Split Dockerfile into parallel build groups for GitHub Actions by hsbt · Pull Request #23 · ruby/all-ruby

hsbt · 2026-03-04T05:24:54Z

This reduces CI build time from ~3 hours (sequential) to ~30-45 minutes (parallel groups).

This reduces CI build time from ~3 hours (sequential) to ~30-45 minutes (parallel groups). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Refactors the Docker multi-stage build into multiple named “group” targets so GitHub Actions can build/cache them in parallel, then assembles a final runtime image using cached outputs to reduce CI wall-clock time.

Changes:

Split the Dockerfile into builder-buster/builder-bullseye base stages plus group-* build targets and a final aggregation stage.
Add per-target stripping/cleanup and aggregate outputs from each group into the final image.
Introduce a GitHub Actions workflow that builds each group-* target in a matrix and then builds/pushes the final image using registry-backed BuildKit cache.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 8 comments.

File	Description
Dockerfile	Introduces per-version build groups as separate stages and aggregates their artifacts into the final image.
.github/workflows/build.yml	Adds a parallelized CI build that caches each group target separately and then builds/pushes the final image.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot · 2026-03-04T05:31:30Z

 RUN echo "deb http://archive.debian.org/debian/ buster main contrib non-free" > /etc/apt/sources.list && \
    echo "deb http://archive.debian.org/debian-security/ buster/updates main contrib non-free" >> /etc/apt/sources.list && \


This stage uses archive.debian.org (Buster) and disables Acquire::Check-Valid-Until for the apt-get update here, but there is another apt-get update later in the same stage (after adding i386 + deb-src) that will still hit expired Valid-Until unless the check is also disabled/persisted. To avoid flaky/failing builds, apply Check-Valid-Until=false to the later update as well (or add an apt conf entry so it applies to all updates in this stage).

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2026-03-04T05:31:31Z

+RUN rm -rf Rakefile versions/ patch/ DIST build/*/log build/*/ruby*/ \
+      build/*/man build/*/share/man build/*/share/doc build/*/share/ri && \
+    rm -f build/*/lib/libruby-static.a build/*/bin/gcc build/*/bin/cc
+RUN find /build-all-ruby -type f \( -name ruby -o -name '*.so' \) -exec sh -c 'file $1 | grep -q "not stripped"' - '{}' \; -print0 | xargs -0 strip


The find … -print0 | xargs -0 strip pipeline can fail when no files match the file | grep -q "not stripped" filter (GNU xargs will still invoke strip with no args). Consider avoiding xargs here (e.g., use find … -exec strip … {} +) or add --no-run-if-empty/-r to xargs; also quoting the filename in the file call would be safer.

Copilot · 2026-03-04T05:31:31Z

+RUN rm -rf Rakefile versions/ patch/ DIST build/*/log build/*/ruby*/ \
+      build/*/man build/*/share/man build/*/share/doc build/*/share/ri && \
+    rm -f build/*/lib/libruby-static.a build/*/bin/gcc build/*/bin/cc
+RUN find /build-all-ruby -type f \( -name ruby -o -name '*.so' \) -exec sh -c 'file $1 | grep -q "not stripped"' - '{}' \; -print0 | xargs -0 strip


Same issue as other groups: this find … | xargs strip can invoke strip with no args if the file | grep filter selects nothing. Prefer find … -exec strip … {} + or add xargs --no-run-if-empty/-r (and quote the filename passed to file).

Copilot · 2026-03-04T05:31:31Z

+RUN rm -rf Rakefile versions/ patch/ DIST build/*/log build/*/ruby*/ \
+      build/*/man build/*/share/man build/*/share/doc build/*/share/ri && \
+    rm -f build/*/lib/libruby-static.a build/*/bin/gcc build/*/bin/cc
+RUN find /build-all-ruby -type f \( -name ruby -o -name '*.so' \) -exec sh -c 'file $1 | grep -q "not stripped"' - '{}' \; -print0 | xargs -0 strip


Same issue as other groups: if the file | grep -q "not stripped" test matches nothing, xargs may still run strip with no arguments and fail the build. Use find … -exec strip … {} + or add xargs --no-run-if-empty/-r.

Copilot · 2026-03-04T05:31:31Z

+RUN rm -rf Rakefile versions/ patch/ DIST build/*/log build/*/ruby*/ \
+      build/*/man build/*/share/man build/*/share/doc build/*/share/ri && \
+    rm -f build/*/lib/libruby-static.a build/*/bin/gcc build/*/bin/cc
+RUN find /build-all-ruby -type f \( -name ruby -o -name '*.so' \) -exec sh -c 'file $1 | grep -q "not stripped"' - '{}' \; -print0 | xargs -0 strip


Same issue as other groups: xargs strip may be executed with no operands when the preceding find prints nothing, causing the layer to fail. Prefer find … -exec strip … {} + or add xargs --no-run-if-empty/-r.

Copilot · 2026-03-04T05:31:32Z

+RUN rm -rf Rakefile versions/ patch/ DIST build/*/log build/*/ruby*/ \
+      build/*/man build/*/share/man build/*/share/doc build/*/share/ri && \
+    rm -f build/*/lib/libruby-static.a build/*/bin/gcc build/*/bin/cc
 RUN find /build-all-ruby -type f \( -name ruby -o -name '*.so' \) -exec sh -c 'file $1 | grep -q "not stripped"' - '{}' \; -print0 | xargs -0 strip


Same issue as other groups: consider avoiding … -print0 | xargs -0 strip because xargs can run strip with no args if no files are selected. Use find … -exec strip … {} + or add xargs --no-run-if-empty/-r.

Copilot · 2026-03-04T05:31:32Z

+RUN rm -rf Rakefile versions/ patch/ DIST build/*/log build/*/ruby*/ \
+      build/*/man build/*/share/man build/*/share/doc build/*/share/ri && \
+    rm -f build/*/lib/libruby-static.a build/*/bin/gcc build/*/bin/cc
+RUN find /build-all-ruby -type f \( -name ruby -o -name '*.so' \) -exec sh -c 'file $1 | grep -q "not stripped"' - '{}' \; -print0 | xargs -0 strip


Same issue as other groups: xargs strip can fail if the file | grep predicate filters everything out (xargs may still invoke strip with no inputs). Prefer find … -exec strip … {} + or add xargs --no-run-if-empty/-r.

Copilot · 2026-03-04T05:31:32Z

      gcc \
+      rdfind \
      ${system_ruby} \


rdfind is now installed in the final runtime image only to run the hardlink dedup step. If the runtime image size/attack surface matters, consider running rdfind in an intermediate build stage (after aggregating the group outputs) and then copying the resulting /build-all-ruby into the final stage, or purging rdfind after the rdfind run within the same layer.

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2026-03-04T05:33:19Z

@hsbt I've opened a new pull request, #24, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2026-03-04T05:34:16Z

@hsbt I've opened a new pull request, #25, to work on those changes. Once the pull request is ready, I'll request review from you.

…er-buster Co-authored-by: hsbt <12301+hsbt@users.noreply.github.com>

Fix expired Valid-Until bypass missing on second apt-get update in builder-buster

… image Co-authored-by: hsbt <12301+hsbt@users.noreply.github.com>

Move rdfind dedup to intermediate aggregator stage, remove from final runtime image

hsbt · 2026-03-04T05:44:12Z

Let's try to this.

Split Dockerfile into parallel build groups for GitHub Actions

31dfc6c

This reduces CI build time from ~3 hours (sequential) to ~30-45 minutes (parallel groups). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings March 4, 2026 05:24

Copilot started reviewing on behalf of hsbt March 4, 2026 05:25 View session

Rename Docker build stages and GH matrix targets

a23615f

Copilot AI reviewed Mar 4, 2026

View reviewed changes

Initial plan

1e1debd

Copilot AI mentioned this pull request Mar 4, 2026

Fix expired Valid-Until bypass missing on second apt-get update in builder-buster #24

Merged

Initial plan

663c99d

Copilot AI mentioned this pull request Mar 4, 2026

Move rdfind dedup to intermediate aggregator stage, remove from final runtime image #25

Merged

Copilot AI and others added 4 commits March 4, 2026 05:34

Fix missing Check-Valid-Until=false on second apt-get update in build…

ffe5738

…er-buster Co-authored-by: hsbt <12301+hsbt@users.noreply.github.com>

Merge pull request #24 from ruby/copilot/sub-pr-23

b98af80

Fix expired Valid-Until bypass missing on second apt-get update in builder-buster

Move rdfind dedup to intermediate aggregator stage, remove from final…

a974825

… image Co-authored-by: hsbt <12301+hsbt@users.noreply.github.com>

Merge pull request #25 from ruby/copilot/sub-pr-23-again

168e434

Move rdfind dedup to intermediate aggregator stage, remove from final runtime image

hsbt merged commit 89036eb into master Mar 4, 2026

hsbt deleted the split-image-build branch March 4, 2026 05:44

		RUN echo "deb http://archive.debian.org/debian/ buster main contrib non-free" > /etc/apt/sources.list && \
		echo "deb http://archive.debian.org/debian-security/ buster/updates main contrib non-free" >> /etc/apt/sources.list && \

Conversation

hsbt commented Mar 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

hsbt Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

hsbt Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Mar 4, 2026

Uh oh!

Copilot AI commented Mar 4, 2026

Uh oh!

hsbt commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

hsbt commented Mar 4, 2026 •

edited

Loading