✨ feat: Dockerimage module for unified builds

[jpmcb]

Build automation for docker image based builds / releases. Much of this is already covered in papercomputeco/tapes and should get hoisted here.

Refs PCC-1166

[linear-code]

PCC-1166

[greptile-apps]

Greptile Summary

The PR adds a reusable Dagger module for building and publishing multi-platform Dockerfile images, along with fixtures, documentation, dependencies, and CI coverage. The new pull-request job currently exposes a repository credential to checked-out PR code.

• Adds configurable build arguments, Dockerfile paths, target platforms, and multi-tag publishing.
• Adds amd64 and arm64 fixture builds to pull-request CI.
• Updates the module catalog and Nix lockfile.

Confidence Score: 1/5

The PR is not safe to merge until pull-request-controlled build code is isolated from DAGGER_CLOUD_TOKEN and the outstanding mutable action references are pinned.

The new job checks out pull-request changes and executes their Makefile, Dagger module, and build inputs with a repository credential, creating a direct disclosure path for same-repository pull requests; the previously reported mutable Dagger action references also remain in token-bearing jobs.

Files Needing Attention: .github/workflows/pr.yaml and dockerimage/Makefile

Security Review

The new Docker image CI job executes checked-out pull-request code with DAGGER_CLOUD_TOKEN in its environment, allowing a same-repository pull-request author to disclose the credential. The previously reported mutable dagger/dagger-for-github@v8.2.0 references also remain outstanding.

Important Files Changed

Filename	Overview
.github/workflows/pr.yaml	Adds Docker image CI, but executes checked-out pull-request code with a repository token and retains previously reported mutable action references.
dockerimage/main.go	Implements configurable Dockerfile builds and sequential multi-platform publication for each requested tag.
dockerimage/Makefile	Adds amd64 and arm64 fixture builds and forms part of the pull-request-controlled command path receiving the CI credential.
dockerimage/go.mod	Defines the generated Dagger module's Go dependencies and compatibility replacements.
dockerimage/fixtures/Dockerfile	Provides a build-only fixture that verifies build-argument propagation.

Sequence Diagram

sequenceDiagram
    participant PR as Pull request
    participant CI as GitHub Actions
    participant Build as PR-controlled build code
    participant Cloud as External endpoint
    PR->>CI: Trigger pull_request workflow
    CI->>CI: Checkout proposed changes
    CI->>Build: Run make test with DAGGER_CLOUD_TOKEN
    Build-->>Cloud: Token can be transmitted

Loading

Prompt To Fix All With AI

### Issue 1
.github/workflows/pr.yaml:36
**PR code receives repository token**

If same-repository pull requests receive `DAGGER_CLOUD_TOKEN`, this job checks out the proposed changes and runs their Makefile, Nix environment, Dagger module, and Dockerfile with that credential, allowing the pull-request author to transmit the token. **How this was verified:** The `pull_request` job executes `make -C dockerimage test` from the checked-out changes with `DAGGER_CLOUD_TOKEN` in its environment.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (2): Last reviewed commit: "✨ feat: Dockerimage module for unified b..." | Re-trigger Greptile}

[greptile-apps]

PR code receives repository token

If same-repository pull requests receive DAGGER_CLOUD_TOKEN, this job checks out the proposed changes and runs their Makefile, Nix environment, Dagger module, and Dockerfile with that credential, allowing the pull-request author to transmit the token. How this was verified: The pull_request job executes make -C dockerimage test from the checked-out changes with DAGGER_CLOUD_TOKEN in its environment.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/pr.yaml
Line: 36

Comment:
**PR code receives repository token**

If same-repository pull requests receive `DAGGER_CLOUD_TOKEN`, this job checks out the proposed changes and runs their Makefile, Nix environment, Dagger module, and Dockerfile with that credential, allowing the pull-request author to transmit the token. **How this was verified:** The `pull_request` job executes `make -C dockerimage test` from the checked-out changes with `DAGGER_CLOUD_TOKEN` in its environment.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[jpmcb]

This is fine and a pattern we have throughout the papercomputeco org: "same-repository pull requests" are from only internal, trusted contributors (i.e., employees).