feat(build): isolate maintainer build logic to a dedicated pipeline file

.gcp/maintainer-worker.yml

@@ -0,0 +1,36 @@
+steps:
+  # Step 1: Install root dependencies
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Install Dependencies'
+    entrypoint: 'npm'
+    args: ['install']
+
+  # Step 2: Authenticate for Docker
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Authenticate docker'
+    entrypoint: 'npm'
+    args: ['run', 'auth']
+
+  # Step 3: Build workspace packages
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Build packages'
+    entrypoint: 'npm'
+    args: ['run', 'build:packages']
+
+  # Step 4: Build Maintainer Image
+  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
+    id: 'Build Maintainer Image'
+    entrypoint: 'bash'
+    args:
+      - '-c'
+      - |-
+        # Use commit SHA for PR builds to ensure isolation
+        IMAGE_BASE="us-docker.pkg.dev/gemini-code-dev/gemini-cli/maintainer"
+        TAG="${SHORT_SHA}"
+        
+        docker build -f .gcp/Dockerfile.maintainer -t "$${IMAGE_BASE}:$${TAG}" .
+        docker push "$${IMAGE_BASE}:$${TAG}"
+
+options:
+  defaultLogsBucketBehavior: 'REGIONAL_USER_OWNED_BUCKET'
+  dynamicSubstitutions: true

.gcp/release-docker.yml

@@ -35,7 +35,7 @@ steps:
         echo "Determined image tag: $$FINAL_TAG"
         echo "$$FINAL_TAG" > /workspace/image_tag.txt
 
-  # Step 5: Build sandbox container image (Final stage)
+  # Step 5: Build sandbox container image
   - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
     id: 'Build sandbox Docker image'
     entrypoint: 'bash'
@@ -43,24 +43,11 @@ steps:
       - '-c'
       - |-
         export GEMINI_SANDBOX_IMAGE_TAG=$$(cat /workspace/image_tag.txt)
+        echo "Using Docker image tag for build: $$GEMINI_SANDBOX_IMAGE_TAG"
         npm run build:sandbox -- --output-file /workspace/final_image_uri.txt
     env:
       - 'GEMINI_SANDBOX=$_CONTAINER_TOOL'
 
-  # Step 6: Build maintainer container image (Dedicated Maintainer Dockerfile)
-  - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
-    id: 'Build maintainer Docker image'
-    entrypoint: 'bash'
-    args:
-      - '-c'
-      - |-
-        export TAG=$$(cat /workspace/image_tag.txt)
-        IMAGE_BASE="us-docker.pkg.dev/gemini-code-dev/gemini-cli/maintainer"
-        docker build -f .gcp/Dockerfile.maintainer -t "$${IMAGE_BASE}:$${TAG}" .
-        docker push "$${IMAGE_BASE}:$${TAG}"
-    env:
-      - 'GEMINI_SANDBOX=$_CONTAINER_TOOL'
-
   # Step 8: Publish sandbox container image
   - name: 'us-west1-docker.pkg.dev/gemini-code-dev/gemini-code-containers/gemini-code-builder'
     id: 'Publish sandbox Docker image'
@@ -70,6 +57,8 @@ steps:
       - |-
         set -e
         FINAL_IMAGE_URI=$$(cat /workspace/final_image_uri.txt)
+
+        echo "Pushing sandbox image: $${FINAL_IMAGE_URI}"
         $_CONTAINER_TOOL push "$${FINAL_IMAGE_URI}"
     env:
       - 'GEMINI_SANDBOX=$_CONTAINER_TOOL'