Install the Python formatter in the build image (#8286) by hannes-ucsc · Pull Request #8287 · DataBiosphere/azul

hannes-ucsc · 2026-09-05T23:20:51Z

Linked issues: #8286

Checklist

Author

¹ when the issue title describes a problem, the corresponding PR
title is Fix: followed by the issue title

Author (partiality)

Added p tag to titles of partial commits
This PR is labeled partial _{or completely resolves all linked issues}
This PR partially resolves each of the linked issues _{or does not have the partial label}

Author (reindex)

Added r tag to commit title _{or the changes introduced by this PR will not require reindexing of any deployment}
This PR is labeled reindex:dev _{or the changes introduced by it will not require reindexing of dev}
This PR is labeled reindex:anvildev _{or the changes introduced by it will not require reindexing of anvildev}
This PR is labeled reindex:anvilprod _{or the changes introduced by it will not require reindexing of anvilprod}
This PR is labeled reindex:prod _{or the changes introduced by it will not require reindexing of prod}
This PR is labeled reindex:partial and its description documents the specific reindexing procedure for dev, anvildev, anvilprod and prod _{or requires a full reindex or carries none of the labels reindex:dev, reindex:anvildev, reindex:anvilprod and reindex:prod}

Author (mirror)

This PR is labeled mirror:dev _{or the changes introduced by it will not require mirroring of dev}
This PR is labeled mirror:anvildev _{or the changes introduced by it will not require mirroring of anvildev}
This PR is labeled mirror:anvilprod _{or the changes introduced by it will not require mirroring of anvilprod}
This PR is labeled mirror:prod _{or the changes introduced by it will not require mirroring of prod}
This PR is labeled mirror:partial and its description documents the specific mirroring procedure for dev, anvildev, anvilprod and prod _{or requires a full mirroring or carries none of the labels mirror:dev, mirror:anvildev, mirror:anvilprod and mirror:prod}

Author (API changes)

This PR and its linked issues are labeled API _{or this PR does not modify a REST API}
Added a (A) tag to commit title for backwards (in)compatible changes _{or this PR does not modify a REST API}
Updated REST API version number in app.py _{or this PR does not modify a REST API}

Author (upgrading deployments)

Ran make docker_images.json and committed the resulting changes _{or this PR does not modify azul_docker_images, or any other variables referenced in the definition of that variable}
Documented upgrading of deployments in UPGRADING.rst _{or this PR does not require upgrading deployments}
Added u tag to commit title _{or this PR does not require upgrading deployments}
This PR is labeled upgrade _{or does not require upgrading deployments}
This PR is labeled deploy:shared _{or does not modify docker_images.json, and does not require deploying the shared component for any other reason}
This PR is labeled deploy:gitlab _{or does not require deploying the gitlab component}
This PR is labeled deploy:runner _{or does not require deploying the runner image}

Author (hotfixes)

Added F tag to main commit title _{or this PR does not include permanent fix for a temporary hotfix}
Reverted the temporary hotfixes for any linked issues _{or the none of the stable branches (anvilprod and prod) have temporary hotfixes for any of the issues linked to this PR}

Author (before every review)

Rebased PR branch on develop, squashed fixups from prior reviews
Ran make requirements_update _{or this PR does not modify pyproject.toml}
Added R tag to commit title _{or this PR does not modify uv.lock}
This PR is labeled reqs _{or does not modify uv.lock}
make integration_test passes in personal deployment _{or this PR does not modify functionality that could affect the IT outcome}
PR is awaiting requested review from a peer
Status of PR is Review requested
PR is assigned to only the peer and the author

Peer reviewer (after approval)

Note that after requesting changes, the PR must be assigned to only the author.

Actually approved the PR
PR is not a draft
PR is awaiting requested review from system administrator
Status of PR is Review requested
PR is assigned to only the system administrator and the author

System administrator (after approval)

Actually approved the PR
Labeled linked issues as demo or no demo
Commented on linked issues about demo expectations _{or all linked issues are labeled no demo}
Decided if PR can be labeled no sandbox
A comment to this PR details the completed security design review
PR title is appropriate as title of merge commit
N reviews label is accurate
Status of PR is Approved
PR is assigned to only the operator and the author

Operator

Checked reindex:… labels and r commit title tag
Checked mirror:… labels
Checked that demo expectations are clear _{or all linked issues are labeled no demo}
Squashed PR branch and rebased onto develop
Sanity-checked history
Pushed PR branch to GitHub

Operator (deploy `.shared` and `.gitlab` components)

Ran _select dev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unused _{or this PR is not labeled deploy:shared}
Ran _select dev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab apply(an error from _login_docker_gitlab is benign if the instance was stopped for backup) _{or this PR is not labeled deploy:gitlab}
Ran _select anvildev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unused _{or this PR is not labeled deploy:shared}
Ran _select anvildev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab apply(an error from _login_docker_gitlab is benign if the instance was stopped for backup) _{or this PR is not labeled deploy:gitlab}
Checked the items in the next section _{or this PR is labeled deploy:gitlab}
PR is assigned to only the system administrator and the author _{or this PR is not labeled deploy:gitlab}

System administrator (post-deploy of `.gitlab` component)

Background migrations for dev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
Background migrations for anvildev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
PR is assigned to only the operator and the author

Operator (deploy runner image)

Ran _select dev.gitlab && make -C terraform/gitlab/runner _{or this PR is not labeled deploy:runner}
Ran _select anvildev.gitlab && make -C terraform/gitlab/runner _{or this PR is not labeled deploy:runner}

Operator (sandbox build)

Operator (merge the branch)

All status checks passed and the PR is mergeable
The title of the merge commit starts with the title of this PR
Added PR # reference to merge commit title
Collected commit title tags in merge commit title _{but only included p if the PR is also labeled partial}
Pushed merge commit to GitHub
Status of PR is Merged lower
Status of blocked issues is Triage _{or no issues are blocked on the linked issues}

Operator (main build)

Operator (reindex)

Operator (mirroring)

Started mirroring in dev _{or this PR is not labelled mirror:dev}
Started mirroring in anvildev _{or this PR is not labelled mirror:anvildev}
Checked for, triaged and possibly requeued messages in mirror fail queue in dev _{or this PR is not labelled mirror:dev}
Checked for, triaged and possibly requeued messages in mirror fail queue in anvildev _{or this PR is not labelled mirror:anvildev}
Emptied mirror fail queue in dev _{or this PR is not labelled mirror:dev}
Emptied mirror fail queue in anvildev _{or this PR is not labelled mirror:anvildev}

Operator

Propagated the upgrade and API labels to the next promotion PRs _{or this PR carries neither of these labels}
Propagated the deploy:shared, deploy:gitlab, deploy:runner, reindex:partial, reindex:anvilprod, reindex:prod, mirror:partial, mirror:anvilprod and mirror:prod labels to the next promotion PRs _{or this PR carries none of these labels}
Propagated any specific instructions related to the deploy:shared, deploy:gitlab, deploy:runner, reindex:partial, reindex:anvilprod, reindex:prod, mirror:partial, mirror:anvilprod and mirror:prod labels, from the description of this PR to that of the next promotion PRs _{or this PR carries none of these labels}
PR is assigned to no one

Shorthand for review comments

L line is too long
W line wrapping is wrong
Q bad quotes
F other formatting problem

codecov · 2026-09-06T00:00:13Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.79%. Comparing base (fc54279) to head (5948fb3).
⚠️ Report is 2 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #8287      +/-   ##
===========================================
- Coverage    84.79%   84.79%   -0.01%     
===========================================
  Files          168      168              
  Lines        25196    25201       +5     
===========================================
+ Hits         21365    21369       +4     
- Misses        3831     3832       +1

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

coveralls · 2026-09-06T00:01:04Z

coverage: 84.87% (-0.001%) from 84.871% — issues/hannes-ucsc/8286-7825-eliminate-pycharm-image into develop

Nothing refers to `ucscgi/azul-pycharm` anymore, now that the formatter is installed in the image built from the Dockerfile in this directory. The checklist items for building and publishing it go with it, as does the one asking for its unused tags to be removed after a promotion, which the PR template derives from the images marked as custom. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…8286) The GitHub build has no credentials for the mirror and pulls images from the upstream registry instead. The digest of the base image is that of the image in the mirror, and digests of multi-platform images differ between the mirror and the upstream registry, so that reference can't be used there. Referring to the image by tag would work, but only by giving up the pinning that the digest provides everywhere else, letting a rebuilt tag change the base image without anything in this repository changing. Track the upstream digest in `environment.boot` as well, next to the mirrored one, and refer to that in the GitHub build. Tracking the image twice leaves the existing name saying nothing about which of the two it is, so it becomes `azul_python_image_mirrored`. The build argument keeps the unqualified name, because which of the two references a build passes is the caller's choice, and a build that pulls from the upstream registry shouldn't pass its reference in an argument named after the mirror. `common.mk` defaults that choice to the mirrored reference. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Docker's apt repository is now configured at the top of the file, ahead of the single `apt-get update`, so that one index serves the three installs below it. The packages the base image ships are no longer upgraded. That image is pinned to a digest that is bumped every other week, which is what keeps them current, and leaving them at the versions that digest ships makes the content of this image a function of that digest. Bumping `azul_image_version` fetches a new index, which is necessary when a build fails because a version in the cached index is no longer available from the repository. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The comment preceding `azul_pycharm_version` now states what to do after changing it, and the checklist item in the issue template for the biweekly upgrade refers to that comment instead of naming the commands itself. Establishing which parts of the archive to extract is involved enough to be described separately, by a skill, which applies only when `make format` fails after the version was bumped. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The line for the downloaded archive used to be selected with `grep`, which interpreted the file name as a regular expression and matched it anywhere in a line. Neither is a problem for the names and files involved today, but that is a property of what those files happen to contain. `sha256sum --ignore-missing` verifies every file the checksum file lists that is actually present, which is the one just downloaded, and fails when none is. That also removes the only pipeline from each of the four instructions, and with it the need for `pipefail`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Two instructions left files there. The post-install script of the package providing the JRE runs a JVM, which creates a directory for its performance data, and uv leaves a lock file per package it installs. While at it, remove each kind of leftover with the least forceful form that does the job: a plain `rm` for files, `rm -r` for the empty directory the JVM leaves, and `rm -rf` only for directories that actually have something in them. The instruction installing the AWS CLI used one `rm -rf` for two files and a directory. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The archive was downloaded into a directory in the image root, unpacked in full, the binary moved out of it and the directory removed again. Download it to /tmp, like every other archive, and extract just the binary to its destination. The license file in the archive was discarded before and still is. `curl` now fails on a response that isn't the archive, instead of saving it and leaving `unzip` to complain about it, and the `pipefail` around the extraction is gone, having had no pipeline to watch over. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The archive holds a Python runtime and the data files of botocore, thousands of files in all, and `unzip` named every one of them. In the most recent build on GitHub those lines accounted for 7562 of the 32091 lines the job logged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

There are now three targets, each assuming more than the one before it. `__format` assumes the formatter is installed where it runs, and is what the GitLab build invokes inside a container from the image. `_format` assumes only that the image exists, and runs `__format` in a container from it. `format` assumes nothing and builds the image first. The middle one is for a build that obtains the image some other way than by building it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Building the image accounts for most of the two minutes the GitHub build spends formatting. Push it to the registry that GitHub hosts, under a tag naming the hash of everything that determines its contents, and pull it in builds whose inputs hash the same. Compressed, the image is 859MB, so a build that finds one trades the build for a download of that size. The image is only ever reused by a tree that would have produced an equivalent one, and a build that finds none builds and pushes one, so the first build of this branch populates the registry. Note that this creates a package that is visible to everyone, this repository being public. Nothing in that registry expires by itself, which is why the build prunes it, keeping the five most recent versions. Failing to prune doesn't fail the build. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Running the formatter as the invoking user requires that user to have an entry in /etc/passwd and a home directory to write to. Both were assembled in a temporary directory in the project root and mounted into the container. Setting HOME is enough: the JVM falls back to it when it can't look the user up. It names /tmp, the one directory in the image that any user can write to, so the caches and indexes PyCharm leaves there are discarded with the container. Nothing is created in the project root anymore, so nothing has to be removed from it either, and the ignore rule for it is obsolete. The project is mounted at /azul now, the path the runner image uses for it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The dev image carried a virtual environment at /build/.venv that every GitLab job had to activate. `UV_PROJECT_ENVIRONMENT` points uv at the image's own Python installation instead, the way the lambda images already do it. Nothing activates anything, and a virtual environment in a bind-mounted project root can't be mistaken for the one to use. The `check_venv` and `check_python` targets consult whichever of the two variables naming an environment is set, so they keep their meaning on a developer machine and acquire one in a container. Both images use /azul for the directory that holds the lock file while uv reads it, matching the path at which the project is mounted for formatting. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Resolving a path to a host path fails on a host, where there is no container whose mounts it could be resolved against, and in a container whose mounts it falls outside of. Both are documented outcomes, and the caller handles them by using the path as it is. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Installing PyCharm makes the image take longer to build. A build with a cold layer cache took 298s of the 360s the stage allowed, close enough that a slower runner, a larger base image or a bigger PyCharm release would exceed it, and the failure would look like an infrastructure problem rather than a lack of time. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

hannes-ucsc self-assigned this Sep 5, 2026

hannes-ucsc force-pushed the issues/hannes-ucsc/8286-7825-eliminate-pycharm-image branch from 46e8118 to 2765c7d Compare September 5, 2026 23:29

hannes-ucsc force-pushed the issues/hannes-ucsc/8286-7825-eliminate-pycharm-image branch 2 times, most recently from 01d9b3d to 660a2cb Compare September 7, 2026 23:50

hannes-ucsc and others added 14 commits September 8, 2026 10:11

Install the Python formatter in the build image (#8286)

243f907

hannes-ucsc force-pushed the issues/hannes-ucsc/8286-7825-eliminate-pycharm-image branch from 660a2cb to a6e74ff Compare September 8, 2026 17:32

Navigation Menu

Uh oh!

Install the Python formatter in the build image (#8286) - #8287

Install the Python formatter in the build image (#8286)#8287
hannes-ucsc wants to merge 15 commits into
developfrom
issues/hannes-ucsc/8286-7825-eliminate-pycharm-image

hannes-ucsc commented Sep 5, 2026

Uh oh!

codecov Bot commented Sep 6, 2026 •

edited

Loading

Uh oh!

coveralls commented Sep 6, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

hannes-ucsc commented Sep 5, 2026

Checklist

Author

Author (partiality)

Author (reindex)

Author (mirror)

Author (API changes)

Author (upgrading deployments)

Author (hotfixes)

Author (before every review)

Peer reviewer (after approval)

System administrator (after approval)

Operator

Operator (deploy .shared and .gitlab components)

System administrator (post-deploy of .gitlab component)

Operator (deploy runner image)

Operator (sandbox build)

Operator (merge the branch)

Operator (main build)

Operator (reindex)

Operator (mirroring)

Operator

Shorthand for review comments

Uh oh!

codecov Bot commented Sep 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coveralls commented Sep 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Operator (deploy `.shared` and `.gitlab` components)

System administrator (post-deploy of `.gitlab` component)

codecov Bot commented Sep 6, 2026 •

edited

Loading

coveralls commented Sep 6, 2026 •

edited

Loading