ENH: Dynamically resolve dockcross image tags from ITKPythonPackage

The pre-pull step was hardcoding v5.4.x image tags, but modules using
v6.0b02 defaults pull different images (20260203-3dfb3ff for x64,
2025.08.12-1 for aarch64). The pre-pull cached the wrong image and
the actual build script still hit Docker Hub without caching.

Fetch dockcross-manylinux-set-vars.sh from the same ITKPythonPackage
tag the build will use, then source it to get the correct IMAGE_TAG
and CONTAINER_SOURCE. This ensures the pre-pull step always caches
exactly the image the build script will need.

Also add v6.0b02 image tags to the GHCR mirror workflow.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hjmjohnson

.github/workflows/build-test-package-python.yml

@@ -86,32 +86,42 @@ jobs:
 
     - name: 'Pre-pull dockcross image'
       run: |
+        # Resolve the image tag dynamically from the ITKPythonPackage build scripts
+        # so it matches exactly what the build step will pull.
+        IPP_TAG=${{ inputs.itk-python-package-tag }}
+        IPP_TAG=${IPP_TAG:=main}
+        IPP_ORG=${{ inputs.itk-python-package-org }}
+        IPP_ORG=${IPP_ORG:=InsightSoftwareConsortium}
+
         MANYLINUX_PLATFORM=${{ matrix.manylinux-platform }}
-        MANYLINUX_VERSION=$(echo ${MANYLINUX_PLATFORM} | cut -d '-' -f 1)
-        TARGET_ARCH=$(echo ${MANYLINUX_PLATFORM} | cut -d '-' -f 2)
-        if [[ ${MANYLINUX_VERSION} == _2_28 && ${TARGET_ARCH} == x64 ]]; then
-          IMAGE_TAG="20240304-9e57d2b"
-        elif [[ ${MANYLINUX_VERSION} == 2014 ]]; then
-          IMAGE_TAG="20240304-9e57d2b"
-        else
-          echo "Unknown manylinux platform ${MANYLINUX_PLATFORM}, skipping pre-pull"
+        export MANYLINUX_VERSION=$(echo ${MANYLINUX_PLATFORM} | cut -d '-' -f 1)
+        export TARGET_ARCH=$(echo ${MANYLINUX_PLATFORM} | cut -d '-' -f 2)
+
+        VARS_URL="https://raw.githubusercontent.com/${IPP_ORG}/ITKPythonPackage/${IPP_TAG}/scripts/dockcross-manylinux-set-vars.sh"
+        echo "Fetching image tags from ${VARS_URL}"
+        curl -fsSL "${VARS_URL}" -o /tmp/set-vars.sh || { echo "Could not fetch set-vars.sh, skipping pre-pull"; exit 0; }
+        source /tmp/set-vars.sh
+
+        if [[ -z ${CONTAINER_SOURCE} ]]; then
+          echo "Could not determine container source, skipping pre-pull"
           exit 0
         fi
-        IMAGE="dockcross/manylinux${MANYLINUX_VERSION}-${TARGET_ARCH}:${IMAGE_TAG}"
+
+        # Build the GHCR mirror name
         GHCR_IMAGE="ghcr.io/insightsoftwareconsortium/dockcross-manylinux${MANYLINUX_VERSION}-${TARGET_ARCH}:${IMAGE_TAG}"
-        echo "Pre-pulling ${GHCR_IMAGE} (mirror of docker.io/${IMAGE})"
+        echo "Pre-pulling ${GHCR_IMAGE} (mirror of ${CONTAINER_SOURCE})"
         for attempt in 1 2 3; do
           if docker pull "${GHCR_IMAGE}" 2>/dev/null; then
-            docker tag "${GHCR_IMAGE}" "docker.io/${IMAGE}"
+            docker tag "${GHCR_IMAGE}" "${CONTAINER_SOURCE}"
             echo "Successfully pulled from GHCR mirror"
             exit 0
           fi
-          echo "GHCR pull attempt ${attempt} failed, trying Docker Hub..."
-          if docker pull "docker.io/${IMAGE}"; then
-            echo "Successfully pulled from Docker Hub"
+          echo "GHCR pull attempt ${attempt} failed, trying upstream ${CONTAINER_SOURCE}..."
+          if docker pull "${CONTAINER_SOURCE}"; then
+            echo "Successfully pulled from upstream"
             exit 0
           fi
-          echo "Docker Hub pull attempt ${attempt} failed, retrying in 15s..."
+          echo "Upstream pull attempt ${attempt} failed, retrying in 15s..."
           sleep 15
         done
         echo "WARNING: All pull attempts failed, build script will retry"
@@ -214,18 +224,35 @@ jobs:
 
     - name: 'Pre-pull manylinux aarch64 image'
       run: |
-        IMAGE_TAG="2024-03-25-9206bd9"
-        IMAGE="quay.io/pypa/manylinux_2_28_aarch64:${IMAGE_TAG}"
+        # Resolve the image tag dynamically from the ITKPythonPackage build scripts
+        IPP_TAG=${{ inputs.itk-python-package-tag }}
+        IPP_TAG=${IPP_TAG:=main}
+        IPP_ORG=${{ inputs.itk-python-package-org }}
+        IPP_ORG=${IPP_ORG:=InsightSoftwareConsortium}
+
+        export MANYLINUX_VERSION="_2_28"
+        export TARGET_ARCH="aarch64"
+
+        VARS_URL="https://raw.githubusercontent.com/${IPP_ORG}/ITKPythonPackage/${IPP_TAG}/scripts/dockcross-manylinux-set-vars.sh"
+        echo "Fetching image tags from ${VARS_URL}"
+        curl -fsSL "${VARS_URL}" -o /tmp/set-vars.sh || { echo "Could not fetch set-vars.sh, skipping pre-pull"; exit 0; }
+        source /tmp/set-vars.sh
+
+        if [[ -z ${CONTAINER_SOURCE} ]]; then
+          echo "Could not determine container source, skipping pre-pull"
+          exit 0
+        fi
+
         GHCR_IMAGE="ghcr.io/insightsoftwareconsortium/dockcross-manylinux_2_28-aarch64:${IMAGE_TAG}"
-        echo "Pre-pulling ${GHCR_IMAGE} (mirror of ${IMAGE})"
+        echo "Pre-pulling ${GHCR_IMAGE} (mirror of ${CONTAINER_SOURCE})"
         for attempt in 1 2 3; do
           if docker pull "${GHCR_IMAGE}" 2>/dev/null; then
-            docker tag "${GHCR_IMAGE}" "${IMAGE}"
+            docker tag "${GHCR_IMAGE}" "${CONTAINER_SOURCE}"
             echo "Successfully pulled from GHCR mirror"
             exit 0
           fi
           echo "GHCR pull attempt ${attempt} failed, trying upstream..."
-          if docker pull "${IMAGE}"; then
+          if docker pull "${CONTAINER_SOURCE}"; then
             echo "Successfully pulled from upstream"
             exit 0
           fi

.github/workflows/mirror-dockcross-images.yml

@@ -17,12 +17,18 @@ jobs:
     strategy:
       matrix:
         include:
+          # v5.4.x image tags
           - source: docker.io/dockcross/manylinux_2_28-x64:20240304-9e57d2b
             target: dockcross-manylinux_2_28-x64:20240304-9e57d2b
           - source: docker.io/dockcross/manylinux2014-x64:20240304-9e57d2b
             target: dockcross-manylinux2014-x64:20240304-9e57d2b
           - source: quay.io/pypa/manylinux_2_28_aarch64:2024-03-25-9206bd9
             target: dockcross-manylinux_2_28-aarch64:2024-03-25-9206bd9
+          # v6.0b02 image tags
+          - source: docker.io/dockcross/manylinux_2_28-x64:20260203-3dfb3ff
+            target: dockcross-manylinux_2_28-x64:20260203-3dfb3ff
+          - source: quay.io/pypa/manylinux_2_28_aarch64:2025.08.12-1
+            target: dockcross-manylinux_2_28-aarch64:2025.08.12-1
 
     steps:
     - name: Log in to GHCR