Consolidate native image toolchains

Author: eamsden

.github/release-automation/docker/native-image-java23/dockerfile

@@ -54,7 +54,7 @@ case "$RELEASE_PLATFORM" in
   linux-amd64-musl)
     image_id_file=$(mktemp)
     docker build --iidfile "$image_id_file" \
-      "$trusted_root/.github/release-automation/docker/native-image-musl-java23" 1>&2
+      "$trusted_root/docker/native-image-musl" 1>&2
     docker run --rm -w /github/workspace -v "$PWD:/github/workspace" \
       "$(<"$image_id_file")" \
       ./gradlew "-PreleaseVersion=$release_version" -PnativeBuild -PnativeBuildMusl \
@@ -63,7 +63,7 @@ case "$RELEASE_PLATFORM" in
   linux-amd64 | linux-arm64)
     image_id_file=$(mktemp)
     docker build --iidfile "$image_id_file" \
-      "$trusted_root/.github/release-automation/docker/native-image-java23" 1>&2
+      "$trusted_root/docker/native-image" 1>&2
     docker run --rm -w /github/workspace -v "$PWD:/github/workspace" \
       "$(<"$image_id_file")" \
       ./gradlew "-PreleaseVersion=$release_version" -PnativeBuild \

.github/release-automation/docker/native-image-musl-java23/dockerfile

@@ -7,6 +7,8 @@ on:
       - ".github/scripts/temporal-release/**"
       - ".github/workflows/temporal-release-*.yml"
       - ".github/workflows/build-native-image.yml"
+      - "docker/native-image/**"
+      - "docker/native-image-musl/**"
       - "gradle/publishing.gradle"
       - "gradle/versioning.gradle"
   push:
@@ -17,6 +19,8 @@ on:
       - ".github/scripts/temporal-release/**"
       - ".github/workflows/temporal-release-*.yml"
       - ".github/workflows/build-native-image.yml"
+      - "docker/native-image/**"
+      - "docker/native-image-musl/**"
       - "gradle/publishing.gradle"
       - "gradle/versioning.gradle"
 
@@ -35,7 +39,7 @@ jobs:
       - name: Check shell syntax
         run: |
           for script in .github/scripts/temporal-release/*.sh \
-            .github/release-automation/docker/native-image-musl-java23/install-musl.sh; do
+            docker/native-image-musl/install-musl.sh; do
             bash -n "$script"
           done
       - name: Test exact GitHub artifact handling

.github/release-automation/docker/native-image-musl-java23/install-musl.sh

@@ -1,9 +1,13 @@
 # This Dockerfile builds a GraalVM Native Image Test Server with musl support.
-FROM ubuntu:24.04
+FROM ghcr.io/graalvm/native-image-community:23@sha256:5a28da013d97ac66033b6c836015c7ee7f5d3e07c705d51f1e6c26a04fd17b8e AS graalvm
+FROM ubuntu:24.04@sha256:561618e2c15bf2397621dd04f96926663a3b5616c189cf7e38db7e82f5c538ea
 ENV JAVA_HOME=/usr/lib64/graalvm/graalvm-community-java23
-COPY --from=ghcr.io/graalvm/native-image-community:23 $JAVA_HOME $JAVA_HOME
 ENV PATH="${JAVA_HOME}/bin:${PATH}"
-RUN apt-get -y update --allow-releaseinfo-change && apt-get install -y -V git build-essential curl ca-certificates binutils
+COPY --from=graalvm ${JAVA_HOME} ${JAVA_HOME}
+RUN apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+      git build-essential curl ca-certificates binutils make tar gzip && \
+    rm -rf /var/lib/apt/lists/*
 COPY install-musl.sh /opt/install-musl.sh
 RUN chmod +x /opt/install-musl.sh
 WORKDIR /opt
@@ -14,5 +18,5 @@ ENV MUSL_HOME=/opt/musl-toolchain
 ENV PATH="$MUSL_HOME/bin:$PATH"
 # Verify installation.
 RUN x86_64-linux-musl-gcc --version
-# Avoid errors like: "fatal: detected dubious ownership in repository".
+# Avoid errors like "fatal: detected dubious ownership in repository."
 RUN git config --global --add safe.directory '*'

.github/scripts/temporal-release/build-native-binary.sh

@@ -1,15 +1,23 @@
 # This Dockerfile builds a GraalVM Native Image Test Server with glibc support.
-# Use an old version of Ubuntu to build the test server to maintain compatibility with 
-# older versions of glibc, specifically glib 2.17.
-FROM ubuntu:18.04
+FROM ghcr.io/graalvm/native-image-community:23@sha256:5a28da013d97ac66033b6c836015c7ee7f5d3e07c705d51f1e6c26a04fd17b8e AS graalvm
+# Use an old Ubuntu base to retain compatibility with older glibc versions.
+FROM ubuntu:18.04@sha256:152dc042452c496007f07ca9127571cb9c29697f42acbfad72324b2bb2e43c98
 ENV JAVA_HOME=/usr/lib64/graalvm/graalvm-community-java23
-COPY --from=ghcr.io/graalvm/native-image-community:23 $JAVA_HOME $JAVA_HOME
 ENV PATH="${JAVA_HOME}/bin:${PATH}"
-RUN apt-get -y update --allow-releaseinfo-change && apt-get install -V -y software-properties-common
-RUN add-apt-repository -y ppa:ubuntu-toolchain-r/test
-RUN apt-get update
-# We need to update gcc and g++ to 10 for Graal to work on ARM64
-RUN apt-get install -y git build-essential zlib1g-dev gcc-10 g++-10
-RUN update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-10 60 --slave /usr/bin/g++ g++ /usr/bin/g++-10
-# Avoid errors like: "fatal: detected dubious ownership in repository"
-RUN git config --global --add safe.directory '*'
+COPY --from=graalvm ${JAVA_HOME} ${JAVA_HOME}
+# Install the GCC 10 toolchain required by GraalVM, trusting only the checked-in PPA key.
+COPY ubuntu-toolchain-r-test.asc /usr/share/keyrings/ubuntu-toolchain-r-test.asc
+RUN apt-get update --allow-releaseinfo-change && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+      ca-certificates && \
+    printf '%s\n' \
+      'deb [signed-by=/usr/share/keyrings/ubuntu-toolchain-r-test.asc] https://ppa.launchpadcontent.net/ubuntu-toolchain-r/test/ubuntu bionic main' \
+      > /etc/apt/sources.list.d/ubuntu-toolchain-r-test.list && \
+    apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+      git build-essential zlib1g-dev gcc-10 g++-10 && \
+    update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-10 60 \
+      --slave /usr/bin/g++ g++ /usr/bin/g++-10 && \
+    rm -rf /var/lib/apt/lists/*
+# Avoid errors like "fatal: detected dubious ownership in repository."
+RUN git config --global --add safe.directory '*'