fix(ci): derive Docker boundary version from package (#7248)

Author: rayrayraykk

.github/workflows/docker-release.yml

@@ -46,6 +46,10 @@ jobs:
         with:
           submodules: recursive
 
+      - name: Get QwenPaw version
+        id: qwenpaw_version
+        uses: ./.github/actions/get-version
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -91,6 +95,7 @@ jobs:
           VERSION: ${{ steps.vars.outputs.version }}
           IS_PRERELEASE: ${{ steps.vars.outputs.is_prerelease }}
           QWENPAW_DISABLED_CHANNELS: "imessage"
+          QWENPAW_VERSION: ${{ steps.qwenpaw_version.outputs.version }}
         run: |
           TAGS="-t ${ACR_REGISTRY}/${IMAGE}:${VERSION} -t ${ACR_REGISTRY}/${IMAGE}:pre"
           TAGS="${TAGS} -t docker.io/${IMAGE}:${VERSION} -t docker.io/${IMAGE}:pre"
@@ -100,4 +105,6 @@ jobs:
           docker buildx build --platform linux/amd64,linux/arm64 \
             -f deploy/Dockerfile \
             --build-arg QWENPAW_DISABLED_CHANNELS="${QWENPAW_DISABLED_CHANNELS}" \
+            --build-arg \
+            QWENPAW_MANAGED_RUNTIME_BOUNDARY_VERSION="${QWENPAW_VERSION}" \
             ${TAGS} --push .

.github/workflows/release-verify.yml

@@ -173,28 +173,9 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
 
-      - name: Verify managed runtime boundary version
-        shell: bash
-        run: |
-          python - <<'PY'
-          import re
-          from pathlib import Path
-
-          version_source = Path("src/qwenpaw/__version__.py").read_text()
-          dockerfile = Path("deploy/Dockerfile").read_text()
-          version = re.search(r'__version__ = "([^"]+)"', version_source)
-          boundary = re.search(
-              r'ARG QWENPAW_MANAGED_RUNTIME_BOUNDARY_VERSION="([^"]+)"',
-              dockerfile,
-          )
-          if version is None or boundary is None:
-              raise SystemExit("Unable to read runtime boundary versions")
-          if version.group(1) != boundary.group(1):
-              raise SystemExit(
-                  f"Runtime boundary version mismatch: "
-                  f"{boundary.group(1)} != {version.group(1)}",
-              )
-          PY
+      - name: Get QwenPaw version
+        id: version
+        uses: ./.github/actions/get-version
 
       - name: Log in to Aliyun ACR (when credentials available)
         if: env.ACR_USERNAME != ''
@@ -210,6 +191,7 @@ jobs:
         env:
           DOCKER_NODE_IMAGE: ${{ inputs.docker_node_image }}
           DOCKER_UV_IMAGE: ${{ inputs.docker_uv_image }}
+          QWENPAW_VERSION: ${{ steps.version.outputs.version }}
         run: |
           BUILD_ARGS=""
           if [ -n "$DOCKER_NODE_IMAGE" ]; then
@@ -221,9 +203,22 @@ jobs:
           docker build \
             -f deploy/Dockerfile \
             -t qwenpaw-verify:test \
+            --build-arg \
+            QWENPAW_MANAGED_RUNTIME_BOUNDARY_VERSION="$QWENPAW_VERSION" \
             $BUILD_ARGS \
             .
 
+      - name: Verify managed runtime boundary version
+        env:
+          QWENPAW_VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          actual=$(docker image inspect qwenpaw-verify:test \
+            --format '{{ index .Config.Labels "io.qwenpaw.managed-runtime-boundary.version" }}')
+          if [ "$actual" != "$QWENPAW_VERSION" ]; then
+            echo "::error::Runtime boundary version mismatch: $actual != $QWENPAW_VERSION"
+            exit 1
+          fi
+
       - name: Start container
         run: |
           docker run -d \

.github/workflows/release.yml

@@ -266,6 +266,10 @@ jobs:
           ref: ${{ needs.resolve.outputs.sha }}
           submodules: recursive
 
+      - name: Get QwenPaw version
+        id: version
+        uses: ./.github/actions/get-version
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
@@ -285,6 +289,7 @@ jobs:
           DOCKER_NODE_IMAGE: ${{ inputs.dry_run && 'node:20-slim' || '' }}
           DOCKER_UV_IMAGE: ${{ inputs.dry_run && 'ghcr.io/astral-sh/uv:latest' || '' }}
           QWENPAW_DISABLED_CHANNELS: "imessage"
+          QWENPAW_VERSION: ${{ steps.version.outputs.version }}
         run: |
           BUILD_ARGS=()
           if [ -n "${DOCKER_NODE_IMAGE}" ]; then
@@ -296,6 +301,8 @@ jobs:
           docker buildx build --platform linux/amd64,linux/arm64 \
             -f deploy/Dockerfile \
             --build-arg QWENPAW_DISABLED_CHANNELS="${QWENPAW_DISABLED_CHANNELS}" \
+            --build-arg \
+            QWENPAW_MANAGED_RUNTIME_BOUNDARY_VERSION="${QWENPAW_VERSION}" \
             --output "type=oci,dest=${RUNNER_TEMP}/qwenpaw-image.tar" \
             "${BUILD_ARGS[@]}" .
 

deploy/Dockerfile

@@ -18,7 +18,7 @@ FROM ${UV_IMAGE} AS uv-src
 # -----------------------------------------------------------------------------
 FROM ${NODE_IMAGE}
 
-ARG QWENPAW_MANAGED_RUNTIME_BOUNDARY_VERSION="2.1.1b1"
+ARG QWENPAW_MANAGED_RUNTIME_BOUNDARY_VERSION
 LABEL io.qwenpaw.managed-runtime-boundary.version=\
 ${QWENPAW_MANAGED_RUNTIME_BOUNDARY_VERSION}
 

scripts/docker_build.sh

@@ -19,10 +19,19 @@ shift || true
 
 # Channels to exclude from the image (default: imessage).
 DISABLED_CHANNELS="${QWENPAW_DISABLED_CHANNELS:-imessage}"
+QWENPAW_VERSION=$(sed -n \
+    's/^__version__[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' \
+    src/qwenpaw/__version__.py)
+if [ -z "$QWENPAW_VERSION" ]; then
+    echo "[docker_build] Failed to read src/qwenpaw/__version__.py" >&2
+    exit 1
+fi
 
 echo "[docker_build] Building image: $TAG (Dockerfile: $DOCKERFILE)"
 docker build -f "$DOCKERFILE" \
     --build-arg QWENPAW_DISABLED_CHANNELS="$DISABLED_CHANNELS" \
+    --build-arg \
+    QWENPAW_MANAGED_RUNTIME_BOUNDARY_VERSION="$QWENPAW_VERSION" \
     ${QWENPAW_ENABLED_CHANNELS:+--build-arg QWENPAW_ENABLED_CHANNELS="$QWENPAW_ENABLED_CHANNELS"} \
     -t "$TAG" "$@" .
 echo "[docker_build] Done."