containers: no validation runs before the tag every consumer pins moves

Container changes get no automated signal until after they are merged and published. The merge that first builds an image is the same event that pushes :latest, which every consumer pins — so the window between "broken image built" and "broken image live in seven lecture repos" is zero.

Today

build-containers.yml:3-17 triggers on push to main (paths containers/**), the weekly cron, and dispatch. There is no pull_request trigger anywhere for container builds. Both build steps are push: true to a latest tag (:62/:70 and :104/:110).

test-container.yml:6-11 fires only on workflow_dispatch or a completed build run, and :33 hardcodes ghcr.io/quantecon/${{ matrix.image }}:latest — the smoke suite is structurally incapable of testing anything but an already-published image.

The action harness does not cover this and currently disguises it: test-actions.yml triggers on pull_request but never builds or pulls an image, and the gate's IGNORED regex (:112) does not list containers/. A containers-only PR therefore runs the full harness and reports the required check Action harness: all checks green, having asserted nothing whatsoever about the image. That is the "green that reads as coverage" defect #108 was filed about, relocated.

The exposure is not hypothetical: #28 (stack drift breaking lecture execution), #85 (kaleido/Chrome), #103 (publish pipeline) were all image defects, and Dependabot proposes conda and docker bumps against both container directories weekly with nothing validating them.

Phase 1 — validate on the PR

• On pull_request touching containers/**, detect which image directories changed and build only those, with cache-from the published :latest to keep it minutes rather than a cold hour
• Push to a PR-scoped tag (pr-<N>), never :latest, and run the existing containers/quantecon/tests/smoke-test.sh against it in a needs: job with container: ghcr.io/quantecon/<image>:pr-<N>
• Delete the PR tag when the PR closes
• Add containers/ to the harness relevance gate, or make the container job part of the required check, so a containers-only PR can no longer report green from jobs that never touched an image
• Skip on forks (github.event.pull_request.head.repo.fork == false) — do not reach for pull_request_target, see #105

Do not copy the shape the audit that prompted this suggested (push: false + load: true + docker run). A locally-loaded image cannot back a container: block, and docker run is the HOME=/root execution mode that #125 deliberately replaced — it is the reason #85 escaped the smoke tests in the first place. Pushing a PR-scoped tag keeps the real container: job semantics.

Phase 2 — gate the tag itself

Even with phase 1, the weekly cron and any direct push still move :latest before a test meets it. lecture-dp's weekly cache build crons at 0 2 * * 1, the same minute build-containers.yml does, against quantecon-build:latest.

• Publish only the main-<sha> tag from build-containers.yml, run the smoke suite against that tag, and retag :latest on green

This is the same structural flaw that made action release-gating P0 (#135, #136, #138) — an artifact reaching consumers before anything verified it — applied to the container tag instead of the action ref. Worth sequencing after #136 so it reuses whatever that lands, and cheap now that smoke-test.sh exists and runs in minutes.

Related

#108 — this makes its fixture changes (theme, fontpkg) validatable on the PR instead of by manual dispatch. #100's coverage table should record that containers are covered post-merge only. #141 — the matrix that is currently the only post-publish safety net has been silently red for three weeks.

Start with .github/workflows/build-containers.yml, test-container.yml, and test-actions.yml, then read containers/quantecon/tests/smoke-test.sh. Trace the existing image tags, triggers, and harness gate before testing the current smoke workflow. Done means pull requests validate changed images without moving :latest, relevant checks cannot pass without container coverage, and the published tag is gated by the smoke suite.