ci: Implement Prebuilt Image for stable test pipeline

[seonghobae]

Resolves #82
Supersedes #80

This PR implements a robust CI pipeline by building a Prebuilt Image and storing it in GHCR, completely decoupling the test runner from network and dependency installation unreliability.

• Adds Dockerfile.test which bakes in all system dependencies, python packages, and the mineru binary.
• Adds build-ci-image.yml to build and push this image to GHCR.
• Modifies tests.yml to run tests inside the container using the GHCR image, rather than building it on the fly.

Summary by CodeRabbit

릴리스 노트

• Chores
  • CI/CD 파이프라인이 Docker 컨테이너 환경을 사용하도록 업데이트되었습니다.
  • 테스트 실행 환경이 컨테이너화되고, CI 이미지가 자동으로 빌드 및 배포됩니다.

[coderabbitai]

Warning

Rate limit exceeded

@seonghobae has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 54 minutes and 31 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 54 minutes and 31 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 53f1ec60-dae3-4a36-b03a-9707c86e93ce

📥 Commits

Reviewing files that changed from the base of the PR and between ea77f60 and d6d705f.

📒 Files selected for processing (3)

• .github/workflows/build-ci-image.yml
• .github/workflows/tests.yml
• Dockerfile.test

📝 Walkthrough

워크스루

GitHub Actions 워크플로우를 통해 Docker 컨테이너 이미지를 GitHub Container Registry에 빌드하고 게시하는 새로운 CI 파이프라인을 도입합니다. 테스트 워크플로우는 사전 구축된 이미지를 사용하도록 업데이트되어 매번 처음부터 빌드하는 대신 안정성을 향상시킵니다.

변경 사항

코호트 / 파일	요약
CI 워크플로우 .github/workflows/build-ci-image.yml, .github/workflows/tests.yml	Dockerfile.test 변경 또는 워크플로우 자체 수정 시 Docker 이미지를 빌드하고 GHCR에 게시하는 새 워크플로우를 추가합니다. 테스트 워크플로우는 packages: read 권한을 부여받고 GHCR에서 사전 구축된 컨테이너 이미지를 사용하도록 수정됩니다. Python 설정 단계가 제거되고 PYTHONPATH=src가 설정됩니다.
Docker 설정 Dockerfile.test	Python 3.10 기반 테스트 컨테이너를 정의합니다. 시스템 의존성을 설치하고 uv를 통해 dev 및 test extras를 포함한 프로젝트를 설치한 후, pytest 실행을 기본 커맨드로 설정합니다.

예상 코드 리뷰 노력

🎯 3 (중간) | ⏱️ ~18분

관련 가능성 있는 PR

• ci: ship lean multi-arch images with optional NVIDIA publish #27: CI Docker 워크플로우 및 Dockerfile 아티팩트 수정이 포함되어 있어 이번 PR과 직접적인 연관성이 있습니다.

시

🐰 깃허브 액션에서 이미지를 만들고,
GHCR 저장소에 담아,
테스트 시간마다 빌드 없이
안정적으로 달려가네요!
사전 구축된 컨테이너로
CI는 더욱 튼튼해졌어요. 🐇✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description clearly explains what was changed and why, but does not follow the required template structure with Summary, Git Flow target, and Verification sections.	Add sections for Git Flow target confirmation, and complete the Verification checklist with pytest test results to match the template requirements.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title accurately summarizes the main change: implementing a prebuilt Docker image for stable test pipeline execution in CI.
Linked Issues check	✅ Passed	All primary coding requirements from issue #82 are met: Dockerfile.test created with dependencies, image built and pushed to GHCR, tests.yml updated to use prebuilt image, and tests verification approach established.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to the stated objectives: Dockerfile.test, build-ci-image.yml, and tests.yml modifications align with decoupling test runner from network/dependency installation issues.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ci-prebuilt-image

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 6

🧹 Nitpick comments (2)

Dockerfile.test (2)

18-23: COPY src/, tests/, tools/는 CI 컨테이너에 코드를 baked in 하지만 tests.yml의 actions/checkout이 /github/workspace를 덮어씁니다.

GitHub Actions가 컨테이너 잡을 실행할 때 워크스페이스는 호스트에서 bind-mount 되며, checkout 스텝은 PR 시점의 소스를 그 위에 쓰므로 이미지에 포함된 /app/src, /app/tests는 실제 테스트 실행과 무관해집니다. tests.yml이 PYTHONPATH=src로 /github/workspace/src를 사용하고 uv sync로 의존성을 재설치하는 이유이기도 합니다.

따라서 이미지의 의도를 명확히 하기 위해 둘 중 하나를 택할 것을 권장합니다:

• (A) 이미지 = 런타임/시스템 의존성 + uv + 프리-워밍된 의존성만 baked. 소스(src/, tests/, tools/) 복사 제거.
• (B) 이미지에 소스를 포함하되 CI는 이미지 내부 경로에서 직접 실행(workspace bind 미사용).

옵션 A가 일반적으로 CI 용도에 더 적합합니다.

🛠️ 옵션 A 예시

-# Copy project files
-COPY pyproject.toml .
-COPY README.md .
-COPY src/ ./src/
-COPY tests/ ./tests/
-COPY tools/ ./tools/
-
-# Install dependencies using uv (including mineru and test extras)
-# We use system environment for the container
-RUN uv pip install --system -e ".[dev,test]"
+# Pre-warm dependencies only (source is mounted at runtime by Actions)
+COPY pyproject.toml README.md ./
+COPY src/newsdom_api/__init__.py ./src/newsdom_api/__init__.py
+RUN uv pip install --system -e ".[dev,mineru]"

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@Dockerfile.test` around lines 18 - 23, The Dockerfile currently COPYs src/,
tests/, and tools/ into the image but GitHub Actions' actions/checkout
bind-mounts /github/workspace over the container at runtime (see tests.yml using
PYTHONPATH=src and the uv sync step), so the baked-in /app/src, /app/tests are
ignored; pick one approach and implement it: either remove the COPY src/, COPY
tests/, and COPY tools/ lines from the Dockerfile and keep the image focused on
system deps + uv (Option A), or keep the source in the image and update the CI
tests.yml to stop bind-mounting/overwriting the workspace so it runs against the
image's internal paths (Option B); refer to the COPY lines in the Dockerfile and
the actions/checkout + PYTHONPATH=src / uv sync references in tests.yml when
making the change.

---

12-14: uv 버전을 고정하세요 — tests.yml의 setup-uv@0.11.3과 일치시켜야 재현성이 확보됩니다.

curl ... | sh로 최신 uv를 설치하면 tests.yml(로컬 체크아웃 경로에서 여전히 astral-sh/setup-uv@... with version: 0.11.3을 사용)과 버전이 달라질 수 있습니다. 컨테이너 내부의 uv는 컨테이너를 다시 빌드할 때마다 변경되어 "프리빌트로 안정성 확보"라는 PR 목적과 충돌합니다. 버전 고정 혹은 공식 이미지 사용을 권장합니다.

🛠️ 옵션 A: 버전 고정

-# Install uv
-RUN curl -LsSf https://astral.sh/uv/install.sh | sh
-ENV PATH="/root/.local/bin:${PATH}"
+# Install uv (pin to match .github/workflows/tests.yml)
+ENV UV_VERSION=0.11.3
+RUN curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh

옵션 B: ghcr.io/astral-sh/uv:0.11.3 바이너리 스테이지에서 COPY --from=...로 가져오는 멀티스테이지 빌드.

What is the correct way to pin the uv installer version when using the astral.sh/uv/install.sh script?

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@Dockerfile.test` around lines 12 - 14, Pin the uv version to match tests.yml
(setup-uv@0.11.3) instead of installing the latest via curl | sh: either (A)
invoke the astral installer with an explicit 0.11.3 version argument or
environment variable so the script installs that exact release (ensure the RUN
line that calls https://astral.sh/uv/install.sh passes/version-locks 0.11.3), or
(B) switch to a multi-stage build that pulls the prebuilt
ghcr.io/astral-sh/uv:0.11.3 image and COPY --from that stage into the final
image; reference tests.yml’s setup-uv@0.11.3 to keep versions consistent.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/build-ci-image.yml:
- Around line 37-58: The metadata-action step (id: meta) computes tags
(accessible as steps.meta.outputs.tags) but those tags aren't passed into
docker/build-push-action; only a hardcoded :latest is used and metadata-action
still uses the original ${GITHUB_REPOSITORY_OWNER} casing, so SHA tags and owner
normalization are lost; fix by moving the "Lowercase repository owner" step (id:
lowercase_owner) to run before the metadata-action, update metadata-action to
use the lowercased owner (use steps.lowercase_owner.outputs.owner for its images
input), and pass steps.meta.outputs.tags into the build-push-action tags input
(in addition to or instead of :latest) so the computed type=sha and other tags
are actually pushed.
- Around line 9-12: 현재 workflow의 pull_request 트리거에 push: true 설정은 외부 포크 PR에서
GITHUB_TOKEN 권한 부족으로 GHCR 푸시 실패를 일으킵니다; 수정 방법은 .github 워크플로우의 pull_request 트리거에서
push 권한 호출(또는 push: true 설정)을 제거하고, 푸시가 필요한 작업(이미지 푸시 등)은 push 이벤트(또는 main 브랜치에
대한 workflow_dispatch)에서만 실행되도록 분기 처리하거나 pull_request 트리거를 아예 제거해 PR에서는 빌드/검증만
수행되게 변경하세요; 워크플로우 내 식별자는 pull_request, push, 그리고 이미지 푸시 관련 job 이름(예: the job
that performs GHCR push)을 찾아 해당 조건을 분리/이동하십시오.

In @.github/workflows/tests.yml:
- Around line 31-38: Update the "Run tests with warnings as errors" job step to
run pytest with coverage enforcement by replacing the plain "uv run pytest"
invocation in that step with "uv run pytest --cov=src/newsdom_api --cov-branch
--cov-report=term-missing --cov-fail-under=100"; additionally, remove or justify
the redundant "name: Install current workspace dependencies" / "uv sync --frozen
--all-extras" and any "setup-uv" step if your CI image already contains baked-in
dependencies — either delete those steps to rely on the prebuilt image or add a
comment explaining why dependencies must be installed at runtime.
- Around line 15-19: Replace the hardcoded owner in the container.image value
(currently "ghcr.io/seongho-bae/newsdom-api/ci-env:latest") with a dynamic,
lowercased repository owner; use the GitHub Actions expression
github.repository_owner lowercased (e.g. via ${{
toLower(github.repository_owner) }} or by setting an earlier step/env value to
toLower(github.repository_owner) and referencing that) so container.image is
built as "ghcr.io/${lowercased_owner}/newsdom-api/ci-env:latest" instead of the
fixed "seongho-bae".

In `@Dockerfile.test`:
- Around line 1-10: Add --no-install-recommends to the apt-get install
invocation to avoid pulling unnecessary packages (update the RUN line that calls
apt-get install in the Dockerfile.test), and switch to a non-root user after
installing dependencies by creating/applying a dedicated user and setting USER
(ensure you also set appropriate ownership/permissions for /app or working
directory if present); keep the cleanup rm -rf /var/lib/apt/lists/* in place and
ensure the non-root USER is created before starting the container.
- Around line 25-27: The Dockerfile is trying to install a non-existent "test"
extra which breaks the build and also omits the needed mineru extra; update the
RUN uv pip install --system -e ".[dev,test]" invocation to install the correct
extras that exist and include mineru (e.g. replace the extras with dev and
mineru) so the test deps (in dev) and the mineru binary are baked into the
image; locate the RUN line that starts with "uv pip install --system -e" and
change the extras list accordingly.

---

Nitpick comments:
In `@Dockerfile.test`:
- Around line 18-23: The Dockerfile currently COPYs src/, tests/, and tools/
into the image but GitHub Actions' actions/checkout bind-mounts
/github/workspace over the container at runtime (see tests.yml using
PYTHONPATH=src and the uv sync step), so the baked-in /app/src, /app/tests are
ignored; pick one approach and implement it: either remove the COPY src/, COPY
tests/, and COPY tools/ lines from the Dockerfile and keep the image focused on
system deps + uv (Option A), or keep the source in the image and update the CI
tests.yml to stop bind-mounting/overwriting the workspace so it runs against the
image's internal paths (Option B); refer to the COPY lines in the Dockerfile and
the actions/checkout + PYTHONPATH=src / uv sync references in tests.yml when
making the change.
- Around line 12-14: Pin the uv version to match tests.yml (setup-uv@0.11.3)
instead of installing the latest via curl | sh: either (A) invoke the astral
installer with an explicit 0.11.3 version argument or environment variable so
the script installs that exact release (ensure the RUN line that calls
https://astral.sh/uv/install.sh passes/version-locks 0.11.3), or (B) switch to a
multi-stage build that pulls the prebuilt ghcr.io/astral-sh/uv:0.11.3 image and
COPY --from that stage into the final image; reference tests.yml’s
setup-uv@0.11.3 to keep versions consistent.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ee371c5c-d69f-45de-b4a1-d86c7bab45ee

📥 Commits

Reviewing files that changed from the base of the PR and between 573d302 and ea77f60.

📒 Files selected for processing (3)

• .github/workflows/build-ci-image.yml
• .github/workflows/tests.yml
• Dockerfile.test

[seonghobae]

@coderabbitai resolve

[coderabbitai]

✅ Actions performed

Comments resolved and changes approved.