ci: build CI's image from docker/Dockerfile.ci

This image is suitable for release, debug and debug-asan builds.
The image is somewhat heavy (1.08 GiB) due to llvm-18, but don't run
tarantool's CI that often.

NO_DOC=internal
NO_TEST=internal
NO_CHANGELOG=internal

Co-authored-by: Dmitry Ivanov <d.ivanov@picodata.io>
Co-authored-by: Vitaly Shunkov <v.shunkov@picodata.io>

.gitlab-ci.yml

@@ -16,6 +16,8 @@ variables:
     DOCKER_REGISTRY_PUB: docker-public.binary.picodata.io
     DOCKER_AUTH_CONFIG: $DOCKER_AUTH_RW
     KANIKO_REGISTRY_MIRROR: docker-proxy.binary.picodata.io
+    BASE_IMAGE_LATEST: latest
+    MAIN_BRANCH: &main-branch 2.11.5-picodata
     # k8s runner config
     KUBERNETES_CPU_REQUEST: 6
     KUBERNETES_CPU_LIMIT: 6
@@ -23,7 +25,40 @@ variables:
     # Helps to tolerate spurious network failures
     GET_SOURCES_ATTEMPTS: 3
 
+# job:rules explained:
+#
+# - if build-base changes on master branch (compared to HEAD~1)
+#     * build-base-image (with tag latest) and push
+#     * test (on base-image:latest)
+# - if build-base changes on development branch (compared to master)
+#     * build-base-image (with tag sha)
+#     * test (on base-image:sha)
+# - else (if build-base doesn't change)
+#     * skip build-base-image
+#     * just test (on base-image:latest)
+#
+# Anchor syntax explained here:
+# https://docs.gitlab.com/ee/ci/yaml/yaml_optimization.html
+#
+.rules:
+  - &if-build-base-changes-on-master-branch
+    if: $CI_COMMIT_BRANCH == $MAIN_BRANCH
+    changes:
+      # implies compare_to HEAD~1
+      paths: &build-base-changes-paths
+        - docker/**
+        - .gitlab-ci.yml
+
+  - &if-build-base-changes-on-dev-branch
+    if: $CI_COMMIT_BRANCH != $MAIN_BRANCH
+    changes:
+      compare_to: *main-branch
+      paths: *build-base-changes-paths
+
+  - &else {}
+
 stages:
+  - build-base-image
   - test
   - build
   - pack
@@ -37,6 +72,16 @@ workflow:
     - if: $CI_PIPELINE_SOURCE == "web"
 
 .test:
+  rules:
+    - <<: *if-build-base-changes-on-master-branch
+      variables:
+        BASE_IMAGE_TAG: ${BASE_IMAGE_LATEST}
+    - <<: *if-build-base-changes-on-dev-branch
+      variables:
+        BASE_IMAGE_TAG: ${CI_COMMIT_SHA}
+    - <<: *else
+      variables:
+        BASE_IMAGE_TAG: ${BASE_IMAGE_LATEST}
   stage: test
   interruptible: true
   variables:
@@ -52,7 +97,7 @@ workflow:
 
 luacheck:
     extends: .test
-    image: docker-public.binary.picodata.io/tarantool-testing:latest
+    image: docker-public.binary.picodata.io/tarantool-testing:${BASE_IMAGE_TAG}
     script:
       - make -f .test.mk luacheck
 
@@ -60,7 +105,7 @@ test-ubuntu:
   extends:
     - .test
     - .parallel
-  image: docker-public.binary.picodata.io/tarantool-testing:latest
+  image: docker-public.binary.picodata.io/tarantool-testing:${BASE_IMAGE_TAG}
   variables:
     TEST_RUN_RETRIES: 3
     SERVER_START_TIMEOUT: 400
@@ -96,7 +141,7 @@ coverage:
     - if: $CI_COMMIT_TAG
     - if: $CI_PIPELINE_SOURCE == "web"
   retry: 2
-  image: docker-public.binary.picodata.io/tarantool-testing:latest
+  image: docker-public.binary.picodata.io/tarantool-testing:${BASE_IMAGE_TAG}
   variables:
     TEST_RUN_RETRIES: 3
     SERVER_START_TIMEOUT: 400
@@ -201,7 +246,28 @@ pack-on-tag:
       /kaniko/executor --context $CI_PROJECT_DIR --dockerfile ${DOCKERFILE}
       --build-arg TARANTOOL_VERSION=$CI_COMMIT_TAG ${PUSH_DOCKER}
       --cache=false --cache-run-layers=true --single-snapshot --compressed-caching=false --use-new-run --snapshot-mode=redo --cleanup
-      --destination $DOCKER_REGISTRY_PUB/tarantool:$CI_COMMIT_TAG --destination $DOCKER_REGISTRY_PUB/tarantool:latest
+      --destination $DESTINATION
+
+build-base-image:
+  extends: .kaniko-image
+  interruptible: true
+  stage: build-base-image
+  rules:
+    - <<: *if-build-base-changes-on-master-branch
+      variables:
+        BASE_IMAGE_TAG: ${BASE_IMAGE_LATEST}
+    - <<: *if-build-base-changes-on-dev-branch
+      variables:
+        BASE_IMAGE_TAG: ${CI_COMMIT_SHA}
+    - if: $CI_COMMIT_TAG
+      variables:
+        BASE_IMAGE_TAG: ${BASE_IMAGE_LATEST}
+    - <<: *else
+      when: never
+  variables:
+    DOCKERFILE: docker/Dockerfile.ci
+    DESTINATION: $DOCKER_REGISTRY_PUB/tarantool-testing:${BASE_IMAGE_TAG}
+    PUSH_DOCKER: ""
 
 build-docker-on-tag:
   stage: docker
@@ -212,7 +278,8 @@ build-docker-on-tag:
     - pack-on-tag
   variables:
     PUSH_DOCKER: ""
-    DOCKERFILE: docker/Dockerfile
+    DOCKERFILE: docker/Dockerfile.release
+    DESTINATION: $DOCKER_REGISTRY_PUB/tarantool:latest --destination $DOCKER_REGISTRY_PUB/tarantool:$CI_COMMIT_TAG
 
 run-tntmodule-tests-on-tag:
   stage: docker

docker/Dockerfile.ci

+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Please, keep the packages sorted. Thank you.
+RUN set -e; \
+    apt update -y && \
+    apt install -y \
+        autoconf \
+        build-essential \
+        cmake \
+        curl \
+        git \
+        gnupg \
+        libcurl4-openssl-dev \
+        libicu-dev \
+        liblua5.3-dev \
+        libreadline-dev \
+        libssl-dev \
+        libtool \
+        libunwind-dev \
+        libyaml-dev \
+        libzstd-dev \
+        lua5.3 \
+        luarocks \
+        make \
+        ncurses-dev \
+        pkg-config \
+        python3 \
+        python3-gevent \
+        python3-pip \
+        python3-six \
+        python3-yaml \
+        software-properties-common \
+        tzdata \
+        unzip \
+        wget \
+        zlib1g-dev \
+    && apt-get clean all
+
+# Install llvm toolchain (clang with asan, ubsan, tsan, etc).
+#
+# This toolchain contains a particularly heavyweight package called
+# llvm-18. It might be very tempting to save 150 MiB of disk space by
+# dropping this package, but then we won't have llvm-symbolizer which is
+# crucial for decoding ASan's stacktraces.
+ENV CLANG_VERSION=18
+RUN wget https://apt.llvm.org/llvm.sh && chmod +x llvm.sh \
+    && ./llvm.sh "$CLANG_VERSION" \
+    && apt -y remove clangd-"$CLANG_VERSION" llvm-"$CLANG_VERSION"-dev \
+    && apt -y install llvm-"$CLANG_VERSION" \
+    && apt -y autoremove \
+    && rm -rf ./llvm.sh /var/lib/apt/lists/* \
+    && apt-get clean all
+
+# Install luacheck
+RUN luarocks-5.3 install luacheck 0.22.1-1
+
+# Install glauth for ldap tests
+ENV GLAUTH_URL=https://github.com/glauth/glauth/releases/download/v2.3.0/glauth-linux-amd64
+RUN set -e \
+    && cd /bin \
+    && curl -L -o glauth "$GLAUTH_URL" \
+    && chmod +x glauth
+
+# Timezone
+RUN ln -fs /usr/share/zoneinfo/Europe/Moscow /etc/localtime
+
+# vi: ft=dockerfile

docker/Dockerfile → docker/Dockerfile.release

@@ -142,3 +142,5 @@ HEALTHCHECK CMD tarantool_is_up
 
 EXPOSE 3301
 CMD [ "tarantool" ]
+
+# vi: ft=dockerfile