
 RUN curl -Ls "https://dl.min.io/client/mc/release/linux-$(dpkg --print-architecture)/mc" \
    -o /usr/local/bin/mc && chmod +x /usr/local/bin/mc

-# Install recent valgrind from source
-RUN curl -Ls https://sourceware.org/pub/valgrind/valgrind-3.22.0.tar.bz2 -o valgrind.tar.bz2 && \
-    echo "c811db5add2c5f729944caf47c4e7a65dcaabb9461e472b578765dd7bf6d2d4c  valgrind.tar.bz2" > valgrind-sha.txt && \
-    sha256sum --quiet -c valgrind-sha.txt && \
-    mkdir valgrind && \
-    tar --strip-components 1 --no-same-owner --no-same-permissions --directory valgrind -xjf valgrind.tar.bz2 && \
-    cd valgrind && \
-    ./configure --enable-only64bit --enable-lto && \
-    make -j`nproc` && \
-    make install && \
-    cd .. && \
-    rm -rf /tmp/*
-
-# Set after building valgrind, which doesn't build with clang for some reason
 ENV CC=clang
 ENV CXX=clang++
Author	SHA1	Message	Date
andrew	12a62a91cf	Track the CI image hash with a label instead of a tag CI / build-image (arm64, ubuntu-latest-arm64) (push) Failing after 3m47s Details CI / build-image (amd64, ubuntu-latest-amd64) (push) Failing after 3m47s Details CI / pre-commit (push) Has been skipped Details CI / test (-DCMAKE_BUILD_TYPE=Debug, debug) (push) Has been skipped Details CI / test (-DCMAKE_CXX_FLAGS=-DUSE_64_BIT=1, 64-bit-versions) (push) Has been skipped Details CI / test (-DCMAKE_C_COMPILER=gcc -DCMAKE_CXX_COMPILER=g++, gcc) (push) Has been skipped Details CI / test (-DUSE_SIMD_FALLBACK=ON, simd-fallback) (push) Has been skipped Details CI / release (amd64, ubuntu-latest-amd64) (push) Has been skipped Details CI / release (arm64, ubuntu-latest-arm64) (push) Has been skipped Details CI / coverage (push) Has been skipped Details Pushing per-hash tags accumulates multi-GB versions in the registry, and package cleanup rules can't distinguish the hash tags that the latest-{arch} tags currently point to from stale ones. Push only latest-{arch} and record the Dockerfile hash as an image label; the skip-rebuild check reads the label back via buildx imagetools.	2026-06-12 12:16:34 -04:00
andrew	cbbb23bf9d	Shrink the CI image Replace texlive-full with the texlive packages the paper actually needs (latexmk, latex-extra, pictures for TikZ, bibtex-extra, recommended fonts), and use Ubuntu's valgrind instead of building 3.22 from source - the distro version is newer now. Cuts the image by several GB and removes the slowest step of the image build.	2026-06-12 12:12:10 -04:00