[CI] Updated tflm-ci docker image (#3200)

This update improves the `tflm-ci` Docker image and CI stability using it:

- Pinned CI for Deterministic Builds: All GitHub workflows now use the pinned `tflm-ci:0.6.3` image. This replaces the latest tag to ensure all CI runs are deterministic.
- Upgraded Base Image: The Dockerfile now uses Debian bookworm instead of bullseye.
- Updated Dependencies:
  - `bazelisk` is updated to version 1.27.0.
  - `yapf` is updated to 0.40.2 for consistency with [this](https://github.com/tensorflow/tflite-micro/blob/eacd4c404d22ffce40b1f164fc77c6831f80d561/third_party/python_requirements.txt#L1170).
- Improved Documentation: The Dockerfile comment is expanded to include instructions on how to upload new image versions to ghcr.io.

BUG=Clean-up

Author: veblush

.github/workflows/check_tflite_files.yml

@@ -34,7 +34,7 @@ jobs:
           echo "${PR_FILES}" >> tmp_pull_request_files.txt
           rm -rf .git
           echo ${{ secrets.tflm-bot-token }} | docker login ghcr.io -u tflm-bot --password-stdin
-          docker run --rm -v `pwd`:/tflite-micro -w /tflite-micro ghcr.io/tflm-bot/tflm-ci:latest python3 ci/check_tflite_files.py tmp_pull_request_files.txt
+          docker run --rm -v `pwd`:/tflite-micro -w /tflite-micro ghcr.io/tflm-bot/tflm-ci:0.6.3 python3 ci/check_tflite_files.py tmp_pull_request_files.txt
           TFLITE_FILE_TEST_STATUS=$?
           rm -f tmp_pull_request_files.txt
           exit ${TFLITE_FILE_TEST_STATUS}

.github/workflows/ci.yml

@@ -259,7 +259,7 @@ jobs:
         with:
           ref: ${{ inputs.trigger-sha }}
       - name: Test
-        uses: docker://ghcr.io/tflm-bot/tflm-ci:latest
+        uses: docker://ghcr.io/tflm-bot/tflm-ci:0.6.3
         with:
           args: /bin/sh -c tensorflow/lite/micro/tools/ci_build/test_cortex_m_qemu.sh tflite-micro/
 
@@ -275,7 +275,7 @@ jobs:
         with:
           ref: ${{ inputs.trigger-sha }}
       - name: Check
-        uses: docker://ghcr.io/tflm-bot/tflm-ci:latest
+        uses: docker://ghcr.io/tflm-bot/tflm-ci:0.6.3
         with:
           args: /bin/sh -c "git config --global --add safe.directory /github/workspace && tensorflow/lite/micro/tools/ci_build/test_code_style.sh"
 

.github/workflows/riscv.yml

@@ -24,7 +24,7 @@ jobs:
           python-version: '3.10'
       - uses: actions/checkout@v3
       - name: Test
-        uses: docker://ghcr.io/tflm-bot/tflm-ci:latest
+        uses: docker://ghcr.io/tflm-bot/tflm-ci:0.6.3
         with:
           args: /bin/sh -c tensorflow/lite/micro/tools/ci_build/test_riscv.sh
 

.github/workflows/riscv_postmerge.yml

@@ -32,6 +32,6 @@ jobs:
       with:
         ref: ${{ inputs.trigger-sha }}
     - name: Test
-      uses: docker://ghcr.io/tflm-bot/tflm-ci:latest
+      uses: docker://ghcr.io/tflm-bot/tflm-ci:0.6.3
       with:
         args: /bin/sh -c tensorflow/lite/micro/tools/ci_build/test_riscv.sh

ci/Dockerfile.micro

@@ -1,22 +1,36 @@
-# This docker container can be used to run all the TFLM CI checks.
+# TFLM CI Docker Container
 #
-# It is only used as part of the GitHub workflows to test for code-style. But
-# the container is available and ready for use to run all the checks locally,
-# in case that is useful for debugging. See all the versions at
-# https://github.com/users/TFLM-bot/packages/container/tflm-ci/versions
+# This container includes all dependencies for TFLM CI checks and is
+# recommended for local debugging to ensure a consistent environment.
 #
-# docker pull ghcr.io/tflm-bot/tflm-ci:<version>
+# * Pull a prebuilt image:
+#   See all versions: https://github.com/users/TFLM-bot/packages/container/tflm-ci/versions
+#   docker pull ghcr.io/tflm-bot/tflm-ci:<version>
 #
-# Build you own container with:
-# docker build -f ci/Dockerfile.micro -t tflm-ci .
+# * Build locally:
+#   (Run from the root of the TFLM repository)
+#   docker build -f ci/Dockerfile.micro -t tflm-ci .
 #
+# * Build and upload to GHCR.IO:
+#   (Run from the root of the TFLM repository)
+#   (Update the TFLM_CI_VERSION variable below to your target version)
+#   export TFLM_CI_VERSION=0.6.3
+#   docker build -f ci/Dockerfile.micro -t ghcr.io/tflm-bot/tflm-ci:$TFLM_CI_VERSION .
+#   docker push ghcr.io/tflm-bot/tflm-ci:$TFLM_CI_VERSION
+#   (And you need to update github workflows to use this version.)
+#
+# * Run locally for debugging:
+#   (Mounts local repo and opens a shell)
+#   (Run from the root of the TFLM repository)
+#   docker run -it --rm -v $(pwd):/opt/tflm -w /opt/tflm tflm-ci /bin/bash
+
 # Use a prebuilt Python image instead of base Ubuntu to speed up the build process,
 # since it has all the build dependencies we need for Micro and downloads much faster
 # than the install process.
 
 # Using a multistage build so that the build tools required for stage 1 don't make the
 # CI container unnecessarily large.
-FROM python:3.10-bullseye AS qemu_builder
+FROM python:3.10-bookworm AS qemu_builder
 RUN apt-get update
 
 RUN apt-get install -y ninja-build wget xz-utils
@@ -28,7 +42,7 @@ COPY ci/install_qemu.sh ./
 RUN ./install_qemu.sh /tmp/qemu_install
 
 # This stage is the final CI container.
-FROM python:3.10-bullseye AS tflm-ci
+FROM python:3.10-bookworm AS tflm-ci
 
 RUN apt-get update
 
@@ -52,7 +66,7 @@ RUN git config --global --add safe.directory /github/workspace
 
 # Install yapf to check for Python formatting as part of the TFLM continuous
 # integration.
-RUN pip install yapf==0.32.0
+RUN pip install yapf==0.40.2
 
 # Pillow was added first for the C array generation as a result of the following
 # PRs:

ci/install_bazelisk.sh

@@ -15,8 +15,7 @@
 # ==============================================================================
 
 set -e
-wget https://github.com/bazelbuild/bazelisk/releases/download/v1.16.0/bazelisk-linux-amd64
+wget https://github.com/bazelbuild/bazelisk/releases/download/v1.27.0/bazelisk-linux-amd64
 mv bazelisk-linux-amd64 bazel
 chmod +x bazel
 mv bazel /usr/local/bin
-