codeant-ai-for-open-source[bot] commented on code in PR #42045:
URL: https://github.com/apache/superset/pull/42045#discussion_r3584297497
##########
RELEASING/Dockerfile.from_local_tarball:
##########
@@ -14,7 +14,7 @@
# See the License for the specific language governing permissions and
# limitations under the License.
#
-FROM python:3.10-slim-trixie
+FROM python:3.11-slim-trixie
Review Comment:
**Suggestion:** The base image is now a floating tag (`3.11-slim-trixie`)
instead of a pinned patch version, which makes release-tarball builds
non-deterministic and can break unexpectedly when upstream Python/Debian images
change; align this with the pinned version used in the main `Dockerfile` (or a
shared build arg) to keep release artifacts reproducible and consistent with
tested runtime. [possible bug]
<details>
<summary><b>Severity Level:</b> Critical 🚨</summary>
```mdx
- ❌ Tarball-based Docker images become unreproducible across release runs.
- ⚠️ Runtime base diverges from main Dockerfile pinned image.
- ⚠️ Release candidate validation may miss issues from base change.
```
</details>
<details>
<summary><b>Steps of Reproduction ✅ </b></summary>
```mdx
1. Prepare a Superset release candidate tarball and set SUPERSET_VERSION_RC,
then run
`RELEASING/test_run_tarball.sh local` (script at
`/workspace/superset/RELEASING/test_run_tarball.sh:10-21`) to build a Docker
image from
the source tarball.
2. Observe that the script executes `docker build --no-cache -t
apache-superset:${SUPERSET_VERSION_RC} -f Dockerfile.from_local_tarball .
...` as shown at
`RELEASING/test_run_tarball.sh:16-21`, which uses
`RELEASING/Dockerfile.from_local_tarball` as the build recipe.
3. In `RELEASING/Dockerfile.from_local_tarball:17`, note the base image line
`FROM
python:3.11-slim-trixie`, which is a floating tag that upstream
Python/Debian maintainers
can retarget to newer patch or OS variants over time.
4. Compare with the main runtime Dockerfile at
`/workspace/superset/Dockerfile:21` and
`:110`, where the base image is pinned via `ARG PY_VER=3.11.14-slim-trixie`
and `FROM
python:${PY_VER}`; when upstream updates the floating
`python:3.11-slim-trixie` tag,
tarball-based release builds will silently shift to a different base than
the pinned
`3.11.14-slim-trixie`, making these artifacts unreproducible and potentially
diverging
from the CI-tested runtime.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=a24c147ff3c442f78e17283170cbd942&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=a24c147ff3c442f78e17283170cbd942&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** RELEASING/Dockerfile.from_local_tarball
**Line:** 17:17
**Comment:**
*Possible Bug: The base image is now a floating tag
(`3.11-slim-trixie`) instead of a pinned patch version, which makes
release-tarball builds non-deterministic and can break unexpectedly when
upstream Python/Debian images change; align this with the pinned version used
in the main `Dockerfile` (or a shared build arg) to keep release artifacts
reproducible and consistent with tested runtime.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F42045&comment_hash=cca787e57de2a9883103ba18fd24eb321885463400ad07195308c2568cbb804b&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F42045&comment_hash=cca787e57de2a9883103ba18fd24eb321885463400ad07195308c2568cbb804b&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
