Restructure os version layout by AnHeuermann · Pull Request #49 · OpenModelica/build-deps

AnHeuermann · 2026-06-23T12:38:55Z

Issue

Fixes #48

Changes

Key images by OS/OS-version built from a CI matrix (.ci/matrix.yml).

ubuntu/Dockerfile: one multi-stage Dockerfile for all Ubuntu versions
(22.04/24.04/26.04); base = full stage, add-ons (cmake-4) = extra stages
single .github/workflows/build.yml pipeline: discover -> build -> release
-> publish GHCR (signed) + Nexus, so a token-created release still publishes
debian/almalinux/arch: empty multi-stage placeholders, absent from the matrix
README + RELEASING document the layout and release flow

Key images by OS/OS-version built from a CI matrix (.ci/matrix.yml). - ubuntu/Dockerfile: one multi-stage Dockerfile for all Ubuntu versions (22.04/24.04/26.04); base = `full` stage, add-ons (cmake-4) = extra stages - single .github/workflows/build.yml pipeline: discover -> build -> release -> publish GHCR (signed) + Nexus, so a token-created release still publishes - debian/almalinux/arch: empty multi-stage placeholders, absent from the matrix - README + RELEASING document the layout and release flow Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

AnHeuermann · 2026-06-23T12:39:48Z

@coderabbitai review

AnHeuermann · 2026-06-23T12:48:28Z

@coderabbitai review

coderabbitai · 2026-06-23T12:48:36Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai · 2026-06-23T13:02:40Z

📝 Walkthrough

Walkthrough

Replaces a single flat Dockerfile and two separate publish workflows with a monorepo-style setup: a multi-stage parameterized ubuntu/Dockerfile, OS placeholder Dockerfiles, a .ci/matrix.yml image definition file, a Python query tool (matrix.py), a Bash publish script (publish.sh), and a unified GitHub Actions pipeline (build.yml) covering discover → build → release → publish-to-GHCR-and-Nexus.

Changes

Monorepo CI Pipeline Overhaul

Layer / File(s)	Summary
Ubuntu multi-stage Dockerfile and OS placeholders `ubuntu/Dockerfile`, `almalinux/Dockerfile`, `arch/Dockerfile`, `debian/Dockerfile`	`ubuntu/Dockerfile` defines `base`, `venv`, `full`, and `cmake-4` stages parameterized by `UBUNTU_VERSION`. Placeholder Dockerfiles for AlmaLinux, Arch, and Debian are added as comment-only stubs explicitly excluded from CI. The old flat `Dockerfile` is removed.
CI matrix schema and Python query tool `.ci/matrix.yml`, `.ci/matrix.py`	`matrix.yml` defines Ubuntu 22.04, 24.04, and 26.04 entries (with `cmake-4` add-on for 24.04). `matrix.py` provides `load_images()`, `cmd_all()` (JSON output), `cmd_image(tag)` (shell assignments), and `main()` CLI dispatch with tag validation via regex.
Publish script `.ci/publish.sh`	Bash script that evals `matrix.py image "$TAG"` to load build parameters, runs `docker buildx --push` for the base and each add-on stage under both moving and immutable tags, optionally cosign-signs all tags when `SIGN=true`, and prints the pushed tag list.
Unified GitHub Actions pipeline `.github/workflows/build.yml`, `.github/workflows/release.yml`	`build.yml` adds `discover`, `build`, `release`, `publish-ghcr` (with cosign verification), and `publish-nexus` jobs; trigger patterns updated to `-..` tags. `release.yml` updates the tag pattern and removes default-branch detection, always setting `--latest=false`. Old `publish.yml` and `publish-nexus.yml` are deleted.
Documentation and release guide `README.md`, `RELEASING.md`, `.gitignore`	README is rewritten to document the OS-keyed image model, tagging rules, repo structure, and CI pipeline. `RELEASING.md` is added with semver rules, end-to-end release steps, add-on instructions, and Arch snapshot guidance. `.gitignore` gains `.vscode/` and `CLAUDE.md`.

Sequence Diagram(s)

sequenceDiagram
  participant dev as Developer
  participant gha as GitHub Actions
  participant matrix as matrix.py
  participant buildx as docker buildx
  participant ghcr as GHCR
  participant nexus as Nexus
  participant cosign as cosign

  dev->>gha: push tag (os-version-semver)
  gha->>matrix: matrix.py all → JSON matrix
  matrix-->>gha: image list
  gha->>buildx: build base + add-on stages (--load)
  gha->>gha: create/update GitHub Release (--latest=false)

  rect rgba(100, 149, 237, 0.5)
    note over gha,cosign: publish-ghcr
    gha->>matrix: matrix.py image TAG → shell vars
    matrix-->>gha: build params
    gha->>ghcr: docker buildx --push (moving + immutable tags)
    gha->>cosign: cosign sign --yes each tag
    gha->>cosign: cosign verify each tag
  end

  rect rgba(144, 238, 144, 0.5)
    note over gha,nexus: publish-nexus
    gha->>matrix: matrix.py image TAG → shell vars
    matrix-->>gha: build params
    gha->>nexus: docker buildx --push (moving + immutable tags)
  end

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: restructuring the OS/version-based repository layout around a matrix-based approach for managing OS variants and versions.
Description check	✅ Passed	The description is directly related to the changeset, referencing the Ubuntu Dockerfile restructuring, matrix-based CI, and the consolidated build pipeline that the PR implements.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 6

🧹 Nitpick comments (1)

ubuntu/Dockerfile (1)

47-67: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Use --no-install-recommends on package installs.

These install steps currently pull recommended packages by default, which increases image size and attack surface for every published image variant.

Proposed patch

 RUN apt-get update \
   && apt-get upgrade -qy \
   && apt-get dist-upgrade -qy \
-  && apt-get install -qy \
+  && apt-get install -qy --no-install-recommends \
     ca-certificates \
     curl \
     gnupg \
     lsb-release \
@@
 FROM base AS venv
 RUN apt-get update \
-  && apt-get install -qy python3-pip python3-venv \
+  && apt-get install -qy --no-install-recommends python3-pip python3-venv \
   && rm -rf /var/lib/apt/lists/*
@@
 RUN apt-get update \
   && . /etc/os-release \
   && case "${VERSION_ID}" in \
        22.04) qt="${QT_PKGS_22_04}" ;; \
        *)     qt="${QT_PKGS}" ;; \
      esac \
-  && apt-get install -qy ${COMMON_PKGS} ${qt} \
+  && apt-get install -qy --no-install-recommends ${COMMON_PKGS} ${qt} \
   && apt-get clean \
   && rm -rf /var/lib/apt/lists/*

Also applies to: 73-75, 156-164

Source: Linters/SAST tools

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e0109505-7866-440e-8690-1bdf31658c9e

📥 Commits

Reviewing files that changed from the base of the PR and between 028e1d2 and 476537d.

📒 Files selected for processing (15)

.ci/matrix.py
.ci/matrix.yml
.ci/publish.sh
.github/workflows/build.yml
.github/workflows/publish-nexus.yml
.github/workflows/publish.yml
.github/workflows/release.yml
.gitignore
Dockerfile
README.md
RELEASING.md
almalinux/Dockerfile
arch/Dockerfile
debian/Dockerfile
ubuntu/Dockerfile

💤 Files with no reviewable changes (3)

.github/workflows/publish.yml
Dockerfile
.github/workflows/publish-nexus.yml

sjoelund · 2026-06-23T15:51:15Z

+# PLACEHOLDER — OpenModelica build-deps image for Debian.
+#
+# Not implemented yet. Use the same layout as ../ubuntu/Dockerfile: a single
+# multi-stage Dockerfile covering ALL Debian versions, with these stages:
+#   base     OpenModelica build dependencies only
+#   venv     Python virtualenv at /opt/venv, built in isolation and copied later
+#   full     the published base image (build-deps:debian-<ver>)
+#   <addon>  optional add-on stages (FROM full)
+#
+# The Debian version is selected with a build-arg, e.g.:
+#   ARG DEBIAN_VERSION=13
+#   FROM debian:${DEBIAN_VERSION} AS base
+#
+# To implement:
+#   1. Replace this file with a real multi-stage Dockerfile (see
+#      ../ubuntu/Dockerfile and RELEASING.md). A starting point exists on the
+#      old Debian branches / PR #36
+#      (https://github.com/OpenModelica/build-deps/pull/36).
+#   2. Add the debian entries to .ci/matrix.yml
+#      (context: debian, dockerfile: debian/Dockerfile, target: full,
+#       build_args: { DEBIAN_VERSION: "<ver>" }).
+#   3. Open a PR; build.yml will build it.
+#
+# Until then Debian is intentionally absent from .ci/matrix.yml, so CI does not
+# try to build it.


I would perhaps rename "ubuntu/Dockerfile" to "apt/Dockerfile" instead. They are pretty much the same when it comes to dependencies

sjoelund · 2026-06-23T16:03:18Z

+        ``build_args`` and ``addons`` are space-separated strings so they can be
+        looped over in shell directly.


Is that important? A list would be much more natural...

sjoelund · 2026-06-23T16:03:40Z

+        Resolve a release tag such as ``ubuntu-24.04-2.1.0`` to the image it
+        refers to and print shell ``key='value'`` assignments to stdout::
+
+            dir='ubuntu/24.04'
+            base_tag='ubuntu-24.04'
+            semver='2.1.0'
+            context='ubuntu'
+            dockerfile='ubuntu/Dockerfile'
+            target='full'
+            build_args='UBUNTU_VERSION=24.04'
+            addons='cmake-4'


Simply make the tags v2.1.0 instead and rebuild the images based on that. Needing to tag multiple things is annoying.

sjoelund · 2026-06-24T18:47:19Z

@AnHeuermann I pushed my rust deps

AnHeuermann and others added 2 commits June 23, 2026 14:21

Fixup

476537d

coderabbitai Bot reviewed Jun 23, 2026

View reviewed changes

Comment thread .ci/matrix.py Outdated

Comment thread .github/workflows/build.yml

Comment thread .github/workflows/build.yml

Comment thread .github/workflows/build.yml Outdated

Comment thread .github/workflows/release.yml Outdated

Comment thread RELEASING.md Outdated

AnHeuermann added 2 commits June 23, 2026 15:46

Fix review comments

b02a14a

Adding GBD add-on

ea496b1

AnHeuermann requested a review from sjoelund June 23, 2026 14:32

AnHeuermann self-assigned this Jun 23, 2026

AnHeuermann marked this pull request as draft June 23, 2026 15:17

Automate rolling release

7d91b49

sjoelund requested changes Jun 23, 2026

View reviewed changes

Add first draft of Rust addon

fbcb397

sjoelund force-pushed the restructure-os-version-layout branch from e83f241 to fbcb397 Compare June 24, 2026 07:30

sjoelund added 4 commits June 25, 2026 10:23

Also install Qt Quick3D and the Qt env for MSVC

d021c00

Will also need LLVM for llvm-lib, etc

b74445d

Install Quick3D also for the base image, and qt5compat for aqt

df672fb

We will need wine to run qtdeploy

ef7ad70

		``build_args`` and ``addons`` are space-separated strings so they can be
		looped over in shell directly.

Uh oh!

Conversation

AnHeuermann commented Jun 23, 2026

Issue

Changes

Uh oh!

AnHeuermann commented Jun 23, 2026

Uh oh!

AnHeuermann commented Jun 23, 2026

Uh oh!

coderabbitai Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jun 23, 2026

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sjoelund Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

sjoelund Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

sjoelund Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sjoelund commented Jun 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Jun 23, 2026 •

edited

Loading