Bump shared Rust toolchain to 1.96.1, guard :latest on main#11
Merged
Conversation
Threshold just standardized its own Rust pin on 1.96.1 (rust-toolchain.toml + dtolnay/rust-toolchain@1.96.1 in CI); the shared image was still on 1.93.0, which would reintroduce version drift for any consumer once it migrates to the shared image family. Also guards the :latest tag so it only ever gets produced on pushes to main -- non-main dispatches (used to validate this exact change) now publish :staging instead, so testing a Dockerfile bump no longer overwrites the tag every consumer actually depends on. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MM1S4DNyxhwcbkMcx3hDp2
ScottMorris
added
infrastructure
4 tasks
ScottMorris
added a commit
that referenced
this pull request
Jul 8, 2026
## Summary `ci-desktop` is the only multi-platform image in this workflow (linux/amd64,linux/arm64). Building both platforms in one buildx invocation on an amd64 runner emulates arm64 via QEMU, which takes 2+ hours for this Dockerfile's from-source cargo installs (`tauri-cli`, `cargo-nextest`) -- confirmed directly on the currently-running validation of #11, where the arm64 leg alone ran past 2h40m. Splits the build into per-arch jobs -- amd64 on `ubuntu-24.04`, arm64 on GitHub's native `ubuntu-24.04-arm` runner (GA for public repos since August 2025; this repo is public) -- each pushing its image by digest, followed by a merge job that combines both digests into the final tagged manifest via `docker buildx imagetools create`. Neither leg touches QEMU. As a side benefit, each arch's smoke test now runs natively against its own image instead of only ever smoke-testing amd64 while trusting arm64 to work by cross-arch faith (the previous single-job design only ever set `smoke_platform: linux/amd64` even though it built both platforms for the real push). ## Test plan - [ ] Dispatch this workflow against this branch, confirm `build-ci-desktop`'s two matrix legs both complete natively (no QEMU) and noticeably faster than the ~2h40m baseline - [ ] Confirm `merge-ci-desktop` successfully combines both digests into one manifest and only produces `:staging`/`:sha-*` tags (not `:latest`, since this isn't `main`) - [ ] Pull the resulting `tauri-ci-desktop:staging` manifest and confirm both `linux/amd64` and `linux/arm64` platforms are present (`docker buildx imagetools inspect`) - [ ] After this merges (on top of #11), confirm a push to `main` produces a real `:latest` multi-arch manifest 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01MM1S4DNyxhwcbkMcx3hDp2
This was referenced Jul 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps
RUST_TOOLCHAINfrom 1.93.0 to 1.96.1 indocker/ci/Dockerfile. Threshold just standardized its own Rust pin on 1.96.1; the shared image was behind, which would reintroduce version drift the moment any consumer migrates onto it.Guards the
:latesttag so it's only produced on pushes tomain. Previously every run — including aworkflow_dispatchused just to validate a Dockerfile change — unconditionally overwrote:latestfor every consumer of these images. Non-main runs now publish:staginginstead, so validating a change no longer means shipping it to everyone first.Test plan
publish-imagesmatrix passes for all 4 images and that only:staging/:sha-*tags are produced (not:latest)tauri-ci-mobile:stagingand confirmrustc --versionreports 1.96.1mainproduces:latestas expected🤖 Generated with Claude Code
https://claude.ai/code/session_01MM1S4DNyxhwcbkMcx3hDp2