Fix base image builds and add PR compatibility validation for 1.29 patch prep

.github/workflows/docker-pr-compat.yml

@@ -0,0 +1,67 @@
+name: Docker PR Compatibility
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  build-compat-images:
+    runs-on: ubuntu-latest-16-cores
+    timeout-minutes: 30
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: "true"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker
+
+      - uses: actions/setup-go@v5
+        with:
+          cache-dependency-path: "**/*.sum"
+          go-version-file: "temporal/go.mod"
+
+      - name: Prepare build args
+        run: |
+          github_sha_short=${GITHUB_SHA:0:7}
+          echo "IMAGE_SHA_TAG=sha-${github_sha_short}" >> $GITHUB_ENV
+
+          branch_name=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}
+          echo "IMAGE_BRANCH_TAG=branch-${branch_name}" >> $GITHUB_ENV
+
+          TEMPORAL_SHA=$(git submodule status -- temporal | awk '{print $1}')
+          echo "TEMPORAL_SHA=${TEMPORAL_SHA}" >> $GITHUB_ENV
+          TCTL_SHA=$(git submodule status -- tctl | awk '{print $1}')
+          echo "TCTL_SHA=${TCTL_SHA}" >> $GITHUB_ENV
+
+      - name: Build Linux amd64 binaries
+        run: make amd64-bins
+
+      - name: Build base images from PR changes
+        run: |
+          docker build \
+            -f docker/base-images/base-server.Dockerfile \
+            -t temporaliotest/base-server:${IMAGE_SHA_TAG} \
+            docker/base-images
+
+          docker build \
+            -f docker/base-images/base-admin-tools.Dockerfile \
+            -t temporaliotest/base-admin-tools:${IMAGE_SHA_TAG} \
+            docker/base-images
+
+      - name: Build downstream images against PR base images
+        run: |
+          docker buildx bake \
+            -f docker-bake.hcl \
+            --set "*.platform=linux/amd64" \
+            --set "server.args.BASE_SERVER_IMAGE=temporaliotest/base-server:${IMAGE_SHA_TAG}" \
+            --set "admin-tools.args.BASE_ADMIN_TOOLS_IMAGE=temporaliotest/base-admin-tools:${IMAGE_SHA_TAG}" \
+            --load \
+            server admin-tools auto-setup

Makefile

@@ -141,4 +141,3 @@ update-alpine:
 update-base-images:
 	@printf $(COLOR) "Updating builds to use latest Temporal base images.."
 	./scripts/update-base-images.sh
-

docker/base-images/base-admin-tools.Dockerfile

@@ -1,4 +1,4 @@
-ARG BASE_IMAGE=alpine:3.23
+ARG BASE_IMAGE=alpine:3.23.3
 
 FROM ${BASE_IMAGE} AS builder
 
@@ -8,9 +8,16 @@ RUN apk add --update --no-cache \
     musl-dev \
     libev-dev \
     gcc \
+    g++ \
     pipx
 
-RUN pipx install --global cqlsh
+# cassandra-driver source builds still import pkg_resources via ez_setup.
+# Setuptools v82 removed pkg_resources: https://setuptools.pypa.io/en/latest/history.html#v82-0-0
+# On Alpine, cassandra-driver is built from source (no musllinux wheels), so pip's isolated
+# build env must be constrained to setuptools<81 or the build fails.
+RUN printf 'setuptools<81\n' > /tmp/pip-build-constraints.txt && \
+    PIP_CONSTRAINT=/tmp/pip-build-constraints.txt pipx install --global cqlsh && \
+    rm -f /tmp/pip-build-constraints.txt
 
 FROM ${BASE_IMAGE} AS base-admin-tools
 

docker/base-images/base-builder.Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine3.23 AS base-builder
+FROM golang:1.25.7-alpine3.23 AS base-builder
 
 RUN apk upgrade --no-cache
 RUN apk add --no-cache \

docker/base-images/base-ci-builder.Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine3.23 AS base-ci-builder
+FROM golang:1.25.7-alpine3.23 AS base-ci-builder
 
 RUN apk upgrade --no-cache
 RUN apk add --no-cache \

docker/base-images/base-server.Dockerfile

@@ -1,6 +1,6 @@
-ARG BASE_IMAGE=alpine:3.23
+ARG BASE_IMAGE=alpine:3.23.3
 
-FROM golang:1.25-alpine3.23 AS builder
+FROM golang:1.25.7-alpine3.23 AS builder
 
 ARG DOCKERIZE_VERSION=v0.9.2
 RUN go install github.com/jwilder/dockerize@${DOCKERIZE_VERSION}