From 5e48cd518f78f6e7f7c1f950b64d26893f92d93e Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 5 Nov 2026 05:54:12 +0000 Subject: [PATCH] Docker image: compile the SDK once, and let the workflow push to ghcr.io The test-services image compiled the Rust extension twice per platform: `uv sync --all-extras --all-packages` for an editable install (with 158 packages of extras the image never uses), then `uv build --all-packages` again from the sdist. Under QEMU, for linux/arm64, that was 55 + 45 minutes. Only the wheel is copied to the final stage, so the build stage now runs `uv build --wheel`, once. The workflow had no permissions block, and every run since Oct 30 failed at the push: "installation not allowed to Write organization package". It now asks for packages: write. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01RePHkQqibBdq1QeiSmBDhE --- .github/workflows/docker.yml | 5 +++++ test-services/Dockerfile | 6 ++++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index f20d9039..5c25ac33 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -7,6 +7,11 @@ on: tags: - v** +# The GITHUB_TOKEN pushes the image to ghcr.io. +permissions: + contents: read + packages: write + env: REPOSITORY_OWNER: ${{ github.repository_owner }} GHCR_REGISTRY: "ghcr.io" diff --git a/test-services/Dockerfile b/test-services/Dockerfile index e4a21570..98b271f9 100644 --- a/test-services/Dockerfile +++ b/test-services/Dockerfile @@ -19,8 +19,10 @@ COPY README.md . COPY uv.lock . -RUN uv sync --all-extras --all-packages -RUN uv build --all-packages +# Only the wheel is needed, built once from the source tree: no editable install of +# the extras, and no sdist to build it again from (each compiles the Rust extension, +# which under QEMU, for linux/arm64, takes the better part of an hour). +RUN uv build --wheel FROM python:3.12-slim AS test-services