Compile the Azure CLI's bytecode on the build platform

The 0.2.0 release failed on its arm64 image: compiling the Azure CLI's
12,000 files under emulation hit uv's per-file timeout after 36 minutes.
Bytecode is the same on every architecture for one Python, so it is now
compiled in a stage on the build machine's platform, from the same base.

Pushes and pull requests now build both architectures too, so a failure
under emulation is found before a release.

Author: craigthackerx

.github/workflows/container.yml

@@ -235,14 +235,20 @@ jobs:
             echo "changed=true" >> "${GITHUB_OUTPUT}"
           fi
 
+      # Every platform is built on every change, not only for a release, so a build that
+      # only breaks under emulation is found before a release depends on it.
       - name: Set up emulation for other architectures
-        if: steps.changed.outputs.changed == 'true'
+        if: >-
+          steps.plan.outputs.skip != 'true' &&
+          (steps.plan.outputs.publish != 'true' || steps.changed.outputs.changed == 'true')
         run: |
           sudo apt-get update --quiet
           sudo apt-get install --yes --quiet qemu-user-static
 
       - name: Build for every platform
-        if: steps.changed.outputs.changed == 'true'
+        if: >-
+          steps.plan.outputs.skip != 'true' &&
+          (steps.plan.outputs.publish != 'true' || steps.changed.outputs.changed == 'true')
         env:
           VARIANT: ${{ matrix.variant }}
           VERSION: ${{ steps.version.outputs.version }}

CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to libre-devops-helpers are recorded here. The project follo
 
 ## 0.2.1
 
+### Fixed
+
+- The 0.2.0 release stopped before publishing the default image and the GitHub release:
+  its arm64 build compiled the Azure CLI's 12,000 files under emulation and ran out of
+  time. The Azure CLI's bytecode is now compiled on the build machine's own platform (it
+  is the same on every architecture), in seconds. Only `0.2.0-slim` was published.
+- Every push and pull request now builds both architectures, so a build that fails only
+  under emulation is caught before a release.
+
 ### Security
 
 - The default image's Azure CLI now runs cryptography 50.0.1 (CVE-2026-69247,

Containerfile

@@ -28,9 +28,21 @@ COPY src ./src
 RUN UV_PROJECT_ENVIRONMENT=/opt/ldo uv sync --locked --no-dev --no-editable
 
 # Build the Azure CLI, locked in container/azure-cli, into its own environment at /opt/az.
+# Its bytecode is compiled in the next stage instead: the Azure CLI is over 12,000 files,
+# and compiling them under emulation, for another architecture's image, takes longer
+# than a build may run.
 FROM build AS build-az
 COPY container/azure-cli/pyproject.toml container/azure-cli/uv.lock /src/azure-cli/
-RUN UV_PROJECT_ENVIRONMENT=/opt/az uv sync --locked --no-dev --project /src/azure-cli
+RUN UV_PROJECT_ENVIRONMENT=/opt/az UV_COMPILE_BYTECODE=0 \
+    uv sync --locked --no-dev --project /src/azure-cli
+
+# The Azure CLI's bytecode, compiled on the build machine's own platform. Bytecode is the
+# same on every architecture for one Python version, and this is the same base image, so
+# the result is what compiling in place would give, in seconds rather than an hour.
+# unchecked-hash: the image never changes, so Python need not check the sources.
+FROM --platform=$BUILDPLATFORM docker.io/library/python:3.14-slim-trixie@sha256:caaf356f40667c496d405780745b9ac25771c189a51dfcc42430d531ea09f8a2 AS compile-az
+COPY --from=build-az /opt/az /opt/az
+RUN python -W ignore -m compileall -q -j 0 --invalidation-mode unchecked-hash /opt/az/lib
 
 # Runtime: the same base, patched, with a non-root user and the tool on PATH.
 FROM docker.io/library/python:3.14-slim-trixie@sha256:caaf356f40667c496d405780745b9ac25771c189a51dfcc42430d531ea09f8a2 AS runtime
@@ -64,7 +76,7 @@ FROM runtime AS tool
 # The default target: the tool with the Azure CLI, for signing in as yourself (the
 # default "azure-cli" profiles) and 'ldo az'.
 FROM runtime AS az
-COPY --from=build-az /opt/az /opt/az
+COPY --from=compile-az /opt/az /opt/az
 USER root
 # A wrapper rather than a link, so az always runs on its own environment's Python.
 RUN printf '#!/bin/sh\nexec /opt/az/bin/python -m azure.cli "$@"\n' > /usr/local/bin/az \

README.md

@@ -918,9 +918,10 @@ Every pull request and push to `main` runs `.github/workflows/ci.yml`:
 | Coverage | line and branch coverage, failing below the floor in `pyproject.toml` (`fail_under`), with the report in the job summary and the total written for the badge |
 | Build | builds the sdist and wheel once, installs the wheel in a clean environment, and keeps both as the run's artifact |
 
-`.github/workflows/container.yml` builds both images on every pull request and push, runs
-them (the version, a command's help, a non-root user, and for the default image a
-signed-out `az whoami` that must fail cleanly), and scans them with a checksum-pinned Trivy. The `slim` image
+`.github/workflows/container.yml` builds both images for `amd64` and `arm64` on every pull
+request and push. It runs the native build (the version, a command's help, a non-root user,
+and for the default image a signed-out `az whoami` that must fail cleanly) and scans it with
+a checksum-pinned Trivy. The `slim` image
 fails on any high or critical vulnerability that has a fix; the default image fails on a
 fixed critical one and reports the rest, since the Azure CLI inside it pins its own
 dependencies. Findings with a fix go to the Security tab. Those without one, mostly Debian

tests/project/test_containerfile.py

@@ -0,0 +1,27 @@
+import re
+from pathlib import Path
+
+CONTAINERFILE = Path(__file__).resolve().parents[2] / "Containerfile"
+FROM = re.compile(r"^FROM\s+(?:--platform=\S+\s+)?(\S+)(?:\s+AS\s+(\S+))?", re.MULTILINE)
+
+
+def stages() -> dict[str, str]:
+    return {name: image for image, name in FROM.findall(CONTAINERFILE.read_text())}
+
+
+def test_every_python_stage_is_one_pinned_base():
+    # The Azure CLI's bytecode is compiled in one stage and run in another, so the two must
+    # be the same Python; a partial base image bump would break that quietly.
+    pythons = {image for image in stages().values() if "library/python:" in image}
+    assert len(pythons) == 1, pythons
+    assert "@sha256:" in pythons.pop()
+
+
+def test_the_azure_cli_is_compiled_on_the_build_platform_and_shipped_compiled():
+    text = CONTAINERFILE.read_text()
+    assert "FROM --platform=$BUILDPLATFORM" in text
+    assert "COPY --from=compile-az /opt/az /opt/az" in text
+    assert (
+        "COPY --from=build-az /opt/az /opt/az"
+        in text.split("AS compile-az", 1)[1].split("\nFROM", 1)[0]
+    )