ci: add compressed image size cap to GitHub Actions and GitLab CI

[wdconinc]

Briefly, what does this PR introduce? Please link to any relevant presentations or discussions.

This PR fails the build when the compressed download size of a built image exceeds a configurable high-water mark, to catch regressions.

New script:

• .ci/check_image_size IMAGE_REF LIMIT_GIB: inspects a pushed single-arch manifest, sums layers[].size, fails if over limit

CI variables added (both GitHub Actions and GitLab CI):

  SIZE_LIMIT_DEBIAN_STABLE_BASE_GIB = 0.8
  SIZE_LIMIT_EIC_CI_GIB             = 3
  SIZE_LIMIT_EIC_XL_GIB             = 4.5

Also, add script to shellcheck, and skip failing hadolint now that pre-commit.ci is activated.

What is the urgency of this PR?

• High (please describe reason below)
• Medium
• Low

What kind of change does this PR introduce?

• Bug fix (issue: no container size tracking and alerting)
• New feature (issue #__)
• Optimization (issue #__)
• Updated documentation
• other: __

Please check if any of the following apply

• This PR introduces breaking changes. Please describe changes users need to make below.
• This PR changes default behavior. Please describe changes below.
• AI was used in preparing this PR. Please describe usage below.

This is a high priority since we want to avoid regressions like the one fixed in #287.

Strategy defined by human; script written by AI, reviewed/tested/validated by human.

[Copilot]

Pull request overview

This PR adds CI guardrails to fail container builds when compressed image sizes exceed configured caps, helping catch size regressions in EIC container images.

Changes:

• Adds .ci/check_image_size to inspect pushed image manifests and compare compressed layer size to a GiB limit.
• Adds shared size-limit variables to GitHub Actions and GitLab CI.
• Runs size checks after base and EIC image builds.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 9 comments.

File	Description
.ci/check_image_size	New helper for compressed image size validation.
.github/workflows/build-push.yml	Adds size limit env vars and GitHub Actions size-check steps.
.gitlab-ci.yml	Adds size limit variables and GitLab CI size-check script entries.

Comments suppressed due to low confidence (1)

.gitlab-ci.yml:528

• The eic GitLab job also invokes .ci/check_image_size without installing the script's required jq and bc dependencies; the existing apk add envsubst git earlier in this job does not provide them. These size-check branches will fail before evaluating the cap unless the dependencies are installed.

          .ci/check_image_size
            "${CI_REGISTRY}/${CI_PROJECT_PATH}/${BUILD_IMAGE}${ENV}:${INTERNAL_TAG}-${BUILD_TYPE}"
            "${SIZE_LIMIT_EIC_XL_GIB}" ;;
        *)
          .ci/check_image_size
            "${CI_REGISTRY}/${CI_PROJECT_PATH}/${BUILD_IMAGE}${ENV}:${INTERNAL_TAG}-${BUILD_TYPE}"
            "${SIZE_LIMIT_EIC_CI_GIB}" ;;

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

[github-actions]

Capybara summary for PR 289

• rec_dis_10x100_minQ2=1000_epic_craterlake (new artifact) (ref artifact)
• rec_dis_10x100_minQ2=1_epic_craterlake (new artifact) (ref artifact)
• rec_dis_18x275_minQ2=1000_epic_craterlake (new artifact) (ref artifact)
• rec_dis_18x275_minQ2=1_epic_craterlake (new artifact) (ref artifact)
• rec_dis_5x41_minQ2=1_epic_craterlake (new artifact) (ref artifact)
• rec_e_1GeV_20GeV_epic_craterlake (new artifact) (ref artifact)
• rec_pi_1GeV_20GeV_epic_craterlake (new artifact) (ref artifact)
• sim_dis_10x100_minQ2=1000_epic_craterlake (new artifact) (ref artifact)
• sim_dis_10x100_minQ2=1_epic_craterlake (new artifact) (ref artifact)
• sim_dis_18x275_minQ2=1000_epic_craterlake (new artifact) (ref artifact)
• sim_dis_18x275_minQ2=1_epic_craterlake (new artifact) (ref artifact)
• sim_dis_5x41_minQ2=1_epic_craterlake (new artifact) (ref artifact)
• sim_e_1GeV_20GeV_epic_craterlake (new artifact) (ref artifact)
• sim_pi_1GeV_20GeV_epic_craterlake (new artifact) (ref artifact)
  ^{_{Last updated 2026-05-16T19:08-04:00 f7a27d2}}

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (3)

.gitlab-ci.yml:531

• The eic build job only installs envsubst and git before this new check, but .ci/check_image_size also requires jq and bc. The configured eic_ci/eic_xl limits make this path execute, so GitLab CI will fail after those image builds unless the missing tools are installed in this job or shared build setup.

        .ci/check_image_size
          "${CI_REGISTRY}/${CI_PROJECT_PATH}/${FULLNAME}:${INTERNAL_TAG}-${BUILD_TYPE}"
          "${LIMIT}" ;

.ci/check_image_size:35

• This index resolver accepts any descriptor with a platform, which includes BuildKit provenance attestation manifests (unknown/unknown) as well as the real image manifest. Because it then takes head -1, an attestation descriptor can be selected and the check would sum the tiny attestation layers instead of the image layers, letting an oversized image pass; filter out attestation/unknown-platform descriptors or select the expected platform explicitly.

    DIGEST=$(printf '%s' "${MANIFEST}" | jq -r '
      .manifests[]
      | select(.artifactType == null and .platform != null)
      | .digest' | head -1)

.ci/check_image_size:66

• The remediation command shown here does not work for the OCI index case handled earlier in the script: ${IMAGE_REF} may have .manifests instead of .layers, so this jq expression errors or returns no size. The error message should either show a command that performs the same index-to-manifest resolution or print the resolved manifest reference used for the check.

  echo "To update the high-water mark after an intentional size increase:"
  echo "  1. Inspect the published image size with:"

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

.ci/check_image_size:67

• This troubleshooting command is wrong for the OCI index case handled above (the default GitHub build-push provenance path), because the top-level index has no .layers. If the check fails on an index reference, maintainers following this hint will get a jq error or no size instead of the manifest size.

  echo "  1. Inspect the published image size with:"
  echo "     docker buildx imagetools inspect --raw \"${IMAGE_REF}\" | jq '[.layers[].size] | add // 0'"

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[wdconinc]

This works as intended, e.g. https://github.com/eic/containers/actions/runs/25965960211/job/76331007283#step:17:107

Strategy allows for additional size definitions as needed but the ones we have right now are the most critical ones to track: debian base, eic_ci, eic_xl. We could add a cuda base or eic image later if we want to guard against pulling in a second cuda version.