[SAT-218] fix docker build

[Cristianetaniguti]

BIGapp docker image has two components, one image just for the dependencies and then the main image that is build on the dependencies. This structure was created to avoid long building time for small updates once BIGapp is BIG.
The dependencies one needs to be updated manually when it becomes deprecated.
This bugfix makes evident when the package fails to install on the main image, throwing a clear error and stopping the build. The previous behavior would fail in silent and still build the image without BIGapp.
After failing is triggered, the dependencies image should be adapted and re-runned.

[Copilot]

🟡 Changes recommended

Unresolved workflow, dependency-installation, and cache correctness issues remain.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR improves BIGapp Docker dependency and application builds by validating package installation and publishing versioned dependency images.

Changes:

• Adds explicit BIGapp installation validation and build failures.
• Updates dependency-image tagging, caching, and multi-architecture publishing.
• Configures CI to build application images from dependency images.

File summaries

File	Summary	Findings
inst/update_dep_image.sh	Builds and publishes dependency images.	Moderate: Pass DEPS_TAG to the amd64 build to prevent cache reuse across incompatible R/Bioconductor versions (2 votes).
inst/Dockerfile.deps	Installs and validates R dependencies.	Moderate: -e prevents the fallback after install2.r fails (3 votes). Nit: Mount ccache on all compiling steps (1 vote).
Dockerfile	Validates BIGapp installation during image creation.	No findings.
.github/workflows/dockerhub-on-version.yml	Builds application images from dependency images.	Critical: Restore the production main trigger (1 vote). Moderate: Avoid mutable latest resolution across architecture jobs (1 vote).

Review details

Suppressed comments (2)

.github/workflows/dockerhub-on-version.yml:19

• Using the mutable latest manifest makes these package-version builds nondeterministic: the amd64 and arm64 jobs resolve it independently, so a manual dependency-image update during the run can produce an app manifest whose architectures contain different dependency images, and reruns can silently change the base. Pin an immutable dependency tag/digest, or resolve latest once and pass that digest to both jobs.

  DEPS_TAG: latest

inst/Dockerfile.deps:40

• The new ccache mount is only present while configuring ccache; this install step mounts only rsrc-${DEPS_TAG}, and the CRAN/fallback install steps likewise do not mount /root/.cache/ccache. Since the compilers run in those later RUNs, they write to the image filesystem rather than the scoped BuildKit cache, so the new cache ID provides no cross-build compile reuse. Mount the ccache cache on every RUN that compiles R packages (while retaining the R source cache).

RUN --mount=type=cache,target=/root/.cache/R/src,id=rsrc-${DEPS_TAG} Rscript - <<'RS'

• Files reviewed: 4/4 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.