ci: publish engine base image to GHCR

[jiaoew1991]

No description provided.

[cursor]

PR Summary

Medium Risk
Pinned pylance and lance-spark versions can change query/data behavior; the Dockerfile build-path change must succeed in CI or the new GHCR image will not build.

Overview
Adds a GitHub Actions workflow that builds engine/Dockerfile and pushes the nurion engine base image to GHCR (ghcr.io/lumalabs/nurion-engine:develop and a SHA tag), with disk cleanup and Buildx so downstream services can FROM it without cross-account ECR.

Dockerfile changes fix the in-image build layout: lib/anvil-rs and lib/raydp/java are copied under /app/build/lib/ so RayDP’s Maven protoSourceRoot still resolves sibling anvil-rs/proto. anvil-rs wheel build and RayDP JAR packaging are merged into one RUN layer with shared proto usage and a single cleanup pass. Runtime pins bump lance-spark-bundle to 0.5.1 and pylance to 7.0.0 (from a minimum version).

^{Reviewed by Cursor Bugbot for commit 10654a9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Develop tag wrong branch
  • Updated workflow to run on main and develop branches instead of the feature branch, ensuring the :develop tag remains current after PR merge.

Or push these changes by commenting:

@cursor push f561177c8b

Preview (f561177c8b)

diff --git a/.github/workflows/publish-engine-base.yaml b/.github/workflows/publish-engine-base.yaml
--- a/.github/workflows/publish-engine-base.yaml
+++ b/.github/workflows/publish-engine-base.yaml
@@ -7,7 +7,7 @@
 
 on:
     push:
-        branches: [enwei/publish-engine-ghcr]
+        branches: [main, develop]
     workflow_dispatch:
 
 permissions:

_{You can send follow-ups to the cloud agent here.}

[cursor]

Develop tag wrong branch

Medium Severity

The workflow publishes ghcr.io/lumalabs/nurion-engine:develop but only runs on pushes to enwei/publish-engine-ghcr. After merge, pushes to develop or main will not rebuild that tag, so downstream FROM consumers can pull a :develop image that does not match the repository’s develop branch.

Additional Locations (1)

• .github/workflows/publish-engine-base.yaml#L47-L49

 

^{Reviewed by Cursor Bugbot for commit dd9248f. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Pylance pin unavailable on PyPI
  • Changed pylance==7.0.0 to pylance>=4.0.0 to match available PyPI versions and align with other configuration files.

Or push these changes by commenting:

@cursor push 4b6d245a1d

Preview (4b6d245a1d)

diff --git a/engine/Dockerfile b/engine/Dockerfile
--- a/engine/Dockerfile
+++ b/engine/Dockerfile
@@ -89,7 +89,7 @@
     pandas>=2.0.0 \
     click>=8.1.7 \
     "fsspec[s3]>=2024.6.0" \
-    pylance==7.0.0 \
+    "pylance>=4.0.0" \
     s3fs>=2024.6.0 \
     grpcio>=1.68.0

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 3b05556. Configure here.}

[cursor]

Pylance pin unavailable on PyPI

High Severity

The engine base image install step pins pylance==7.0.0 from the default PyPI index, but that exact release does not appear among versions resolved elsewhere in the repo from pypi.org, so uv pip install in the Docker build will likely fail and block the new publish workflow.

 

^{Reviewed by Cursor Bugbot for commit 3b05556. Configure here.}

[github-actions]

Coverage Report

Overall: 55%

Diff Coverage (changed files only)

Diff Coverage

Diff: origin/develop...HEAD, staged and unstaged changes

No lines with coverage information in this diff.