images: shared task base, code-last layers, no per-push rebuilds [skip ci]

One base (Temurin 21 JDK, node/npm/tsc, php/composer, maven, sqlite, bwrap)
built only when its Dockerfile or dependencies change, plus a browser variant;
engine/search/VM images FROM base@sha256 with the code in the last layer; the
image workflow runs on dispatch, tags, Dockerfile or pin changes, with a build
cache. Executor NPROC bound relative to the current process count.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

plane/Dockerfile.engine-task

@@ -1,23 +1,15 @@
-# Build from the repository root. AX v0.3.1 starts spec.command immediately;
-# preserve its runner as PID 1 and put the engine command in the Task manifest.
-FROM eclipse-temurin:21-jre-jammy AS jre
-
-FROM ghcr.io/norandom/ax-task-runner:v0.3.1 AS engine
-LABEL org.opencontainers.image.licenses="Apache-2.0" \
-      org.opencontainers.image.source="https://github.com/norandom/OpenUltraSAST"
-
-USER root
+# syntax=docker/dockerfile:1
+# Supply digests from plane/task-base.digest; deliberately no floating fallback.
+ARG TASK_BASE_TAG=base-unpublished
+ARG TASK_BASE_DIGEST
+ARG ENGINE_REF=engine
+FROM ghcr.io/norandom/ousast-task-base:${TASK_BASE_TAG}@${TASK_BASE_DIGEST} AS joern-build
+ENV PATH="/opt/joern-cli:${PATH}"
 ARG JOERN_VERSION=v4.0.625
 ARG ARCHIVE=joern-cli-linux-x86_64.zip
 
-# The AX runner is Python 3.12 / Debian slim. Copy the Java 21 runtime from
-# Jammy (older glibc than Debian bookworm) instead of relying on distro JRE versions.
-COPY --from=jre /opt/java/openjdk /opt/java/openjdk
-ENV JAVA_HOME=/opt/java/openjdk
-ENV PATH="/venv/bin:/opt/java/openjdk/bin:/opt/joern-cli:${PATH}"
 RUN apt-get update \
- && apt-get install -y --no-install-recommends \
-      php-cli unzip curl ca-certificates libstdc++6 zlib1g \
+ && apt-get install -y --no-install-recommends curl unzip \
  && rm -rf /var/lib/apt/lists/*
 
 RUN set -eux; \
@@ -37,24 +29,20 @@ COPY ops/frontend-retention/install.py /tmp/frontend-retention-install.py
 RUN python3 /tmp/frontend-retention-install.py /opt/joern-cli \
  && rm /tmp/frontend-retention-install.py
 
+FROM ghcr.io/norandom/ousast-task-base:${TASK_BASE_TAG}@${TASK_BASE_DIGEST} AS engine
+ENV PATH="/opt/joern-cli:${PATH}"
+COPY --from=joern-build /opt/joern-cli /opt/joern-cli
 WORKDIR /app
 COPY pyproject.toml README.md LICENSE ./
 COPY src ./src
+RUN --mount=type=cache,target=/root/.cache/pip \
+    /venv/bin/pip install --no-deps --no-cache-dir .
 COPY benchmarks/learn/engine_task_entry.py \
      benchmarks/learn/engine_trace_worker.py \
      benchmarks/learn/engine_trace_parse.py ./benchmarks/learn/
-# Worker imports are standard-library plus engine modules. Isolate them from
-# the AX runner's Python environment and omit PyYAML, boto3 and all extras.
-RUN python3 -m venv /venv \
- && /venv/bin/pip install --no-cache-dir --no-deps . \
- && /venv/bin/python -I -c 'import pathlib, runpy, sys; sys.modules.update(yaml=None, boto3=None); sys.path.insert(0, "/app/benchmarks/learn"); p = pathlib.Path("/app/benchmarks/learn/engine_trace_worker.py"); print("Worker import smoke bytes:", len(p.read_bytes())); runpy.run_path(str(p), run_name="engine_worker_import_smoke")'
+RUN /venv/bin/python -I -c 'import pathlib, runpy, sys; sys.modules.update(yaml=None, boto3=None); sys.path.insert(0, "/app/benchmarks/learn"); p = pathlib.Path("/app/benchmarks/learn/engine_trace_worker.py"); print("Worker import smoke bytes:", len(p.read_bytes())); runpy.run_path(str(p), run_name="engine_worker_import_smoke")'
+# ENTRYPOINT and CMD belong to the upstream AX runner.
 
-# Do not set ENTRYPOINT or CMD: both belong to the upstream AX runner.
-
-FROM engine AS replay
-RUN apt-get update \
- && apt-get install -y --no-install-recommends git \
- && rm -rf /var/lib/apt/lists/*
+FROM ${ENGINE_REF} AS replay
 COPY benchmarks/unseen/replay_entry.py ./benchmarks/unseen/replay_entry.py
-RUN /venv/bin/pip install --no-cache-dir . \
- && /venv/bin/ousast pre-push --help > /dev/null
+RUN /venv/bin/ousast pre-push --help > /dev/null