Feat/docker ci

.github/ci/Dockerfile

@@ -0,0 +1,84 @@
+# ────────────────────────────────────────────────────────────────
+# tensogram CI image
+#
+# Pre-bakes Rust toolchain + system libs. Python and Node.js are
+# installed at CI runtime by uv / curl (adds ~10 s per job that
+# needs them, but shrinks the image by ~430 MB).
+#
+#   docker build -t tensogram-ci:test .github/ci/
+# ────────────────────────────────────────────────────────────────
+
+# ── Pinned versions (edit here to bump) ─────────────────────────
+ARG UV_VERSION=0.11.6
+
+FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv
+
+FROM ubuntu:24.04 AS builder
+
+ARG RUST_VERSION=1.94.0
+ARG WASM_PACK_VERSION=0.14.0
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    LANG=C.UTF-8 \
+    RUSTUP_HOME=/usr/local/rustup \
+    CARGO_HOME=/usr/local/cargo \
+    PATH=/usr/local/cargo/bin:$PATH
+
+RUN set -eux \
+ && apt-get update \
+ && apt-get install -y --no-install-recommends \
+      build-essential pkg-config curl ca-certificates \
+ && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+      | sh -s -- -y --default-toolchain "${RUST_VERSION}" \
+                 --profile minimal -c clippy -c rustfmt \
+ && rustup target add wasm32-unknown-unknown \
+ && cargo install wasm-pack --version "${WASM_PACK_VERSION}" --locked \
+ && rm -rf "${CARGO_HOME}"/registry "${CARGO_HOME}"/git /tmp/* \
+           "${RUSTUP_HOME}"/toolchains/*/share/doc \
+           "${RUSTUP_HOME}"/toolchains/*/share/man
+
+# ── Final image ─────────────────────────────────────────────────
+FROM ubuntu:24.04
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    LANG=C.UTF-8 \
+    RUSTUP_HOME=/usr/local/rustup \
+    CARGO_HOME=/usr/local/cargo \
+    LIBCLANG_PATH=/usr/lib/x86_64-linux-gnu \
+    PATH=/usr/local/cargo/bin:$PATH
+
+# ── System packages ─────────────────────────────────────────────
+# Ubuntu 24.04 ships cmake 3.28 and LLVM 18 — zero PPAs needed.
+RUN set -eux \
+ && apt-get update \
+ && apt-get install -y --no-install-recommends \
+      build-essential pkg-config git curl ca-certificates \
+      cmake \
+      libclang1-18 libclang-common-18-dev \
+ && rm -f /usr/lib/x86_64-linux-gnu/libicu*.a \
+         /usr/lib/x86_64-linux-gnu/libssl.a \
+         /usr/lib/x86_64-linux-gnu/libcrypto.a \
+         /usr/lib/x86_64-linux-gnu/libxml2.a \
+         /usr/lib/x86_64-linux-gnu/libcurl*.a \
+ && rm -rf /usr/lib/llvm-18/include \
+ && strip --strip-unneeded /usr/lib/x86_64-linux-gnu/lib*.so* 2>/dev/null || true \
+ && apt-get clean \
+ && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* \
+           /usr/share/doc /usr/share/man /usr/share/info \
+           /usr/share/lintian /usr/share/cmake-3.28/Help
+
+# ── Rust toolchain + wasm-pack (from builder) ──────────────────
+COPY --from=builder /usr/local/rustup /usr/local/rustup
+COPY --from=builder /usr/local/cargo  /usr/local/cargo
+
+# ── uv (Python + Node installed at CI runtime) ─────────────────
+COPY --from=uv /uv /uvx /usr/local/bin/
+
+# ── Smoke test ──────────────────────────────────────────────────
+RUN set -eux \
+ && rustc --version && cargo --version \
+ && cmake --version \
+ && wasm-pack --version \
+ && uv --version
+
+WORKDIR /workspace

.github/ci/VERSION

@@ -0,0 +1 @@
+1.1.0

.github/workflows/ci-image.yml

@@ -0,0 +1,59 @@
+name: CI Image
+
+on:
+  push:
+    branches: [main]
+    paths: [".github/ci/**"]
+  pull_request:
+    paths: [".github/ci/**"]
+  workflow_dispatch:
+
+concurrency:
+  group: ci-image-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  IMAGE: eccr.ecmwf.int/tensogram/ci
+
+jobs:
+  build-and-push:
+    name: Build CI image
+    runs-on: [self-hosted, Linux, platform-builder-docker-xl, platform-builder-Ubuntu-22.04]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Read version
+        id: version
+        run: |
+          VERSION=$(cat .github/ci/VERSION | tr -d '[:space:]')
+          MAJOR=$(echo "$VERSION" | cut -d. -f1)
+          MINOR=$(echo "$VERSION" | cut -d. -f1-2)
+          echo "full=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "major=$MAJOR"  >> "$GITHUB_OUTPUT"
+          echo "minor=$MINOR"  >> "$GITHUB_OUTPUT"
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to ECCR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: eccr.ecmwf.int
+          username: ${{ secrets.ECMWF_DOCKER_REGISTRY_USERNAME }}
+          password: ${{ secrets.ECMWF_DOCKER_REGISTRY_ACCESS_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .github/ci/
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: |
+            ${{ env.IMAGE }}:${{ steps.version.outputs.full }}
+            ${{ env.IMAGE }}:${{ steps.version.outputs.minor }}
+            ${{ env.IMAGE }}:${{ steps.version.outputs.major }}
+            ${{ env.IMAGE }}:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max