refactor Dockerfile and add base image publish workflow

0xh3rman · 0xh3rman · commit d69cf8bb615e · 2025-12-16T22:52:30.000+09:00
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
@@ -3,6 +3,9 @@ name: Docker CI
 on:
   push:
     branches: ["main"]
+  pull_request:
+    paths:
+      - "**/Dockerfile"
   workflow_dispatch:
 
 concurrency:
@@ -13,7 +16,7 @@ env:
   BASE_IMAGE_NAME: gem-android-base
   BASE_IMAGE_FULL_NAME: ghcr.io/${{ github.repository_owner }}/gem-android-base
   DOCKER_BUILDKIT: 1
-  BUNDLE_TASK: ":app:assembleUniversalRelease"
+  BUNDLE_TASK: "clean :app:bundleGoogleRelease assembleUniversalRelease"
 
 jobs:
   build_base_image:
@@ -94,33 +97,18 @@ jobs:
         env:
           DOCKER_BUILDKIT: 1
         run: |
-          docker buildx build \
-            --build-arg TAG=${{ github.ref_name }} \
-            --build-arg BASE_IMAGE=${{ env.BASE_IMAGE_FULL_NAME }} \
-            --build-arg BASE_IMAGE_TAG=${{ needs.build_base_image.outputs.image_tag }} \
-            --build-arg SKIP_SIGN=true \
-            --build-arg BUNDLE_TASK=${{ env.BUNDLE_TASK }} \
-            --cache-from type=gha,scope=app-image \
-            --cache-to type=gha,mode=max,scope=app-image \
-            --load \
-            --tag gem-android-app:latest \
-            --file ./reproducible/Dockerfile \
-            .
+          just build-app TAG=${{ github.ref_name }}
 
       - name: Build app inside container
         env:
           GRADLE_CACHE: ${{ runner.temp }}/gradle-cache
           MAVEN_CACHE: ${{ runner.temp }}/m2-cache
+          TAG: ${{ github.ref_name }}
         run: |
           mkdir -p "${GRADLE_CACHE}" "${MAVEN_CACHE}"
-          docker rm -f gem-android-app-build >/dev/null 2>&1 || true
-          docker run --name gem-android-app-build \
-            -e SKIP_SIGN=true \
-            -e BUNDLE_TASK="${{ env.BUNDLE_TASK }}" \
-            -v "${GRADLE_CACHE}":/root/.gradle \
-            -v "${MAVEN_CACHE}":/root/.m2 \
-            gem-android-app:latest \
-            bash -lc 'cd /root/gem-android && ./gradlew ${BUNDLE_TASK} --no-daemon --build-cache'
+          BASE_IMAGE_TAG=${{ needs.build_base_image.outputs.image_tag }} \
+            GRADLE_CACHE="${GRADLE_CACHE}" MAVEN_CACHE="${MAVEN_CACHE}" \
+            just build-app-inside
 
       - name: Extract Universal APK from Docker container
         run: |
diff --git a/.github/workflows/publish-base-image.yml b/.github/workflows/publish-base-image.yml
@@ -0,0 +1,50 @@
+name: Publish Base Image
+
+on:
+  workflow_dispatch:
+    inputs: {}
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  BASE_IMAGE_NAME: gem-android-base
+  BASE_IMAGE_FULL_NAME: ghcr.io/${{ github.repository_owner }}/gem-android-base
+  BASE_IMAGE_TAG_FILE: reproducible/base_image_tag.txt
+  DOCKER_BUILDKIT: 1
+
+jobs:
+  build_and_push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Read base image tag
+        id: base_tag
+        run: |
+          TAG=$(cat "${{ env.BASE_IMAGE_TAG_FILE }}")
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "Base image tag: ${TAG}"
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build base Docker image
+        env:
+          DOCKER_BUILDKIT: 1
+        run: docker build --pull --no-cache -t ${BASE_IMAGE_NAME} .
+
+      - name: Tag and push base Docker image
+        env:
+          BASE_TAG: ${{ steps.base_tag.outputs.tag }}
+        run: |
+          docker tag ${BASE_IMAGE_NAME} ${BASE_IMAGE_FULL_NAME}:${BASE_TAG}
+          docker tag ${BASE_IMAGE_NAME} ${BASE_IMAGE_FULL_NAME}:latest
+          docker push ${BASE_IMAGE_FULL_NAME}:${BASE_TAG}
+          docker push ${BASE_IMAGE_FULL_NAME}:latest
diff --git a/.github/workflows/verify-apk.yml b/.github/workflows/verify-apk.yml
@@ -21,9 +21,9 @@ on:
           - build
           - diff
       base_image_tag:
-        description: gem-android-base tag in GHCR (defaults to latest)
+        description: gem-android-base tag in GHCR (default: tag from reproducible/base_image_tag.txt if not provided)
         required: false
-        default: latest
+        default: ""
         type: string
 
 concurrency:
@@ -47,6 +47,12 @@ jobs:
         with:
           submodules: recursive
 
+      - name: Read base image tag (default)
+        id: base_tag
+        run: |
+          DEFAULT_TAG=$(cat reproducible/base_image_tag.txt)
+          echo "tag=${DEFAULT_TAG}" >> "$GITHUB_OUTPUT"
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -75,7 +81,7 @@ jobs:
 
       - name: Run verify_apk.py
         env:
-          VERIFY_BASE_TAG: ${{ inputs.base_image_tag }}
+          VERIFY_BASE_TAG: ${{ inputs.base_image_tag != '' && inputs.base_image_tag || steps.base_tag.outputs.tag }}
         run: |
           python3 reproducible/verify_apk.py "${{ inputs.tag }}" official.apk --stage "${{ inputs.stage }}"
 
diff --git a/Dockerfile b/Dockerfile
@@ -1,48 +1,61 @@
 # syntax=docker/dockerfile:1.4
-# This Dockerfile is used to setup the environment (JDK, SDK, NDK, just) for Android app building.
+# Pinned Android build environment on top of Gradle.
 
-FROM debian:bookworm
+ARG GRADLE_IMAGE=gradle:8.13-jdk17
+ARG CMDLINE_TOOLS_VERSION=11076708
+ARG ANDROID_API_LEVEL=35
+ARG ANDROID_BUILD_TOOLS_VERSION=35.0.0
+ARG ANDROID_NDK_VERSION=28.1.13356709
+ARG JUST_VERSION=1.45.0
+ARG JUST_TARGET=x86_64-unknown-linux-musl
+
+FROM ${GRADLE_IMAGE}
+
+USER root
+
+ARG CMDLINE_TOOLS_VERSION
+ARG ANDROID_API_LEVEL
+ARG ANDROID_BUILD_TOOLS_VERSION
+ARG ANDROID_NDK_VERSION
+ARG JUST_VERSION
+ARG JUST_TARGET
 
-ENV DEBIAN_FRONTEND=noninteractive
 ENV HOME=/root
 ENV ANDROID_HOME=/opt/android-sdk
 ENV ANDROID_SDK_ROOT=/opt/android-sdk
-ENV PATH=${ANDROID_HOME}/cmdline-tools/latest/bin:${ANDROID_HOME}/platform-tools:${PATH}
-
-RUN dpkg --add-architecture amd64
-
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt,sharing=locked \
-    apt-get update && apt-get install -y \
-    curl \
-    unzip \
-    zip \
-    git \
-    make \
-    build-essential \
-    pkg-config \
-    openjdk-17-jdk-headless \
-    libc6:amd64 \
-    zlib1g:amd64
-
-RUN curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh | bash -s -- --to /usr/local/bin
-
-RUN --mount=type=cache,target=/tmp/android-dl \
-    mkdir -p ${ANDROID_HOME}/cmdline-tools/latest && \
-    if [ ! -f /tmp/android-dl/commandlinetools-linux-11076708_latest.zip ]; then \
-        curl -o /tmp/android-dl/commandlinetools-linux-11076708_latest.zip \
-        https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip; \
-    fi && \
-    unzip -q /tmp/android-dl/commandlinetools-linux-11076708_latest.zip -d /tmp/cmdline-tools && \
-    mv /tmp/cmdline-tools/cmdline-tools/* ${ANDROID_HOME}/cmdline-tools/latest/ && \
-    rm -rf /tmp/cmdline-tools
+ENV ANDROID_SDK_URL=https://dl.google.com/android/repository/commandlinetools-linux-${CMDLINE_TOOLS_VERSION}_latest.zip
+ENV PATH=${ANDROID_HOME}/cmdline-tools/bin:${ANDROID_HOME}/platform-tools:${PATH}
+
+# Runtime deps for build-tools/aapt2.
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+    libc6 \
+    libstdc++6 \
+    zlib1g \
+    libtinfo6 \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install just from a pinned release.
+RUN curl -fL \
+        "https://github.com/casey/just/releases/download/${JUST_VERSION}/just-${JUST_VERSION}-${JUST_TARGET}.tar.gz" \
+        -o /tmp/just.tar.gz && \
+    tar -xzf /tmp/just.tar.gz -C /tmp && \
+    mv /tmp/just /usr/local/bin/just && \
+    rm -rf /tmp/just*
+
+RUN mkdir -p "${ANDROID_HOME}" /root/.android && \
+    cd "${ANDROID_HOME}" && \
+    curl -o sdk.zip "${ANDROID_SDK_URL}" && \
+    unzip -q sdk.zip && \
+    rm sdk.zip
 
 RUN --mount=type=cache,target=/root/.android \
-    yes | ${ANDROID_HOME}/cmdline-tools/latest/bin/sdkmanager --licenses && \
-    ${ANDROID_HOME}/cmdline-tools/latest/bin/sdkmanager \
+    yes | ${ANDROID_HOME}/cmdline-tools/bin/sdkmanager --sdk_root=${ANDROID_HOME} --licenses && \
+    ${ANDROID_HOME}/cmdline-tools/bin/sdkmanager --sdk_root=${ANDROID_HOME} \
         "platform-tools" \
-        "platforms;android-35" \
-        "build-tools;35.0.0" \
-        "ndk;28.1.13356709"
+        "platforms;android-${ANDROID_API_LEVEL}" \
+        "build-tools;${ANDROID_BUILD_TOOLS_VERSION}" \
+        "ndk;${ANDROID_NDK_VERSION}"
 
 CMD ["bash"]
diff --git a/justfile b/justfile
@@ -43,13 +43,46 @@ generate-models: install-typeshare
     @cd core && cargo run --package generate --bin generate android ../gemcore/src/main/kotlin/com/wallet/core
 
 build-base-image:
-	just --justfile reproducible/justfile build-base
+	DOCKER_BUILDKIT=1 docker build --no-cache -t gem-android-base ..
 
 TAG := env("TAG", "main")
 BUILD_MODE := env("BUILD_MODE", "")
 
 build-app:
-	just --justfile reproducible/justfile build-app TAG={{TAG}} BUNDLE_TASK="clean :app:bundleGoogleRelease assembleUniversalRelease"
+	#!/usr/bin/env bash
+	set -euo pipefail
+	base_tag=$(cat reproducible/base_image_tag.txt)
+	tag="{{TAG}}"
+	if ! docker pull ghcr.io/gemwalletcom/gem-android-base:${base_tag} >/dev/null 2>&1; then
+		echo "Base image ghcr.io/gemwalletcom/gem-android-base:${base_tag} not found; building locally..." >&2
+		DOCKER_BUILDKIT=1 DOCKER_DEFAULT_PLATFORM=linux/amd64 docker build --platform linux/amd64 -t ghcr.io/gemwalletcom/gem-android-base:${base_tag} .
+	fi
+	DOCKER_BUILDKIT=1 DOCKER_DEFAULT_PLATFORM=linux/amd64 docker build --platform linux/amd64 \
+		--build-arg TAG="${tag}" \
+		--build-arg SKIP_SIGN=true \
+		--build-arg BUNDLE_TASK="clean :app:bundleGoogleRelease assembleUniversalRelease" \
+		--build-arg BASE_IMAGE=ghcr.io/gemwalletcom/gem-android-base \
+		--build-arg BASE_IMAGE_TAG="${base_tag}" \
+		-t gem-android-app-verify \
+		-f ./reproducible/Dockerfile \
+		.
+
+build-app-inside:
+	#!/usr/bin/env bash
+	set -euo pipefail
+	TAG="{{TAG}}" just build-app
+	container_name="gem-android-app-build"
+	gradle_cache=$(mktemp -d)
+	maven_cache=$(mktemp -d)
+	trap 'rm -rf "${gradle_cache}" "${maven_cache}"; docker rm -f ${container_name} >/dev/null 2>&1 || true' EXIT
+	docker rm -f ${container_name} >/dev/null 2>&1 || true
+	DOCKER_DEFAULT_PLATFORM=linux/amd64 docker run --platform linux/amd64 --name ${container_name} \
+		-e SKIP_SIGN=true \
+		-e BUNDLE_TASK="clean :app:bundleGoogleRelease assembleUniversalRelease" \
+		-v "${gradle_cache}":/root/.gradle \
+		-v "${maven_cache}":/root/.m2 \
+		gem-android-app-verify \
+		bash -lc 'cd /root/gem-android && ./gradlew ${BUNDLE_TASK} --no-daemon --build-cache'
 
 core-upgrade:
 	@git submodule update --recursive --remote
@@ -84,4 +117,7 @@ add-verification-dependency dependency:
 		gem-android-base \
 		bash -lc './scripts/add_verification_dependency.sh "$ADDITIONAL_DEPENDENCY"'
 
+verify TAG APK:
+	python3 ./reproducible/verify_apk.py {{TAG}} {{APK}}
+
 mod core
diff --git a/reproducible/README.md b/reproducible/README.md
@@ -3,7 +3,8 @@
 This folder contains the tooling to rebuild tagged releases inside Docker and compare them to published APKs.
 
 ## Principle
-- Build inside Docker using the repo-root `Dockerfile` and `reproducible/Dockerfile`, running the release task sequence (`clean :app:bundleGoogleRelease assembleUniversalRelease`) with Gradle/Maven caches cleared each run.
+- Build inside Docker using the repo-root base image `Dockerfile` and `reproducible/Dockerfile`, running the release task sequence (`clean :app:bundleGoogleRelease assembleUniversalRelease`) with Gradle/Maven caches cleared each run.
+- Base image publishing is done by the `Publish Base Image` workflow to build/push `ghcr.io/gemwalletcom/gem-android-base:<base-tag>` (where `<base-tag>` lives in `reproducible/base_image_tag.txt`).
 - Require `local.properties` for GitHub packages; use the same base image used for releases.
 - Strip signing artifacts, patch map-id when present, then copy the official signing block onto the rebuilt APK with [apksigcopier](https://github.com/obfusk/apksigcopier) to confirm payload identity without exposing keys.
 - Keep outputs under `artifacts/reproducible/<tag>/` and only run diffoscope if hashes still differ after signature copy.
@@ -24,11 +25,10 @@ This folder contains the tooling to rebuild tagged releases inside Docker and co
      ```
      Or, with an exported token: `echo <github-token> | docker login ghcr.io -u <github-username> --password-stdin` (token needs `read:packages`).
 2) Run: `./verify_apk.py <git-tag-or-branch> <path-to-official-apk> [--stage all|build|diff]`. Outputs: `official.apk`, `rebuilt.apk`, `r8_patched.apk` (when needed), `rebuilt_signed.apk`, `diffoscope.html` under `artifacts/reproducible/<tag>/`.
-3) CI: trigger the `Verify APK` workflow dispatch (`.github/workflows/verify-apk.yml`) with `tag`, `official_apk_url`, optional `stage`, and optional `base_image_tag`; artifacts upload mirrors local outputs.
-4) The release pipeline publishes `gem-android-base` to GHCR as `ghcr.io/gemwalletcom/gem-android-base:<tag>` (and `:latest`). Verification defaults `base_image_tag`/`VERIFY_BASE_TAG` to the tag being verified, so it will use the matching base image unless you override it.
-5) `verify_apk.py` will `docker pull` the base image by default (set `VERIFY_PULL_BASE=false` to skip). It then reuses a local image or builds if the pull fails.
-6) Optional manual map-id patch: `./fix_pg_map_id.py <apk-in> <apk-out> <pg-map-id>`.
-7) Optional dexdump diff: `./diff_dexdump.py <official-apk> <rebuilt-apk> [--out-dir DIR] [--dexdump PATH] [--tag TAG]` to write per-dex dumps/diffs (defaults to `artifacts/reproducible/<tag>/dexdump` when `--tag` is provided).
+3) CI: trigger the `Verify APK` workflow dispatch (`.github/workflows/verify-apk.yml`) with `tag`, `official_apk_url`, optional `stage`, and optional `base_image_tag`; artifacts upload mirrors local outputs. If `base_image_tag` is empty, the workflow reads `reproducible/base_image_tag.txt`.
+4) `verify_apk.py` will `docker pull` the base image by default (set `VERIFY_PULL_BASE=false` to skip). It then reuses a local image or builds if the pull fails.
+5) Optional manual map-id patch: `./fix_pg_map_id.py <apk-in> <apk-out> <pg-map-id>`.
+6) Optional dexdump diff: `./diff_dexdump.py <official-apk> <rebuilt-apk> [--out-dir DIR] [--dexdump PATH] [--tag TAG]` to write per-dex dumps/diffs (defaults to `artifacts/reproducible/<tag>/dexdump` when `--tag` is provided).
 
 ## Known issues
 - AGP 8.13.1 (bundled R8) randomizes map-id; we patch via `fix_pg_map_id.py` and confirm payload identity by copying the official signing block (apksigcopier). Deterministic map-id support is still required for strict reproducibility.
diff --git a/reproducible/base_image_tag.txt b/reproducible/base_image_tag.txt
@@ -0,0 +1 @@
+base-2025-12-18
diff --git a/reproducible/justfile b/reproducible/justfile
diff --git a/reproducible/verify_apk.py b/reproducible/verify_apk.py
