IBM
diff --git a/‎.github/workflows/docker-multiplatform.yml‎
Lines changed: 138 additions & 2 deletions b/‎.github/workflows/docker-multiplatform.yml‎
Lines changed: 138 additions & 2 deletions
diff --git a/‎.github/workflows/docker-required.yml‎
Lines changed: 2 additions & 0 deletions b/‎.github/workflows/docker-required.yml‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎.github/workflows/docker-scan.yml‎
Lines changed: 6 additions & 0 deletions b/‎.github/workflows/docker-scan.yml‎
Lines changed: 6 additions & 0 deletions
diff --git a/‎.github/workflows/s390x-wheels.yml‎
Lines changed: 0 additions & 117 deletions b/‎.github/workflows/s390x-wheels.yml‎
Lines changed: 0 additions & 117 deletions
diff --git a/‎.gitignore‎
Lines changed: 1 addition & 0 deletions b/‎.gitignore‎
Lines changed: 1 addition & 0 deletions
@@ -28,6 +28,8 @@ on:
       - 'mcpgateway/**'
       - 'plugins/**'
       - 'pyproject.toml'
+      - 'uv.lock'
+      - 'infra/wheels/**'
       - '.github/workflows/docker-multiplatform.yml'
   pull_request:
     types: [opened, synchronize, ready_for_review]
@@ -37,6 +39,8 @@ on:
       - 'mcpgateway/**'
       - 'plugins/**'
       - 'pyproject.toml'
+      - 'uv.lock'
+      - 'infra/wheels/**'
       - '.github/workflows/docker-multiplatform.yml'
   merge_group:
     branches: ["main"]
@@ -54,11 +58,104 @@ env:
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
+  # ---------------------------------------------------------------
+  # Build the full dependency-closure wheel image for every arch, so
+  # Containerfile.lite's `ARG WHEELS_REF` default (${TARGETARCH}-latest)
+  # resolves on all four without a flag. Content-addressed by
+  # sha256(uv.lock) and pull-or-build idempotent, so unchanged deps are a
+  # cache hit. Rides the same non-PR events as the platform builds below
+  # (push/merge_group/workflow_dispatch).
+  # ---------------------------------------------------------------
+  wheels:
+    if: github.event_name != 'pull_request'
+    name: Build wheels (${{ matrix.suffix }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-24.04
+            suffix: amd64
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+            suffix: arm64
+          - platform: linux/s390x
+            runner: ubuntu-24.04-s390x
+            suffix: s390x
+          - platform: linux/ppc64le
+            runner: ubuntu-24.04-ppc64le
+            suffix: ppc64le
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 120
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+
+      - name: Compute image ref
+        id: ref
+        run: |
+          WHEELS_IMAGE_LC=$(echo "${{ env.IMAGE_NAME }}-wheels" | tr '[:upper:]' '[:lower:]')
+          LOCK_HASH=$(sha256sum uv.lock | cut -c1-16)
+          echo "image=${{ env.REGISTRY }}/${WHEELS_IMAGE_LC}:${{ matrix.suffix }}-${LOCK_HASH}" >> "${GITHUB_OUTPUT}"
+          echo "latest=${{ env.REGISTRY }}/${WHEELS_IMAGE_LC}:${{ matrix.suffix }}-latest" >> "${GITHUB_OUTPUT}"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Check for existing wheel image
+        id: check
+        run: |
+          if docker manifest inspect "${{ steps.ref.outputs.image }}" >/dev/null 2>&1; then
+            echo "Wheel image ${{ steps.ref.outputs.image }} already exists, skipping build"
+            echo "exists=true" >> "${GITHUB_OUTPUT}"
+          else
+            echo "exists=false" >> "${GITHUB_OUTPUT}"
+          fi
+
+      # Push both the lock-hash tag (exact reproducible reference) and a
+      # `latest` tag per arch (fallback for local builds and for `build`
+      # below when the lock-hash image isn't published yet).
+      - name: Build and push wheel image
+        if: steps.check.outputs.exists != 'true'
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: .
+          file: infra/wheels/Containerfile
+          platforms: ${{ matrix.platform }}
+          push: true
+          tags: |
+            ${{ steps.ref.outputs.image }}
+            ${{ steps.ref.outputs.latest }}
+          cache-from: type=gha,scope=wheels-${{ matrix.suffix }}
+          cache-to: type=gha,mode=max,scope=wheels-${{ matrix.suffix }}
+
   # ---------------------------------------------------------------
   # Build each platform in parallel
   # ---------------------------------------------------------------
   build:
-    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
+    # Waits on `wheels`: s390x/ppc64le have no live-PyPI fallback (psycopg-binary
+    # has no s390x wheels, tiktoken needs a Rust compiler the builder stage lacks
+    # to build from sdist on ppc64le), so the matching wheel image must exist
+    # before building against it. `wheels` skips the rebuild via `docker manifest
+    # inspect` when the lock hash is unchanged, so the wait is ~2-3 min in steady
+    # state; only a real dependency change pays the full build time. `always() &&
+    # needs.wheels.result != 'failure'` tolerates `wheels` being skipped entirely
+    # on PR events.
+    if: always() && needs.wheels.result != 'failure' && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
+    needs: wheels
     name: Build ${{ matrix.suffix }}
     strategy:
       fail-fast: false
@@ -124,14 +221,46 @@ jobs:
         if: github.event_name != 'pull_request' || matrix.build_on_pr
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
+      # Login is needed both for pushing the final image (push/workflow_dispatch)
+      # and for probing the wheel-image registry below.
       - name: Log in to GHCR
-        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+        if: github.event_name != 'pull_request' || matrix.build_on_pr
         uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      # Resolve WHEELS_REF explicitly for every arch so the pipeline never
+      # relies on Containerfile.lite's bare `ARG WHEELS_REF` default (which
+      # points at a GHCR tag for local-build convenience). Prefer the
+      # lock-matched tag (exact reproducible closure); if it isn't published
+      # yet (cold lock-hash, `wheels` job still running), fall back to the
+      # per-arch `latest` wheel image. If neither exists (first-ever run,
+      # before `wheels` has published anything for this arch), fall back to
+      # the literal UBI_MINIMAL default so the build doesn't depend on a
+      # GHCR tag that doesn't exist yet - Containerfile.lite's install step
+      # then falls through to a live PyPI install, compiling anything
+      # missing itself.
+      - name: Compute wheel image ref
+        if: github.event_name != 'pull_request' || matrix.build_on_pr
+        run: |
+          WHEELS_IMAGE_LC=$(echo "${{ env.IMAGE_NAME }}-wheels" | tr '[:upper:]' '[:lower:]')
+          LOCK_HASH=$(sha256sum uv.lock | cut -c1-16)
+          LOCK_TAG="${{ env.REGISTRY }}/${WHEELS_IMAGE_LC}:${{ matrix.suffix }}-${LOCK_HASH}"
+          LATEST_TAG="${{ env.REGISTRY }}/${WHEELS_IMAGE_LC}:${{ matrix.suffix }}-latest"
+          if docker manifest inspect "${LOCK_TAG}" >/dev/null 2>&1; then
+            echo "Using lock-matched wheel image: ${LOCK_TAG}"
+            echo "WHEELS_REF=${LOCK_TAG}" >> "${GITHUB_ENV}"
+          elif docker manifest inspect "${LATEST_TAG}" >/dev/null 2>&1; then
+            echo "Lock-matched wheel image not published yet; falling back to ${LATEST_TAG}"
+            echo "WHEELS_REF=${LATEST_TAG}" >> "${GITHUB_ENV}"
+          else
+            UBI_MINIMAL_DEFAULT=$(grep -m1 '^ARG UBI_MINIMAL=' Containerfile.lite | cut -d= -f2-)
+            echo "No wheel image available yet for ${{ matrix.suffix }}; falling back to ${UBI_MINIMAL_DEFAULT}, Containerfile.lite will install from PyPI"
+            echo "WHEELS_REF=${UBI_MINIMAL_DEFAULT}" >> "${GITHUB_ENV}"
+          fi
+
       - name: Extract metadata
         if: github.event_name != 'pull_request' || matrix.build_on_pr
         id: meta
@@ -149,6 +278,13 @@ jobs:
           context: .
           file: Containerfile.lite
           platforms: ${{ matrix.platform }}
+          # WHEELS_REF is always set by "Compute wheel image ref" above when
+          # this step runs (lock tag, latest tag, or UBI_MINIMAL fallback).
+          # The `|| ''` guards the case the step itself didn't run (same
+          # `if` gate skips both), so the build-arg is simply omitted and
+          # Containerfile.lite's own default applies.
+          build-args: |
+            ${{ env.WHEELS_REF && format('WHEELS_REF={0}', env.WHEELS_REF) || '' }}
 
           push: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
           load: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
 
@@ -25,6 +25,8 @@ on:
       - 'mcpgateway/**'
       - 'plugins/**'
       - 'pyproject.toml'
+      - 'uv.lock'
+      - 'infra/wheels/**'
       - '.github/workflows/docker-multiplatform.yml'
 
 permissions:
 
@@ -174,12 +174,18 @@ jobs:
           push: false
           load: true
           tags: ${{ env.IMAGE_NAME }}:fedramp-validate
+          # WHEELS_REF pinned to UBI_MINIMAL: this step overrides PYTHON_VERSION to
+          # 3.11, but the published amd64 wheel closure is built against the
+          # default PYTHON_VERSION (3.12, see infra/wheels/Containerfile), so its
+          # psycopg[c] wheel carries a cp312 tag that uv rejects under a 3.11 venv.
+          # Pinning here skips the hermetic closure and installs from PyPI instead.
           build-args: |
             ENABLE_FIPS=true
             PYTHON_VERSION=3.11
             UBI_BASE=registry.access.redhat.com/ubi9/ubi:latest
             NODEJS_IMAGE=registry.access.redhat.com/ubi9/nodejs-20:latest
             UBI_MINIMAL=registry.access.redhat.com/ubi9/ubi-minimal@sha256:6ea809bdd8164f8b2b607e38f01b14c374a15bdfbc74fcd0155161512dd4e00e
+            WHEELS_REF=registry.access.redhat.com/ubi9/ubi-minimal@sha256:6ea809bdd8164f8b2b607e38f01b14c374a15bdfbc74fcd0155161512dd4e00e
 
       - name: FedRAMP post-build compliance validation
         run: |
 
@@ -52,6 +52,7 @@ parts/
 sdist/
 var/
 wheels/
+!infra/wheels/
 *.egg-info/
 .installed.cfg
 *.egg