feat(nix/docker)Cli docker image size reduce

.github/workflows/docker-image-test.yml

@@ -0,0 +1,100 @@
+name: Docker Image Test
+
+on:
+  workflow_call:
+    secrets:
+      DEV_AWS_ROLE:
+        required: true
+      NIX_SIGN_SECRET_KEY:
+        required: true
+  workflow_dispatch:
+    inputs:
+      dockerfile:
+        description: 'Specific Dockerfile to test (leave empty for all)'
+        required: false
+        default: ''
+        type: string
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  docker-image-test:
+    name: Test ${{ matrix.dockerfile }}
+    runs-on: large-linux-arm
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        dockerfile:
+          - Dockerfile-15
+          - Dockerfile-17
+          - Dockerfile-orioledb-17
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Install nix
+        uses: ./.github/actions/nix-install-ephemeral
+        with:
+          push-to-cache: 'false'
+        env:
+          DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }}
+          NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }}
+
+      - name: Create Docker context
+        run: docker context create builders
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        with:
+          endpoint: builders
+
+      - name: Build Docker image
+        run: |
+          echo "Building ${{ matrix.dockerfile }}..."
+          docker build -f ${{ matrix.dockerfile }} -t supabase-postgres:${{ matrix.dockerfile }}-test .
+
+      - name: Run image size analysis
+        run: |
+          echo "=== Image Size Analysis for ${{ matrix.dockerfile }} ==="
+          # Build the analyzer tag expected by the tool
+          VERSION="${{ matrix.dockerfile }}"
+          VERSION="${VERSION#Dockerfile-}"
+          docker tag supabase-postgres:${{ matrix.dockerfile }}-test "supabase-postgres:${VERSION}-analyze"
+
+          nix run --accept-flake-config .#image-size-analyzer -- --image ${{ matrix.dockerfile }} --no-build
+
+      - name: Run Docker image tests
+        run: |
+          echo "=== Running tests for ${{ matrix.dockerfile }} ==="
+          # Tag with the expected name for test-docker-image.sh
+          VERSION="${{ matrix.dockerfile }}"
+          VERSION="${VERSION#Dockerfile-}"
+          docker tag supabase-postgres:${{ matrix.dockerfile }}-test "pg-docker-test:${VERSION}"
+
+          ./test-docker-image.sh --no-build ${{ matrix.dockerfile }}
+
+      - name: Show container logs on failure
+        if: failure()
+        run: |
+          VERSION="${{ matrix.dockerfile }}"
+          VERSION="${VERSION#Dockerfile-}"
+          CONTAINER_NAME=$(docker ps -a --filter "name=pg-test-${VERSION}" --format "{{.Names}}" | head -1)
+          if [[ -n "$CONTAINER_NAME" ]]; then
+            echo "=== Container logs for $CONTAINER_NAME ==="
+            docker logs "$CONTAINER_NAME" 2>&1 || true
+          fi
+
+      - name: Cleanup
+        if: always()
+        run: |
+          VERSION="${{ matrix.dockerfile }}"
+          VERSION="${VERSION#Dockerfile-}"
+          # Remove test containers
+          docker ps -a --filter "name=pg-test-${VERSION}" -q | xargs -r docker rm -f || true
+          # Remove test images
+          docker rmi "supabase-postgres:${{ matrix.dockerfile }}-test" || true
+          docker rmi "supabase-postgres:${VERSION}-analyze" || true
+          docker rmi "pg-docker-test:${VERSION}" || true

.github/workflows/nix-build.yml

@@ -213,3 +213,15 @@ jobs:
       (needs.nix-build-packages-x86_64-linux.result == 'skipped' || needs.nix-build-packages-x86_64-linux.result == 'success') &&
       (needs.nix-build-checks-x86_64-linux.result == 'skipped' || needs.nix-build-checks-x86_64-linux.result == 'success')
     uses: ./.github/workflows/test.yml
+
+  docker-image-test:
+    needs: [nix-eval, nix-build-packages-aarch64-linux, nix-build-checks-aarch64-linux]
+    if: |
+      !cancelled() &&
+      needs.nix-eval.result == 'success' &&
+      (needs.nix-build-packages-aarch64-linux.result == 'skipped' || needs.nix-build-packages-aarch64-linux.result == 'success') &&
+      (needs.nix-build-checks-aarch64-linux.result == 'skipped' || needs.nix-build-checks-aarch64-linux.result == 'success')
+    uses: ./.github/workflows/docker-image-test.yml
+    secrets:
+      DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }}
+      NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }}