pin cibuildwheel images and manage them with dependabot

.github/dependabot.yml

@@ -5,3 +5,16 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+  # Docker images for cibuildwheel
+  - package-ecosystem: "docker"
+    directories:
+      - "/docker/manylinux-builder-aarch64"
+      - "/docker/manylinux-builder-x86_64"
+      - "/docker/musllinux-builder-aarch64"
+      - "/docker/musllinux-builder-x86_64"
+    schedule:
+      interval: "weekly"
+    groups:
+      docker:
+        patterns:
+          - "*"

.github/workflows/docs.yml

@@ -1,13 +1,24 @@
 # Build on Linux
 name: Build keyvi documentation
 
-# Controls when the action will run. 
+# Controls when the action will run.
 on:
   # Triggers the workflow on push or pull request events but only for the master branch
   push:
     branches: [ master ]
+    paths-ignore:
+      - '.github/workflows/keyvi.yml'
+      - '.github/workflows/python**.yml'
+      - '.github/workflows/rust**.yml'
+      - 'docker/**'
+
   pull_request:
     branches: [ master ]
+    paths-ignore:
+      - '.github/workflows/keyvi.yml'
+      - '.github/workflows/python**.yml'
+      - '.github/workflows/rust**.yml'
+      - 'docker/**'
 
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
@@ -47,14 +58,14 @@ jobs:
           export PATH="/usr/lib/ccache:/usr/local/opt/ccache/libexec:$PATH"
           python -m pip install -r python/requirements.txt
           python -m pip install sphinx breathe sphinx-wagtail-theme
-          
+
       - name: build python extension
         run: |
           export PATH="/usr/lib/ccache:/usr/local/opt/ccache/libexec:$PATH"
           cd python
           python setup.py build --mode ${BUILD_TYPE}
           python setup.py install --user
-    
+
       - name: build with cmake
         uses: lukka/run-cmake@v3
         with:

.github/workflows/keyvi.yml

@@ -1,13 +1,30 @@
 # Build on Linux
 
-name: Build keyvi
+name: Build keyvi core
 
-# Controls when the action will run. 
+# Controls when the action will run.
 on:
   # Triggers the workflow on push or pull request events but only for the master branch
   push:
+    paths-ignore:
+      - '.github/workflows/docs.yml'
+      - '.github/workflows/python**.yml'
+      - '.github/workflows/rust**.yml'
+      - 'docker/**'
+      - 'doc/**'
+      - 'python/**'
+      - 'rust/**'
+
   pull_request:
     branches: [ master ]
+    paths-ignore:
+      - '.github/workflows/docs.yml'
+      - '.github/workflows/python**.yml'
+      - '.github/workflows/rust**.yml'
+      - 'docker/**'
+      - 'doc/**'
+      - 'python/**'
+      - 'rust/**'
 
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:

.github/workflows/python-cibuildwheel.yml

@@ -3,8 +3,24 @@ name: Python cibuildwheel
 on:
   push:
     branches: [ master, release-* ]
+    paths-ignore:
+      - '.github/workflows/docs.yml'
+      - '.github/workflows/keyvi.yml'
+      - '.github/workflows/python-dockerimages-**.yml'
+      - '.github/workflows/rust**.yml'
+      - 'docker/**'
+      - 'doc/**'
+      - 'rust/**'
   pull_request:
     branches: [ master ]
+    paths-ignore:
+      - '.github/workflows/docs.yml'
+      - '.github/workflows/keyvi.yml'
+      - '.github/workflows/python-dockerimages-**.yml'
+      - '.github/workflows/rust**.yml'
+      - 'docker/**'
+      - 'doc/**'
+      - 'rust/**'
   release:
     types: [published]
   workflow_dispatch:
@@ -90,14 +106,14 @@ jobs:
           CIBW_MANYLINUX_AARCH64_IMAGE: 'keyvidev/manylinux-builder-aarch64'
           CIBW_MUSLLINUX_X86_64_IMAGE: 'keyvidev/musllinux-builder-x86_64'
           CIBW_MUSLLINUX_AARCH64_IMAGE: 'keyvidev/musllinux-builder-aarch64'
-          
+
           # ccache using path
           CIBW_ENVIRONMENT_MACOS: PATH=/usr/local/opt/ccache/libexec:$PATH
           CIBW_ENVIRONMENT_LINUX: PATH=/usr/local/bin:/usr/lib/ccache:$PATH CCACHE_DIR=/host${{ github.workspace }}/.ccache CCACHE_CONFIGPATH=/host/home/runner/.config/ccache/ccache.conf
-          
+
           # python dependencies
           CIBW_BEFORE_BUILD: pip install -r python/requirements.txt
-          
+
           # testing
           CIBW_TEST_REQUIRES: pytest python-snappy zstd
           CIBW_TEST_COMMAND: >
@@ -108,7 +124,7 @@ jobs:
           # CIBW_BUILD_VERBOSITY: 2
         with:
           package-dir: python
-        
+
       - uses: actions/upload-artifact@v4
         with:
           name: artifact-${{ matrix.os }}-${{ matrix.flavor }}-${{ matrix.target }}
@@ -160,5 +176,5 @@ jobs:
           pattern: artifact-*
           merge-multiple: true
           path: dist
-  
+
       - uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/python-dockerimages-cibuildwheel.yml

@@ -2,14 +2,14 @@ name: Python Linux docker cibuildwheel
 
 on:
   push:
-    branches: [ master, release-* ]
+    branches: [ master ]
     paths:
-      - 'docker/*/Dockerfile'
+      - 'docker/**'
       - '.github/workflows/python-dockerimages-cibuildwheel.yml'
   pull_request:
     branches: [ master ]
     paths:
-      - 'docker/*/Dockerfile'
+      - 'docker/**'
       - '.github/workflows/python-dockerimages-cibuildwheel.yml'
   workflow_dispatch:
 
@@ -39,22 +39,13 @@ jobs:
           echo "PLATFORM=linux/amd64" >> $GITHUB_ENV
           echo "ARCH=x86_64" >> $GITHUB_ENV
         if: matrix.os == 'ubuntu-24.04'
-      - name: Sets env for manylinux
-        run: |
-          echo "BASE_IMAGE=quay.io/pypa/manylinux_2_28_${{ env.ARCH }}" >> $GITHUB_ENV
-        if: matrix.base_image == 'many'
-      - name: Sets env for musllinux
-        run: |
-          echo "BASE_IMAGE=quay.io/pypa/musllinux_1_2_${{ env.ARCH }}" >> $GITHUB_ENV
-        if: matrix.base_image == 'musl'
       - name: Build and push ${{ matrix.base_image }}-${{ env.ARCH }} docker image
         uses: docker/build-push-action@v6
         with:
-          context: docker/manylinux-builder
+          context: docker/${{ matrix.base_image }}linux-builder-${{ env.ARCH }}
+          build-contexts: scripts=docker/scripts
           cache-from: type=gha
           cache-to: type=gha,mode=max
           platforms: ${{ env.PLATFORM }}
           push: ${{ github.event_name == 'push' }}
-          build-args: |
-            base_image=${{ env.BASE_IMAGE }}
           tags: keyvidev/${{ matrix.base_image }}linux-builder-${{ env.ARCH }}

.github/workflows/rust.yml

@@ -3,8 +3,22 @@ name: Rust
 on:
   push:
     branches: [ master, release-* ]
+    paths-ignore:
+      - '.github/workflows/docs.yml'
+      - '.github/workflows/keyvi.yml'
+      - '.github/workflows/python**.yml'
+      - 'docker/**'
+      - 'doc/**'
+      - 'python/**'
   pull_request:
     branches: [master]
+    paths-ignore:
+      - '.github/workflows/docs.yml'
+      - '.github/workflows/keyvi.yml'
+      - '.github/workflows/python**.yml'
+      - 'docker/**'
+      - 'doc/**'
+      - 'python/**'
   release:
     types: [published]
   workflow_dispatch:

docker/manylinux-builder-aarch64/Dockerfile

@@ -0,0 +1,15 @@
+FROM quay.io/pypa/manylinux_2_28_aarch64@sha256:202a1466ef81720b304986cdb98a057def76135259642ff011218a4eef4ae55e
+
+RUN \
+    yum -y update && \
+    yum clean all && \
+    yum -y install bzip2-devel snappy-devel xxhash-devel libzstd-devel python3-devel openssl-devel && \
+    yum clean all;
+
+COPY --from=scripts . /scripts/
+WORKDIR /scripts
+
+RUN ./install_zlib.sh
+RUN ./install_boost.sh
+RUN ./install_cmake.sh
+RUN ./install_ccache.sh

docker/manylinux-builder-x86_64/Dockerfile

@@ -0,0 +1,15 @@
+FROM quay.io/pypa/manylinux_2_28_x86_64@sha256:ef34ac42712ea34065f9036ec72b09b465a6da9e80f94d819a67399957229296
+
+RUN \
+    yum -y update && \
+    yum clean all && \
+    yum -y install bzip2-devel snappy-devel xxhash-devel libzstd-devel python3-devel openssl-devel && \
+    yum clean all;
+
+COPY --from=scripts . /scripts/
+WORKDIR /scripts
+
+RUN ./install_zlib.sh
+RUN ./install_boost.sh
+RUN ./install_cmake.sh
+RUN ./install_ccache.sh

docker/musllinux-builder-aarch64/Dockerfile

@@ -0,0 +1,13 @@
+FROM quay.io/pypa/musllinux_1_2_aarch64@sha256:5ebf27586ed7e77f54b41a3c4cecd8e271e62b2d30917a951f2e3b80201774e8
+
+RUN \
+    apk upgrade --no-cache && \
+    apk add --no-cache procps bzip2-dev snappy-dev python3-dev zstd-dev xxhash-dev openssl-dev;
+
+COPY --from=scripts . /scripts/
+WORKDIR /scripts
+
+RUN ./install_zlib.sh
+RUN ./install_boost.sh
+RUN ./install_cmake.sh
+RUN ./install_ccache.sh

docker/musllinux-builder-x86_64/Dockerfile

@@ -0,0 +1,13 @@
+FROM quay.io/pypa/musllinux_1_2_x86_64@sha256:c5071dd790d06f34e8ef0a36310988d6a1ad77d3b743ba1495e09529145833d0
+
+RUN \
+    apk upgrade --no-cache && \
+    apk add --no-cache procps bzip2-dev snappy-dev python3-dev zstd-dev xxhash-dev openssl-dev;
+
+COPY --from=scripts . /scripts/
+WORKDIR /scripts
+
+RUN ./install_zlib.sh
+RUN ./install_boost.sh
+RUN ./install_cmake.sh
+RUN ./install_ccache.sh