CI: Refresh Docker apt Version Pins & Align CTest PR Mode by xsscx · Pull Request #2201 · InternationalColorConsortium/iccDEV

xsscx · 2026-08-20T14:53:09Z

PR Summary

Checklist

Legal Requirements

All official software projects hosted by the International Color Consoritum (ICC)
follows the open source software best practice policies. The International Color Consoritum IP policy governs ICC specification development and contributions to ICC open source software. Software contributions are also covered by the Contributor License Agreement (CLA).

Contributor License Agreements

Developers who wish to contribute code to be considered for inclusion
in ICC software must first complete a Contributor License Agreement
(CLA).

There is no cost or membership requirement to sign the ICC Contributor License Agreement (CLA). Please note that this is different from membership in the International Color Consortium (ICC). If your organization relies on our projects, please become a member. Membership dues are an essential source of funding and investment for these projects.

If you are an individual writing the code on your own time and you are SURE you are the sole owner of any intellectual property you contribute, you can sign the CLA as an individual contributor.
If you are writing the code as part of your job, or if there is any possibility that your employer might think they own any intellectual property you create, then you should use the Corporate Contributor Licence Agreement

License

ICC software is licensed under the BSD 3-Clause "New" or "Revised" License. Contributions to ICC software projects should abide by that license unless otherwised specified or approved by the ICC.

Copyright Notices

All new source files must begin with the ICC Copyright notice and include or reference the BSD 3-Clause "New" or "Revised" License.

INTELLECTUAL PROPERTY & PATENTS

Participation in ICC's development activities is subject to ICC's Patent Policy.

Maintainer Review Required

If you have questions, contact a listed Maintainer.

ci-pr-action.yml hardcoded ctest_mode: fast when calling the ci-regression-checks reusable workflow (ci-iccdev-tool-tests.yml), regardless of ci_scope or ctest_recent_limit. This silently excluded slow/calculator-labeled CTest suites from every PR gate run, while a maintainer's manual full-mode ci-regression-checks dispatch could still fail on tests the PR gate never exercised, producing a false Merge Ready label. Thread a new ctest_mode value through detect-src -> validate-inputs -> tool-tests, defaulting to full (matching the existing ctest_recent_limit=0 run-everything default for ordinary PR events) and narrowing to fast only for the explicit fast-lane scope.

Dockerfile and Dockerfile.ci-regression pin exact apt-get install package=version strings against the digest-pinned Ubuntu base image. The Ubuntu 26.04 apt archive republished point releases for build-essential, curl, and libtiff/libtiff-dev/libtiff-tools/libtiff6 since these pins were last set, so apt-get install failed with exit code 100 (Docker (ubuntu) and Docker (regression) jobs, run 32279991997). Regenerate the pins against apt-cache policy for the same base image digest and update only the packages that drifted: build-essential 12.12ubuntu2 -> 12.12ubuntu2.26.04.2 libtiff-dev/libtiff-tools/libtiff6 4.7.0-3ubuntu4 -> 4.7.0-3ubuntu5 curl (regression only) 8.18.0-1ubuntu2.3 -> 8.18.0-1ubuntu2.4 Verified both Dockerfile and Dockerfile.ci-regression build cleanly locally against the pinned base digest with the refreshed pins. Document the failure mode and the local diagnose/fix recipe in docs/regression-container.md so other maintainers can resolve future apt version drift without re-discovering the apt-cache policy technique.

Copilot

Pull request overview

Updates maintainer CI/container infrastructure to keep Ubuntu 26.04 Docker builds reproducible as apt package revisions drift, and aligns ci-pr-action CTest selection defaults with the reusable CTest gate.

Changes:

Refresh pinned apt-get install package=version entries in Dockerfile and Dockerfile.ci-regression (e.g., build-essential, curl, libtiff*).
Document how to diagnose and repair apt pin drift that breaks ci-docker builds.
Extend ci-pr-action to propagate a ctest_mode setting and default to full coverage outside fast-lane.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
`docs/regression-container.md`	Adds guidance for diagnosing/fixing apt pin drift causing `ci-docker` failures.
`Dockerfile.ci-regression`	Updates pinned apt package versions for the regression CI image build.
`Dockerfile`	Updates pinned apt package versions for the build container image.
`.github/workflows/ci-pr-action.yml`	Adds/propagates `ctest_mode` and adjusts defaults to align CTest scope.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/ci-pr-action.yml:187

This new CTest mode alignment is added in the same Bash step, but the run block still omits the workflow credential-hygiene line git config --global credential.helper "" required by the repository’s workflow governance. Add it near the top of the step so Git credentials are cleared before any subsequent logic.

          # Default to the same full CTest surface ci-regression-checks runs,
          # so a scope resolving ctest_recent_limit=0 ("run all selected
          # tests") does not silently diverge by excluding slow/calculator
          # labels. Only the fast-lane scope narrows this below.
          ctest_mode=full

docs/regression-container.md:454

The suggested docker run ... bash -c helper doesn’t enable set -e/pipefail, so an apt-get update failure can be masked and still print stale/empty candidate versions. Add set -euo pipefail inside the container snippet so drift detection fails fast on errors.

docker run --rm ubuntu:26.04@sha256:<digest> bash -c '
  apt-get update -qq
  for p in PKGS; do
    v=$(apt-cache policy "$p" | awk "/Candidate:/{print \$2}")
    echo "$p=$v"

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Note

This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.

xsscx · 2026-08-20T15:34:22Z

PR Author Note

2026-08-20 15:30:59 UTC

ci-risk-analysis

Error: Process completed with exit code 1.

Maintainer Workflow Notes

That Workflow Failure is correct & expected, by design.
My PR has Trusted Code Updates, and the ci-risk-analysis workflow correctly flags the issue.
Maintainer Steps are to next allow the PR SHA Commit to be in the Trusted-Checkout
All subsequent Trusted Checkouts return to using master:HEAD.

xsscx · 2026-08-20T16:20:01Z

Elapsed Time Sample

2026-08-20 16:19:27 UTC

CTest Full

xsscx · 2026-08-20T16:46:43Z

Post Merge Report

2026-08-20 16:46:00 UTC

Expected

gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable. Example:
  env:
    GH_TOKEN: ${{ github.token }}
Error: Process completed with exit code 4.
##[debug]Finishing: Build PR list

Note: there will be some breaking changes from this PR to Resolve

xsscx added 2 commits August 20, 2026 10:19

xsscx added this to the v2.3.2.4 milestone Aug 20, 2026

xsscx self-assigned this Aug 20, 2026

xsscx requested review from ChrisCoxArt, colourbill-ctrl, dwtza and maxderhak as code owners August 20, 2026 14:53

xsscx requested a lite review from Copilot August 20, 2026 14:53

This was linked to issues Aug 20, 2026

CI: CTest align ci-pr-action & ci-regression-checks #2189

Closed

CI: iccMCP Log: Field 'lifespan' has an incomplete definition #2195

Closed

github-actions Bot added the pending CI checks still running label Aug 20, 2026

Copilot AI reviewed Aug 20, 2026

View reviewed changes

Comment thread docs/regression-container.md Outdated

Comment thread Dockerfile.ci-regression

xsscx changed the title ~~CI: Bump Docker SHA Pins & Modify CTest PR Default Config~~ CI: Refresh Docker apt Version Pins & Align CTest PR Mode Aug 20, 2026

xsscx requested a lite review from Copilot August 20, 2026 15:03

Copilot AI reviewed Aug 20, 2026

View reviewed changes

xsscx requested a lite review from Copilot August 20, 2026 15:11

Copilot AI reviewed Aug 20, 2026

xsscx force-pushed the ci-qa-pr-docker-testing branch from 28dea57 to 9e9e7c5 Compare August 20, 2026 15:25

github-actions Bot added Sanitizers ASAN, UBSAN, or sanitizer test infrastructure Release Release, CPack, installer, or artifact publishing Unix Linux, macOS, Bash, or POSIX shell scope Labels Label taxonomy, labeler config, or label automation labels Aug 20, 2026

xsscx linked an issue Aug 20, 2026 that may be closed by this pull request

CI Report: unset GITHUB_TOKEN || true #2202

Closed

ci: enforce workflow Bash prologue policy

e15ba5d

xsscx force-pushed the ci-qa-pr-docker-testing branch from 9e9e7c5 to e15ba5d Compare August 20, 2026 15:32

xsscx temporarily deployed to ghcr-publish August 20, 2026 15:39 — with GitHub Actions Inactive

xsscx had a problem deploying to ghcr-publish August 20, 2026 15:51 — with GitHub Actions Error

xsscx temporarily deployed to ghcr-publish August 20, 2026 16:09 — with GitHub Actions Inactive

xsscx added Copilot Copilot use indicated by Maintainer Codex Codex use indicated by Maintainer labels Aug 20, 2026

xsscx had a problem deploying to ghcr-publish August 20, 2026 16:21 — with GitHub Actions Error

xsscx merged commit 029dc30 into master Aug 20, 2026
48 of 51 checks passed

xsscx mentioned this pull request Aug 20, 2026

CI: Post Merge Report | breaking change to Label Workflow #2203

Closed

Copilot started reviewing on behalf of xsscx August 20, 2026 17:06 View session

Copilot started reviewing on behalf of xsscx August 20, 2026 17:22 View session

Copilot started reviewing on behalf of xsscx August 20, 2026 17:42 View session

Navigation Menu

Uh oh!

CI: Refresh Docker apt Version Pins & Align CTest PR Mode - #2201

CI: Refresh Docker apt Version Pins & Align CTest PR Mode#2201
xsscx merged 3 commits into
masterfrom
ci-qa-pr-docker-testing

xsscx commented Aug 20, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

xsscx commented Aug 20, 2026

Uh oh!

xsscx commented Aug 20, 2026

Uh oh!

Uh oh!

xsscx commented Aug 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

xsscx commented Aug 20, 2026

PR Summary

Checklist

Legal Requirements

Contributor License Agreements

License

Copyright Notices

INTELLECTUAL PROPERTY & PATENTS

Maintainer Review Required

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

xsscx commented Aug 20, 2026

PR Author Note

ci-risk-analysis

Maintainer Workflow Notes

Uh oh!

xsscx commented Aug 20, 2026

Elapsed Time Sample

CTest Full

Uh oh!

Uh oh!

xsscx commented Aug 20, 2026

Post Merge Report

Expected

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants