ci: testing some dockerfile validation and visualization

[nicklasl]

Summary

Adds CI tooling to track and validate Dockerfile build stage dependencies. The tool parses
multi-stage Dockerfiles, performs topological validation, and posts informational reports on
PRs when dependencies change.

Changes

New files

• tools/dockerfile-deps.py: Python script that:

  • Parses multi-stage Dockerfile to extract build stage dependencies
  • Tracks both stage-to-stage deps (FROM, COPY --from) and file deps (COPY/ADD)
  • Performs topological sort to detect circular dependencies
  • Generates color-coded Mermaid dependency graphs
  • Validates against source of truth
  • Outputs markdown reports for GitHub Actions

• .github/workflows/dockerfile-deps.yml: CI workflow that:

  • On main: generates source of truth and uploads as GitHub artifact (90-day retention)
  • On PRs: downloads artifact from main, validates changes, posts informational comment
  • Never blocks PRs - purely informational

Modified files

• .gitignore: Added .dockerfile-deps.json (generated artifact, not committed)

How it works

1. When PRs modify the Dockerfile, CI downloads the latest dependency snapshot from main
2. Validates current PR's dependencies against the snapshot
3. Posts a comment showing what changed (if anything)
4. When merged to main, new snapshot is generated and stored for future PRs

Test plan

• Create PR with workflow changes
• Merge to main to generate initial artifact
• Test PR validation by modifying Dockerfile
• Verify informational comment appears

[nicklasl]

This is all pretty and neat but why do we need it? 😸