Add pull-or-build fallback to source code, always build in tests

Add pull_or_build_image static method to ContainerConnection that
tries to pull images from GHCR first and falls back to local build.
Apply it to MySQLServer, MySQLMgmt, and Superset container runs.
Revert test workflow to always build images locally since tests
validate the latest code, not published images.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: szachovy

.github/workflows/tests.yml

@@ -47,28 +47,25 @@ jobs:
         run: "terraform apply --auto-approve"
         working-directory: "${{ env.TERRAFORM_WORKING_DIRECTORY }}"
 
-      - name: "Pull or build service images and pre-load into test containers"
+      - name: "Build and pre-load service images into test containers"
         run: |
-          pull_or_build_and_load() {
+          build_and_load() {
             local image_name="$1"
             local build_context="$2"
             shift 2
             local nodes=("$@")
-            if ! docker pull "${image_name}:latest" 2>/dev/null; then
-              echo "Pull failed for ${image_name}:latest, building locally"
-              docker build --quiet -t "${image_name}:latest" "$build_context"
-            fi
+            docker build --quiet -t "${image_name}:latest" "$build_context"
             for node in "${nodes[@]}"; do
               docker save "${image_name}:latest" | docker exec -i "$node" docker load
             done
             docker rmi "${image_name}:latest" || true
             docker image prune --force
           }
-          pull_or_build_and_load "ghcr.io/szachovy/superset-cluster-mysql-server" \
+          build_and_load "ghcr.io/szachovy/superset-cluster-mysql-server" \
             "services/mysql-server" node-2 node-3 node-4
-          pull_or_build_and_load "ghcr.io/szachovy/superset-cluster-mysql-mgmt" \
+          build_and_load "ghcr.io/szachovy/superset-cluster-mysql-mgmt" \
             "services/mysql-mgmt" node-0 node-1
-          pull_or_build_and_load "ghcr.io/szachovy/superset-cluster-superset-service" \
+          build_and_load "ghcr.io/szachovy/superset-cluster-superset-service" \
             "services/superset" node-0 node-1
           docker image prune --all --force
 

CHANGELOG.md

@@ -14,12 +14,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * CodeQL code scanning workflow for Python static analysis. (#29)
 * Dependabot updates for `github-actions` and `terraform` ecosystems. (#29)
 * CI workflow to build and push service images to GitHub Container Registry on master merge. (#97)
+* Pull-first with local build fallback for container images during deployment. (#97)
 
 ### Changed
 
 * Completed [ARCHITECTURE.md](./docs/ARCHITECTURE.md) (#93)
 * Migrated CI from self-hosted to GitHub-hosted runners with Docker-in-Docker test infrastructure. (#94)
-* Test workflow pulls pre-built images from GHCR with local build fallback. (#97)
+* Test workflow always builds service images locally for reproducibility. (#97)
 
 ### Fixed
 

src/container.py

@@ -100,6 +100,13 @@ def __init__(self, container: str | None) -> None:
         self.client = docker.from_env()
         self.container = container
 
+    @staticmethod
+    def pull_or_build_image(client: docker.client.DockerClient, image: str, build_context: str) -> None:
+        try:
+            client.images.pull(image)
+        except docker.errors.APIError:
+            client.images.build(path=build_context, tag=image)
+
     def run_command_on_the_container(
             self,
             command: str,
@@ -210,14 +217,18 @@ def __init__(self, client: docker.client.DockerClient, container: str) -> None:
                 self.healthcheck_retries = 3
 
             def run(self) -> None:
+                image = "ghcr.io/szachovy/superset-cluster-mysql-server:latest"
+                ContainerConnection.pull_or_build_image(
+                    self.client, image, "/opt/superset-cluster/mysql-server"
+                )
                 with open(
                     file="/opt/superset-cluster/mysql-server/seccomp.json",
                     mode="r",
                     encoding="utf-8"
                 ) as seccomp:
                     seccomp_parsed = json.dumps(json.load(seccomp), separators=(',', ':'))
                 self.client.containers.run(
-                    "ghcr.io/szachovy/superset-cluster-mysql-server:latest",
+                    image,
                     detach=True,
                     name=self.container,
                     hostname=socket.gethostname(),
@@ -317,6 +328,11 @@ def setup_env(self) -> None:
 
             def run(self) -> None:
                 self.setup_env()
+                ContainerConnection.pull_or_build_image(
+                    docker.from_env(),
+                    "ghcr.io/szachovy/superset-cluster-mysql-mgmt:latest",
+                    "/opt/superset-cluster/mysql-mgmt"
+                )
                 subprocess.run(" \
                     docker \
                       compose \
@@ -417,9 +433,13 @@ def create_mysql_superset_password_secret(self) -> str:
                 ).id
 
             def run(self) -> None:
+                image = "ghcr.io/szachovy/superset-cluster-superset-service:latest"
+                ContainerConnection.pull_or_build_image(
+                    self.client, image, "/opt/superset-cluster/superset"
+                )
                 self.client.services.create(
                     name="superset",
-                    image="ghcr.io/szachovy/superset-cluster-superset-service:latest",
+                    image=image,
                     networks=["superset-network"],
                     secrets=[
                         docker.types.SecretReference(