TEST-INFRA: [ci-pipeline-design] Optimize Docker multi-stage builds #1825

New issue

Open

opened 2026-04-02 23:55:52 +00:00 by freemo · 1 comment

freemo commented

2026-04-02 23:55:52 +00:00

Owner

Metadata

Branch: chore/ci-optimize-docker-multistage-builds
Commit Message: chore(ci): optimize Docker multi-stage build by moving uv install to builder stage
Milestone: v3.8.0
Parent Epic: #1678

Background and Context

The Dockerfile uses a multi-stage build, but the uv installation currently occurs in the final image stage rather than the builder stage. Moving uv to the builder stage means the final production image does not need to carry the uv installer, reducing the final image size and its attack surface.

This is a straightforward infrastructure hygiene improvement that aligns with the project's CI pipeline optimization efforts tracked under Epic #1678.

Current Behavior

The uv package manager is installed in the final image stage of the Dockerfile. This means the final production image carries uv as a runtime dependency even though it is only needed during the build phase.

Expected Behavior

uv is installed only in the builder stage. The final image stage copies only the built artifacts (e.g., the virtual environment or installed packages) from the builder stage, without including uv itself. The final image is smaller and has a reduced attack surface.

Acceptance Criteria

The uv installation step is present only in the builder stage of the Dockerfile.
The uv installation step is absent from the final image stage of the Dockerfile.
The final Docker image is demonstrably smaller (verified by comparing image sizes before and after).
The application still runs correctly from the optimized final image.

Supporting Information

Related: #1796 (Optimize Docker image build with layer caching)
Related: #1788 (Create a custom Docker image for CI jobs)
Parent Epic: #1678 (CI Execution Time Optimization)

Subtasks

Audit the current Dockerfile to identify where uv is installed and what it is used for in each stage
Move the uv installation step to the builder stage
Remove the uv installation step from the final image stage
Verify the final image builds successfully with docker build
Verify the application runs correctly from the optimized final image
Compare and document the image size before and after the change
Update any CI workflow steps or documentation that reference the uv installation in the final stage
Run nox (all default sessions), fix any errors
Verify coverage ≥ 97% via nox -s coverage_report

Definition of Done

This issue is complete when:

All subtasks above are completed and checked off.
A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly (chore(ci): optimize Docker multi-stage build by moving uv install to builder stage), followed by a blank line, then additional lines providing relevant details about the implementation.
The commit is pushed to the remote on the branch matching the Branch in Metadata exactly (chore/ci-optimize-docker-multistage-builds).
The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
All nox stages pass.
Coverage >= 97%.

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## Metadata - **Branch**: `chore/ci-optimize-docker-multistage-builds` - **Commit Message**: `chore(ci): optimize Docker multi-stage build by moving uv install to builder stage` - **Milestone**: v3.8.0 - **Parent Epic**: #1678 ## Background and Context The `Dockerfile` uses a multi-stage build, but the `uv` installation currently occurs in the final image stage rather than the `builder` stage. Moving `uv` to the `builder` stage means the final production image does not need to carry the `uv` installer, reducing the final image size and its attack surface. This is a straightforward infrastructure hygiene improvement that aligns with the project's CI pipeline optimization efforts tracked under Epic #1678. ## Current Behavior The `uv` package manager is installed in the final image stage of the `Dockerfile`. This means the final production image carries `uv` as a runtime dependency even though it is only needed during the build phase. ## Expected Behavior `uv` is installed only in the `builder` stage. The final image stage copies only the built artifacts (e.g., the virtual environment or installed packages) from the `builder` stage, without including `uv` itself. The final image is smaller and has a reduced attack surface. ## Acceptance Criteria - The `uv` installation step is present only in the `builder` stage of the `Dockerfile`. - The `uv` installation step is absent from the final image stage of the `Dockerfile`. - The final Docker image is demonstrably smaller (verified by comparing image sizes before and after). - The application still runs correctly from the optimized final image. ## Supporting Information - Related: #1796 (Optimize Docker image build with layer caching) - Related: #1788 (Create a custom Docker image for CI jobs) - Parent Epic: #1678 (CI Execution Time Optimization) ## Subtasks - [ ] Audit the current `Dockerfile` to identify where `uv` is installed and what it is used for in each stage - [ ] Move the `uv` installation step to the `builder` stage - [ ] Remove the `uv` installation step from the final image stage - [ ] Verify the final image builds successfully with `docker build` - [ ] Verify the application runs correctly from the optimized final image - [ ] Compare and document the image size before and after the change - [ ] Update any CI workflow steps or documentation that reference the `uv` installation in the final stage - [ ] Run `nox` (all default sessions), fix any errors - [ ] Verify coverage ≥ 97% via `nox -s coverage_report` ## Definition of Done This issue is complete when: - All subtasks above are completed and checked off. - A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly (`chore(ci): optimize Docker multi-stage build by moving uv install to builder stage`), followed by a blank line, then additional lines providing relevant details about the implementation. - The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly (`chore/ci-optimize-docker-multistage-builds`). - The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - All nox stages pass. - Coverage >= 97%. --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

freemo added this to the v3.8.0 milestone

2026-04-02 23:57:30 +00:00

freemo added a new dependency

2026-04-03 00:03:09 +00:00

#1678 Epic: CI Execution Time Optimization — Timeouts, Concurrency, and Coverage Artifact Sharing

freemo commented

2026-04-03 00:04:52 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified
MoSCoW: MoSCoW/Could Have — CI/test infrastructure improvement.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Issue triaged by project owner: - **State**: Verified - **MoSCoW**: MoSCoW/Could Have — CI/test infrastructure improvement. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo added the

MoSCoW

Could have

label

2026-04-03 00:04:52 +00:00