Move rdfind dedup to intermediate aggregator stage, remove from final runtime image

[Copilot]

rdfind was being installed in the final runtime image solely to run a one-shot hardlink dedup step, unnecessarily increasing the image's attack surface.

Changes

• New aggregator stage — based on builder-bullseye (which already has rdfind), copies /build-all-ruby/ from all six parallel build group stages and runs the dedup:

  FROM builder-bullseye AS aggregator
  COPY --from=ruby-0.x-2.0 /build-all-ruby/ /build-all-ruby/
  # ... remaining group stages ...
  RUN rdfind -makehardlinks true -makeresultsfile false /build-all-ruby

• Final stage — replaced six individual COPY --from=ruby-* /build-all-ruby/ lines with a single COPY --from=aggregator, and dropped rdfind from the apt-get install list entirely.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

This PR reduces the final runtime container image’s attack surface by moving the one-shot rdfind hardlink deduplication step out of the runtime stage into a new intermediate build stage.

Changes:

• Added a new aggregator stage (based on builder-bullseye) that merges /build-all-ruby/ outputs from the six Ruby build stages and runs rdfind once there.
• Removed rdfind from the final runtime image’s apt-get install list.
• Simplified the final runtime stage to copy /build-all-ruby/ from the aggregator stage instead of copying it repeatedly from each Ruby build stage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.