.github/workflows/docker.yml, tox.ini: Use the commit sha before merging the CI fixes as the DOCKER_TAG

Author: Matthias Koeppe

.github/workflows/docker.yml

@@ -179,12 +179,6 @@ jobs:
           (export PATH=$(pwd)/build/bin:$PATH; (cd upstream && bash -x update-pkgs.sh) && sed -i.bak '/upstream/d' .dockerignore && echo "/:toolchain:/i ADD upstream upstream" | sed -i.bak -f - build/bin/write-dockerfile.sh && git diff)
         if: inputs.upstream_artifact
 
-      - name: Merge CI fixes from sagemath/sage
-        run: |
-          .ci/merge-fixes.sh
-        env:
-          GH_TOKEN: ${{ github.token }}
-
       - name: Try to login to ghcr.io
         if: inputs.docker_push_repository != ''
         # https://docs.github.com/en/actions/reference/workflow-commands-for-github-actions#setting-an-environment-variable
@@ -197,6 +191,9 @@ jobs:
               echo "DOCKER_PUSH_REPOSITORY=$(echo ${{ inputs.docker_push_repository }} | tr "[:upper:]" "[:lower:]")" >> $GITHUB_ENV
               echo "DOCKER_CONFIG_FILE=$HOME/.docker/config.json" >> $GITHUB_ENV
             fi
+            # This line needs to be run before the step "Merge CI fixes from sagemath/sage".
+            DOCKER_TAG="$(git describe --dirty --always)"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
             # From the docker documentation via .ci/update-env.sh:
             # "A tag name must be valid ASCII and may
             # contain lowercase and uppercase letters, digits, underscores, periods and
@@ -211,6 +208,15 @@ jobs:
                 EXTRA_DOCKER_TAGS="dev $EXTRA_DOCKER_TAGS";;
             esac
             echo "EXTRA_DOCKER_TAGS=$EXTRA_DOCKER_TAGS" >> $GITHUB_ENV
+
+      - name: Merge CI fixes from sagemath/sage
+        # This step needs to happen after the commit sha is put in DOCKER_TAG
+        # so that multi-stage builds can work correctly.
+        run: |
+          .ci/merge-fixes.sh
+        env:
+          GH_TOKEN: ${{ github.token }}
+
       - name: Configure and build Sage distribution within a Docker container
         run: |
           set -o pipefail; EXTRA_DOCKER_BUILD_ARGS="--build-arg NUMPROC=4 --build-arg USE_MAKEFLAGS=\"-k V=0 SAGE_NUM_THREADS=3\"" tox -e $TOX_ENV -- $TARGETS 2>&1 | sed "/^configure: notice:/s|^|::warning file=artifacts/$LOGS_ARTIFACT_NAME/config.log::|;/^configure: warning:/s|^|::warning file=artifacts/$LOGS_ARTIFACT_NAME/config.log::|;/^configure: error:/s|^|::error file=artifacts/$LOGS_ARTIFACT_NAME/config.log::|;"

tox.ini

@@ -142,6 +142,7 @@ passenv =
                   TARGETS_OPTIONAL
     docker:       EXTRA_DOCKER_BUILD_ARGS
     docker:       EXTRA_DOCKER_TAGS
+    docker:       DOCKER_TAG
                   # Use DOCKER_BUILDKIT=1 for new version - for which unfortunately we cannot save failed builds as an image
     docker:       DOCKER_BUILDKIT
     docker:       BUILDKIT_INLINE_CACHE
@@ -699,7 +700,7 @@ commands =
     docker:        bash -c 'for docker_target in {env:DOCKER_TARGETS:with-targets}; do \
     docker:            BUILD_IMAGE_STEM=sage-$(echo {envname} | sed "s/docker-//;s/-incremental//"); \
     docker:            BUILD_IMAGE=$DOCKER_PUSH_REPOSITORY$BUILD_IMAGE_STEM-$docker_target; \
-    docker:            BUILD_TAG=$(git describe --dirty --always); \
+    docker:            BUILD_TAG={env:DOCKER_TAG:$(git describe --dirty --always)}; \
     docker:            TAG_ARGS=$(for tag in $BUILD_TAG {env:EXTRA_DOCKER_TAGS:}; do echo --tag $BUILD_IMAGE:$tag; done); \
     docker:            DOCKER_BUILDKIT={env:DOCKER_BUILDKIT:0} \
     docker:            docker build . -f {envdir}/Dockerfile \