TEST-INFRA: [ci-pipeline-design] Create a base CI image with pre-installed dependencies #2325

Open
opened 2026-04-03 14:24:38 +00:00 by freemo · 1 comment
Owner

Metadata

  • Branch: chore/ci-base-image-preinstalled-deps
  • Commit Message: chore(ci): create base Docker image with pre-installed uv, nox, and system dependencies
  • Milestone: v3.8.0
  • Parent Epic: #1678

Background and Context

Every job in the CI pipeline currently performs the same redundant setup steps at the start of its run:

  1. Installs system-level dependencies (e.g., apt-get install ...)
  2. Installs uv (the Python package manager)
  3. Installs nox (the task runner)

These steps are repeated independently across all jobs — lint, typecheck, security, quality, unit_tests, integration_tests, coverage, build, docker, helm — adding unnecessary wall-clock time to every CI run. Because these dependencies are stable and change infrequently, there is no value in re-downloading and re-installing them on every job invocation.

Expected Behavior / Proposed Solution

A custom base Docker image should be built and published to the project's container registry. This image would have all common CI dependencies pre-installed:

  • System packages (e.g., git, curl, build tools)
  • uv (pinned to the project's required version)
  • nox (pinned to the project's required version)

All CI jobs would then reference this base image instead of the default runner image, eliminating the redundant install steps and reducing per-job setup time significantly.

The image should be versioned and rebuilt only when its dependencies change (e.g., via a dedicated workflow triggered by changes to a Dockerfile.ci or equivalent manifest).

Acceptance Criteria

  • A Dockerfile.ci (or equivalent) exists in the repository defining the base CI image with system deps, uv, and nox pre-installed
  • The image is built and pushed to the project container registry via a dedicated CI workflow (e.g., triggered on changes to Dockerfile.ci)
  • All existing CI jobs in .forgejo/workflows/ci.yml are updated to use the new base image
  • No CI job performs redundant installation of uv, nox, or system packages that are already present in the base image
  • The base image version is pinned in the workflow file to ensure reproducibility
  • CI pipeline wall-clock time for job setup is measurably reduced

Supporting Information

  • Parent Epic: #1678 — CI Execution Time Optimization — Timeouts, Concurrency, and Coverage Artifact Sharing
  • Related: .forgejo/workflows/ci.yml (current workflow definition)
  • This issue addresses the redundant dependency installation pattern observed across all CI jobs

Subtasks

  • Audit .forgejo/workflows/ci.yml to identify all redundant install steps across jobs
  • Create Dockerfile.ci with system dependencies, uv, and nox pre-installed
  • Create a dedicated .forgejo/workflows/build-ci-image.yml workflow to build and push the image on changes
  • Update all jobs in .forgejo/workflows/ci.yml to use the new base image
  • Remove redundant apt-get, uv install, and nox install steps from each job
  • Pin the base image version/digest in the workflow for reproducibility
  • Update features/ci_workflow_validation.feature to assert the base image is referenced
  • Verify all nox stages pass after changes
  • Confirm coverage ≥ 97% via nox -s coverage_report
  • Run nox (all default sessions), fix any errors

Definition of Done

This issue is complete when:

  • All subtasks above are completed and checked off.
  • A Dockerfile.ci exists defining the base CI image with all common dependencies pre-installed.
  • A CI workflow exists to build and publish the base image automatically when it changes.
  • All jobs in .forgejo/workflows/ci.yml reference the base image and no longer perform redundant installs.
  • A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation.
  • The commit is pushed to the remote on the branch matching the Branch in Metadata exactly.
  • The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
  • All nox stages pass.
  • Coverage >= 97%.

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## Metadata - **Branch**: `chore/ci-base-image-preinstalled-deps` - **Commit Message**: `chore(ci): create base Docker image with pre-installed uv, nox, and system dependencies` - **Milestone**: v3.8.0 - **Parent Epic**: #1678 ## Background and Context Every job in the CI pipeline currently performs the same redundant setup steps at the start of its run: 1. Installs system-level dependencies (e.g., `apt-get install ...`) 2. Installs `uv` (the Python package manager) 3. Installs `nox` (the task runner) These steps are repeated independently across all jobs — lint, typecheck, security, quality, unit_tests, integration_tests, coverage, build, docker, helm — adding unnecessary wall-clock time to every CI run. Because these dependencies are stable and change infrequently, there is no value in re-downloading and re-installing them on every job invocation. ## Expected Behavior / Proposed Solution A custom base Docker image should be built and published to the project's container registry. This image would have all common CI dependencies pre-installed: - System packages (e.g., `git`, `curl`, build tools) - `uv` (pinned to the project's required version) - `nox` (pinned to the project's required version) All CI jobs would then reference this base image instead of the default runner image, eliminating the redundant install steps and reducing per-job setup time significantly. The image should be versioned and rebuilt only when its dependencies change (e.g., via a dedicated workflow triggered by changes to a `Dockerfile.ci` or equivalent manifest). ## Acceptance Criteria - [ ] A `Dockerfile.ci` (or equivalent) exists in the repository defining the base CI image with system deps, `uv`, and `nox` pre-installed - [ ] The image is built and pushed to the project container registry via a dedicated CI workflow (e.g., triggered on changes to `Dockerfile.ci`) - [ ] All existing CI jobs in `.forgejo/workflows/ci.yml` are updated to use the new base image - [ ] No CI job performs redundant installation of `uv`, `nox`, or system packages that are already present in the base image - [ ] The base image version is pinned in the workflow file to ensure reproducibility - [ ] CI pipeline wall-clock time for job setup is measurably reduced ## Supporting Information - Parent Epic: #1678 — CI Execution Time Optimization — Timeouts, Concurrency, and Coverage Artifact Sharing - Related: `.forgejo/workflows/ci.yml` (current workflow definition) - This issue addresses the redundant dependency installation pattern observed across all CI jobs ## Subtasks - [ ] Audit `.forgejo/workflows/ci.yml` to identify all redundant install steps across jobs - [ ] Create `Dockerfile.ci` with system dependencies, `uv`, and `nox` pre-installed - [ ] Create a dedicated `.forgejo/workflows/build-ci-image.yml` workflow to build and push the image on changes - [ ] Update all jobs in `.forgejo/workflows/ci.yml` to use the new base image - [ ] Remove redundant `apt-get`, `uv` install, and `nox` install steps from each job - [ ] Pin the base image version/digest in the workflow for reproducibility - [ ] Update `features/ci_workflow_validation.feature` to assert the base image is referenced - [ ] Verify all nox stages pass after changes - [ ] Confirm coverage ≥ 97% via `nox -s coverage_report` - [ ] Run `nox` (all default sessions), fix any errors ## Definition of Done This issue is complete when: - All subtasks above are completed and checked off. - A `Dockerfile.ci` exists defining the base CI image with all common dependencies pre-installed. - A CI workflow exists to build and publish the base image automatically when it changes. - All jobs in `.forgejo/workflows/ci.yml` reference the base image and no longer perform redundant installs. - A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation. - The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly. - The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - All nox stages pass. - Coverage >= 97%. --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator
freemo added this to the v3.8.0 milestone 2026-04-03 14:24:43 +00:00
Author
Owner

Issue triaged by project owner:

  • State: Verified
  • Priority: Medium (already set, correct)
  • Milestone: v3.8.0 (correct)
  • MoSCoW: Could Have — Custom CI Docker image is a nice-to-have optimization.
  • Parent Epic: #1678

This is the canonical issue for creating a custom CI Docker image. Duplicates #2324, #2290 have been closed and consolidated here.


Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Issue triaged by project owner: - **State**: Verified ✅ - **Priority**: Medium (already set, correct) - **Milestone**: v3.8.0 (correct) - **MoSCoW**: Could Have — Custom CI Docker image is a nice-to-have optimization. - **Parent Epic**: #1678 This is the canonical issue for creating a custom CI Docker image. Duplicates #2324, #2290 have been closed and consolidated here. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner
freemo removed this from the v3.8.0 milestone 2026-04-07 01:01:39 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference
cleveragents/cleveragents-core#2325
No description provided.