[igalshilman]

The "Build docker image" workflow has failed on every push to main since Oct 30, and since #262 it takes about 100 minutes.

Why it's slow

The linux/arm64 half of the image is built under QEMU, and test-services/Dockerfile compiled the Rust extension twice per platform:

Step (run #272)	amd64	arm64 (QEMU)
uv sync --all-extras --all-packages	3.5 min	55 min
uv build --all-packages (sdist, then a wheel from it)	4.7 min	45 min

uv sync also installed 158 packages of extras (google-adk, google-cloud-*, langchain…) that the image never uses: only the wheel in dist/ is copied to the final stage. The build stage now runs uv build --wheel, once, from the source tree.

Why it fails

Every run since #248 ends with:

failed to push ghcr.io/restatedev/test-services-python:main: denied: installation not allowed to Write organization package

docker.yml had no permissions: block (cla.yml needed explicit permissions the same day, so the token's default seems to have become read-only). It now asks for contents: read and packages: write. If the push is still denied after merging, the package's settings on ghcr.io need restatedev/sdk-python with write access under "Manage Actions access".

Testing

• Built the image locally (amd64): one compile (3m 18s), the wheel installs, and the container answers /discover with the test services.
• The push permission can only be checked once the workflow runs on main.

Expected effect

About 100 → 50 minutes (the arm64 compile under QEMU stays). Building arm64 on a native arm64 runner instead of QEMU would bring it to about 10; that's left for a follow-up.

integration.yaml builds the same Dockerfile, so its image build gets faster too.

---

Generated by Claude Code

[pullfrog]

✅ No new issues found.

Reviewed changes

I reviewed the Dockerfile build-stage simplification and the new workflow token permissions.

• One compile per platform: test-services/Dockerfile now runs only uv build --wheel. Before, it also ran uv sync --all-extras --all-packages and then built the wheel a second time from an sdist. The final stage only ever ran pip install deps/*whl with no extras, and restate-sdk is the only package in the repo (no uv workspace members), so dropping uv sync and --all-packages doesn't change what the image contains.
• ghcr.io push permission: docker.yml now sets contents: read (enough for actions/checkout) and packages: write (needed for docker/build-push-action to push with GITHUB_TOKEN). No actions were added or changed, so actions.lock doesn't need updating.

  ^{｜ View workflow run ｜ Using claude-opus-5-5 ｜ 𝕏}

[github-actions]

Test Results

  8 files  ±0    8 suites  ±0   3m 55s ⏱️ -1s
 71 tests ±0   71 ✅ ±0  0 💤 ±0  0 ❌ ±0 
322 runs  ±0  322 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit 5e48cd5. ± Comparison against base commit 312c765.