fix: Restore lock file builds on main and create stable environemt

.github/workflows/base_builder.yaml

@@ -1,21 +1,23 @@
 name: Build AnalysisBase base images
 on:
   push:
-    branches:
-      - "*"
+    branches: ["main"]
     tags:
       - "v*.*.*"
+  pull_request:
+    branches: ["main"]
+  workflow_dispatch:
 
 jobs:
   docker:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@v4
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5.5.1
+        uses: docker/metadata-action@v5
         with:
           # list of Docker images to use as base name for tags
           images: |
@@ -29,26 +31,29 @@ jobs:
             type=sha
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.2.0
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
-        uses: docker/[email protected]
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Login to Harbor Container Registry
-        uses: docker/[email protected]
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
         with:
           registry: hub.opensciencegrid.org
           username: ${{ secrets.HARBOR_USERNAME }}
           password: ${{ secrets.HARBOR_PASSWORD }}
 
       - name: Test build
-        uses: docker/[email protected]
+        if: github.event_name == 'pull_request'
+        uses: docker/build-push-action@v5
         with:
           context: .
           file: docker/Dockerfile
@@ -58,10 +63,12 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
 
       - name: List built images
+        if: github.event_name == 'pull_request'
         run: docker images
 
       - name: Build and push
-        uses: docker/[email protected]
+        if: github.event_name != 'pull_request'
+        uses: docker/build-push-action@v5
         with:
           context: .
           file: docker/Dockerfile
@@ -70,6 +77,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
 
       - name: Repository Dispatch
+        if: github.event_name != 'pull_request'
         uses: peter-evans/[email protected]
         with:
           token: ${{ secrets.GITOPS_REBUILD_TRIGGER }}

.github/workflows/latest_base_builder.yaml

@@ -11,11 +11,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@v4
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5.5.1
+        uses: docker/metadata-action@v5
         with:
           # list of Docker images to use as base name for tags
           images: |
@@ -26,26 +26,26 @@ jobs:
             type=raw,value=latest
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3.0.0
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Login to Harbor Container Registry
-        uses: docker/login-action@v3.0.0
+        uses: docker/login-action@v3
         with:
           registry: hub.opensciencegrid.org
           username: ${{ secrets.HARBOR_USERNAME }}
           password: ${{ secrets.HARBOR_PASSWORD }}
 
       - name: Test build
-        uses: docker/build-push-action@v5.1.0
+        uses: docker/build-push-action@v5
         with:
           context: .
           file: docker/Dockerfile
@@ -58,7 +58,7 @@ jobs:
         run: docker images
 
       - name: Build and push
-        uses: docker/build-push-action@v5.1.0
+        uses: docker/build-push-action@v5
         with:
           context: .
           file: docker/Dockerfile

Makefile

@@ -3,18 +3,18 @@ lock:
 	docker build \
 		--file docker/Dockerfile.lockfile-builder \
 		--build-arg BASE_IMAGE=gitlab-registry.cern.ch/atlas/athena/analysisbase:25.2.2 \
-		--tag tmp/analysisbase:rel24-lockfile-builder \
+		--tag tmp/analysisbase:rel25-lockfile-builder \
 		docker
 	docker run \
 		--rm \
 		-ti \
 		--user 1000:1000 \
 		--volume $(shell pwd)/docker:/workdir \
-		tmp/analysisbase:rel24-lockfile-builder \
+		tmp/analysisbase:rel25-lockfile-builder \
 		bash -c 'bash <(curl -sL https://raw.githubusercontent.com/matthewfeickert/cvmfs-venv/v0.0.5/cvmfs-venv.sh) && \
 			. venv/bin/activate && \
-			python -m pip --no-cache-dir install --upgrade pip-tools && \
-			pip-compile --generate-hashes --output-file=requirements.lock requirements.txt && \
+			python -m pip --no-cache-dir install --upgrade uv && \
+			uv pip compile --generate-hashes --output-file=requirements.lock requirements.txt && \
 			deactivate && \
 			rm -r venv'
 

docker/Dockerfile

@@ -7,33 +7,39 @@ USER root
 
 # needed for dasklab extension.
 RUN yum install -y \
-    nodejs \
-    graphviz && \
+        nodejs \
+        graphviz && \
     yum clean all
 
 # Add Tini
 ENV TINI_VERSION=v0.19.0
 ADD --chown=atlas https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini /tini
 
 COPY --chown=atlas docker/requirements.txt /docker/
-# COPY --chown=atlas docker/requirements.lock /docker/
+COPY --chown=atlas docker/requirements.lock /docker/
 COPY --chown=atlas analysis /analysis
 WORKDIR /analysis
 
 COPY --chown=atlas /docker/entrypoint.sh /entrypoint.sh
 COPY --chown=atlas /docker/cmd.sh /cmd.sh
 
+# TODO: Remove manual fix once move to stable coffea release
 RUN echo -e '\n# Activate python virtual environment\nif [ -d /venv/bin ]; then\n    . /venv/bin/activate\nfi' >> /release_setup.sh && \
     bash <(curl -sL https://raw.githubusercontent.com/matthewfeickert/cvmfs-venv/v0.0.5/cvmfs-venv.sh) /venv && \
     chown -R atlas /venv && \
     . /release_setup.sh && \
     python -m pip --no-cache-dir install --upgrade pip setuptools wheel && \
+    sed -i '/coffea @ /d' /docker/requirements.lock && \
     python -m pip --no-cache-dir install \
-    --requirement /docker/requirements.txt && \
+        --upgrade \
+        --no-deps \
+        --require-hashes \
+        --requirement /docker/requirements.lock && \
+    python -m pip install 'coffea @ git+https://github.com/CoffeaTeam/coffea@52950d10eeb43fc912807dfea9955f8d80c85c39' && \
     chown -R atlas /venv && \
     python --version --version && \
     python -m pip list && \
-    root --version 
+    root --version
 
 RUN chmod +x /tini && \
     chmod +x /entrypoint.sh && \
@@ -46,18 +52,18 @@ RUN chmod +x /tini && \
 RUN . /release_setup.sh && \
     cd /tmp && \
     git clone \
-    --recurse-submodules \
-    --branch py_el_tool_test \
+        --recurse-submodules \
+        --branch py_el_tool_test \
     https://gitlab.cern.ch/gstark/pycolumnarprototype.git && \
     cd pycolumnarprototype && \
     cmake \
-    -S src \
-    -B build && \
+        -S src \
+        -B build && \
     cmake build -LH && \
     cmake \
-    --build build \
-    --clean-first \
-    --parallel "$(nproc --ignore=1)" && \
+        --build build \
+        --clean-first \
+        --parallel "$(nproc --ignore=1)" && \
     DESTDIR=/usr/tools cmake --install build && \
     cd /tmp && \
     rm -rf pycolumnarprototype && \

docker/Dockerfile.lockfile-builder

@@ -0,0 +1,16 @@
+ARG BASE_IMAGE=gitlab-registry.cern.ch/atlas/athena/analysisbase:25.2.2
+FROM ${BASE_IMAGE} as base
+
+SHELL [ "/bin/bash", "-c" ]
+
+USER root
+
+RUN printf '\n# Activate python virtual environment\nif [ -d /venv/bin ]; then\n    . /venv/bin/activate\nfi\n' >> /release_setup.sh && \
+    bash <(curl -sL https://raw.githubusercontent.com/matthewfeickert/cvmfs-venv/v0.0.5/cvmfs-venv.sh) /venv && \
+    chown -R atlas /venv && \
+    . /release_setup.sh && \
+    python -m pip --no-cache-dir install --upgrade pip setuptools wheel && \
+    python -m pip --no-cache-dir install --upgrade uv && \
+    chown -R atlas /venv
+
+USER atlas