Publish prebuilt CI images to the Gitea container registry

setup-php installs PHP 8.3+ from apt on these arm64 runners: a ~145s floor against ~35s for 8.1/8.2, with a tail that twice ran past the step timeout and failed the run (#178). Caching the .debs softened it without removing the apt step, and 8.5 has the same problem. Add a per-version CI image built on php:<version>-cli-alpine and a workflow that publishes it to git.unsupervised.ca/unsupervised/ci-php:<version>. The org is public, so the packages pull anonymously. The image carries bash and nodejs because act_runner runs JavaScript actions inside the job container, GNU coreutils/grep/sed because the workflow scripts use `tac` and `grep --include`, and curl/jq/git/zip for release.yml and bin/build-zip.sh. Composer 2 and the intl and zip extensions round it out. Nothing consumes the images yet — ci.yml and release.yml switch over in a follow-up, because a job cannot run in an image that has not been published. Part of #187 Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01D9acV1mHktGAb1uyvNmrR2
2026-08-24 19:49:17 -03:00
parent 7278309bf5
commit 794df2cb4f
3 changed files with 224 additions and 0 deletions
@@ -0,0 +1,60 @@
+# CI image for unsupervised-scheduler, one tag per PHP version.
+#
+# Built and published by .gitea/workflows/ci-images.yml to
+# git.unsupervised.ca/unsupervised/ci-php:<php-version>. CI and release jobs
+# run inside it via `container:`, so nothing installs PHP at job time.
+#
+# Why: setup-php installs 8.3+ through apt/the ondrej PPA on these arm64
+# runners — a ~145s floor against ~35s for 8.1/8.2, with a tail that has
+# twice crossed into hard failure (#178). Pulling a ~120MB image from the
+# registry in our own cluster replaces that entirely (#187).
+
+ARG PHP_VERSION=8.3
+FROM php:${PHP_VERSION}-cli-alpine
+
+# bash and nodejs are not optional: act_runner executes JavaScript actions
+# (actions/checkout, actions/cache, actions/upload-artifact) *inside* the job
+# container, and shells `run:` steps through bash.
+#
+# coreutils, gawk, grep and sed replace the busybox applets with the GNU ones
+# the workflow scripts are written against (`tac`, `grep --include`).
+#
+# jq, curl, git and zip/unzip are used by release.yml and bin/build-zip.sh.
+RUN apk add --no-cache \
+        bash \
+        coreutils \
+        curl \
+        gawk \
+        git \
+        grep \
+        jq \
+        nodejs \
+        sed \
+        unzip \
+        zip \
+        icu-libs \
+        libzip \
+ && apk add --no-cache --virtual .build-deps \
+        $PHPIZE_DEPS \
+        icu-dev \
+        libzip-dev \
+ && docker-php-ext-install -j"$(nproc)" intl zip \
+ && apk del --no-network .build-deps
+
+# mbstring is compiled into the official php images; intl and zip are added
+# above. That covers what phpunit, phpstan, phpcs and Composer need.
+
+COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
+
+# Jobs run as root inside the container, and never answer prompts.
+ENV COMPOSER_ALLOW_SUPERUSER=1 \
+    COMPOSER_NO_INTERACTION=1 \
+    COMPOSER_HOME=/composer
+
+RUN mkdir -p "$COMPOSER_HOME" \
+ && php -v \
+ && php -m | grep -qx intl \
+ && php -m | grep -qx mbstring \
+ && composer --version
+
+CMD ["/bin/bash"]