fixed push of final image and codeql sequence

Author: maureeungaro

.github/workflows/codeql.yml

@@ -54,14 +54,7 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4
-    - name: Fix Ownership
-      run: |
-        # recent versions of Git refuse to touch a repository whose on-disk owner 
-        # doesn’t match the UID that is running the command
-        # mark the workspace (and any nested path) as safe
-        git config --global --add safe.directory "$GITHUB_WORKSPACE"
-        git config --global --add safe.directory "$GITHUB_WORKSPACE"/src
-
+      
     # Add any setup steps before running the `GitHub/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`
     # or others). This is typically only required for manual builds.
@@ -92,7 +85,8 @@ jobs:
       shell: bash
       run: |
         echo "Starting manual build for CodeQL..."
-        chmod +x ./ci/build.sh
+        DOCKER_ENTRYPOINT_SOURCE_ONLY=1 . /usr/local/bin/docker-entrypoint.sh \
+        module load geant4/11.4.0 \        
         ./ci/build.sh
         echo "Manual build finished."
 

.github/workflows/docker.yml

@@ -135,6 +135,7 @@ jobs:
             UPSTREAM_REV=${{ env.UPSTREAM_REV }}
           context: .
           file: ./Dockerfile.generated
+          target: final
           platforms: ${{ matrix.platform }}
           push: true
           # Add suffix to the arch-specific image tag
@@ -145,18 +146,20 @@ jobs:
           # publishes the BuildKit cache to your container registry under that tag
           cache-to:   ${{ env.CACHE_REF }},mode=max
 
+
       # export logs from the logs-export stage in the dockerfile to the runner’s filesystem (no docker pull)
-      - name: Export logs
+      - name: Export logs (runner artifact)
         uses: docker/build-push-action@v5
         with:
+          pull: true
           context: .
           file: ./Dockerfile.generated
           target: logs-export
-          platforms: ${{ matrix.platform }}
           push: false
           cache-from: ${{ env.CACHE_REF }}
           outputs: type=local,dest=${{ runner.temp }}/artifacts/${{ matrix.logs_dir }}
 
+
       - name: Upload logs artifact
         uses: actions/upload-artifact@v4
         with:
@@ -222,7 +225,7 @@ jobs:
             echo ""
             echo "Includes:"
             if docker buildx imagetools inspect "${IMAGE}:${TAG}-amd64" >/dev/null 2>&1; then echo "- amd64"; fi
-            if docker buildx imagetools inspect "${IMAGE}:${TAG}-arm64" >/dev/null 2>&1; then echo "- arm64"; else echo "- arm64 (skipped)"; fi
+            if docker buildx imagetools inspect "${IMAGE}:${TAG}-arm64" >/dev/null 2>&1; then echo "- arm64"; else echo "no arm64. Run with --platform=linux/amd64 in arm64 CPUs"; fi
             echo ""
             echo "### Pull"
             echo '```bash'

ci/dockerfile_creator.py

@@ -16,8 +16,15 @@ def available_images() -> str:
     return ', '.join(sorted(valid_images))
 
 
+def remote_startup_dir() -> str:
+    return '/usr/local/bin'
+
 def remote_entrypoint():
-    return f'/usr/local/bin/docker-entrypoint.sh'
+    return f'{remote_startup_dir()}/docker-entrypoint.sh'
+
+def remote_entrypoint_addon():
+    return f'{remote_startup_dir()}/additional-entrycommands.sh'
+
 
 def docker_header(image: str, image_tag: str, geant4_tag: str) -> str:
     commands = f"FROM {g4_registry}:{geant4_tag}-{image}-{image_tag} as final\n"
@@ -38,7 +45,8 @@ def install_gemc(geant4_version: str, gemc_version: str) -> str:
     commands += f'     && cd /root/src \\\n'
     commands += f"     && DOCKER_ENTRYPOINT_SOURCE_ONLY=1 . {remote_entrypoint()} \\\n"
     commands += f'     && module load geant4/{geant4_version} \\\n'
-    commands += f'     &&  ./ci/build.sh \n'
+    commands += f'     &&  ./ci/build.sh  \\\n'
+    commands += f'     && echo "module load gemc" >> {remote_entrypoint_addon()} \n'
     return commands