ci: add pinned-packages drift detection after docker builds

After each Docker image build, extract installed packages with dpkg -l
and diff against the committed pinned-packages.txt files. Fails CI if
Dockerfile changes cause package drift without regenerating the pinned
lists.

This catches the scenario where someone modifies a Dockerfile (e.g.,
adds a new apt package or updates the base image) but forgets to run
build-image.sh to regenerate pinned-packages.txt.

Author: kvinwang

.github/workflows/docker-build-check.yml

@@ -43,7 +43,7 @@ jobs:
           fi
           echo "All shared build scripts are in sync."
 
-  kms:
+  gateway:
     runs-on: ubuntu-latest
     needs: check-shared-scripts
     steps:
@@ -52,24 +52,40 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Build KMS Docker image
+      - name: Build Gateway Docker image
         uses: docker/build-push-action@v5
         with:
-          context: kms/dstack-app/builder
+          context: gateway/dstack-app/builder
           push: false
-          platforms: linux/amd64
+          load: true
+          tags: dstack-gateway-check:latest
           provenance: false
           build-args: |
             DSTACK_REV=${{ github.event.pull_request.head.sha || github.sha }}
             DSTACK_SRC_URL=${{ github.server_url }}/${{ github.repository }}
 
-      - name: Build KMS contracts
+      - name: Verify pinned packages
         run: |
-          cd kms/auth-eth
-          npm ci
-          npx hardhat compile
+          build/shared/verify-pinned-packages.sh dstack-gateway-check:latest \
+            gateway/dstack-app/builder/shared/pinned-packages.txt
 
-  gateway:
+      - name: Build gateway-builder target
+        run: |
+          docker buildx build \
+            --load \
+            --target gateway-builder \
+            --tag gateway-builder-check:latest \
+            --provenance=false \
+            --build-arg "DSTACK_REV=${{ github.event.pull_request.head.sha || github.sha }}" \
+            --build-arg "DSTACK_SRC_URL=${{ github.server_url }}/${{ github.repository }}" \
+            gateway/dstack-app/builder
+
+      - name: Verify builder pinned packages
+        run: |
+          build/shared/verify-pinned-packages.sh gateway-builder-check:latest \
+            gateway/dstack-app/builder/shared/builder-pinned-packages.txt
+
+  kms:
     runs-on: ubuntu-latest
     needs: check-shared-scripts
     steps:
@@ -78,17 +94,45 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Build Gateway Docker image
+      - name: Build KMS Docker image
         uses: docker/build-push-action@v5
         with:
-          context: gateway/dstack-app/builder
+          context: kms/dstack-app/builder
           push: false
-          platforms: linux/amd64
+          load: true
+          tags: dstack-kms-check:latest
           provenance: false
           build-args: |
             DSTACK_REV=${{ github.event.pull_request.head.sha || github.sha }}
             DSTACK_SRC_URL=${{ github.server_url }}/${{ github.repository }}
 
+      - name: Verify pinned packages (qemu stage)
+        run: |
+          build/shared/verify-pinned-packages.sh dstack-kms-check:latest \
+            kms/dstack-app/builder/shared/qemu-pinned-packages.txt
+
+      - name: Build kms-builder target
+        run: |
+          docker buildx build \
+            --load \
+            --target kms-builder \
+            --tag kms-builder-check:latest \
+            --provenance=false \
+            --build-arg "DSTACK_REV=${{ github.event.pull_request.head.sha || github.sha }}" \
+            --build-arg "DSTACK_SRC_URL=${{ github.server_url }}/${{ github.repository }}" \
+            kms/dstack-app/builder
+
+      - name: Verify builder pinned packages
+        run: |
+          build/shared/verify-pinned-packages.sh kms-builder-check:latest \
+            kms/dstack-app/builder/shared/builder-pinned-packages.txt
+
+      - name: Build KMS contracts
+        run: |
+          cd kms/auth-eth
+          npm ci
+          npx hardhat compile
+
   verifier:
     runs-on: ubuntu-latest
     needs: check-shared-scripts
@@ -104,8 +148,48 @@ jobs:
           context: verifier
           file: verifier/builder/Dockerfile
           push: false
-          platforms: linux/amd64
+          load: true
+          tags: dstack-verifier-check:latest
           provenance: false
           build-args: |
             DSTACK_REV=${{ github.event.pull_request.head.sha || github.sha }}
             DSTACK_SRC_URL=${{ github.server_url }}/${{ github.repository }}
+
+      - name: Verify pinned packages (runtime)
+        run: |
+          build/shared/verify-pinned-packages.sh dstack-verifier-check:latest \
+            verifier/builder/shared/pinned-packages.txt
+
+      - name: Build verifier-builder target
+        run: |
+          docker buildx build \
+            --load \
+            --target verifier-builder \
+            --tag verifier-builder-check:latest \
+            --provenance=false \
+            --file verifier/builder/Dockerfile \
+            --build-arg "DSTACK_REV=${{ github.event.pull_request.head.sha || github.sha }}" \
+            --build-arg "DSTACK_SRC_URL=${{ github.server_url }}/${{ github.repository }}" \
+            verifier
+
+      - name: Verify builder pinned packages
+        run: |
+          build/shared/verify-pinned-packages.sh verifier-builder-check:latest \
+            verifier/builder/shared/builder-pinned-packages.txt
+
+      - name: Build acpi-builder target
+        run: |
+          docker buildx build \
+            --load \
+            --target acpi-builder \
+            --tag verifier-acpi-check:latest \
+            --provenance=false \
+            --file verifier/builder/Dockerfile \
+            --build-arg "DSTACK_REV=${{ github.event.pull_request.head.sha || github.sha }}" \
+            --build-arg "DSTACK_SRC_URL=${{ github.server_url }}/${{ github.repository }}" \
+            verifier
+
+      - name: Verify qemu pinned packages
+        run: |
+          build/shared/verify-pinned-packages.sh verifier-acpi-check:latest \
+            verifier/builder/shared/qemu-pinned-packages.txt

build/shared/verify-pinned-packages.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+
+# SPDX-FileCopyrightText: © 2025 Phala Network <dstack@phala.network>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Verify that installed packages in a Docker image match the committed
+# pinned-packages file. Detects when Dockerfile changes cause package
+# drift without regenerating the pinned-packages list.
+#
+# Usage: verify-pinned-packages.sh <image> <pinned-packages-file>
+
+set -euo pipefail
+
+IMAGE=$1
+PKG_FILE=$2
+
+if [ -z "$IMAGE" ] || [ -z "$PKG_FILE" ]; then
+    echo "Usage: $0 <image> <pinned-packages-file>" >&2
+    exit 1
+fi
+
+ACTUAL=$(docker run --rm --entrypoint bash "$IMAGE" \
+    -c "dpkg -l | grep '^ii' | awk '{print \$2\"=\"\$3}' | sort")
+
+EXPECTED=$(sort "$PKG_FILE")
+
+if [ "$ACTUAL" = "$EXPECTED" ]; then
+    echo "OK: packages in $IMAGE match $PKG_FILE"
+    exit 0
+fi
+
+echo "ERROR: packages in $IMAGE differ from $PKG_FILE" >&2
+echo "" >&2
+diff --unified <(echo "$EXPECTED") <(echo "$ACTUAL") >&2 || true
+echo "" >&2
+echo "Regenerate pinned packages by running the service's build-image.sh" >&2
+exit 1