ci: validate PRs with cached regression image

[xsscx]

PR Summary

#1983

Checklist

• Signed all Commits in PR
• Built locally according to docs/build.md
• Followed the guidelines in Contributing document
• Ran relevant CTest/profile tests from docs/ctest.md
• Updated documentation for user-visible behavior changes
• Ran sanitizer coverage for memory-safety or parser changes
• Added or updated regression coverage for behavior changes
• For Python package changes, followed docs/python-packaging-release.md for PR and merge requirements
• Did not change maintainer-owned workflow, CTest, CPack, sanitizer, release, or security infrastructure unless requested by an iccDEV maintainer
• New source files include the ICC copyright and BSD 3-Clause license header
• Code style matches nearby code: 2-space indent, K&R braces, m_ members

Legal Requirements

All official software projects hosted by the International Color Consoritum (ICC)
follows the open source software best practice policies. The International Color Consoritum IP policy governs ICC specification development and contributions to ICC open source software. Software contributions are also covered by the Contributor License Agreement (CLA).

Contributor License Agreements

Developers who wish to contribute code to be considered for inclusion
in ICC software must first complete a Contributor License Agreement
(CLA).

There is no cost or membership requirement to sign the ICC Contributor License Agreement (CLA). Please note that this is different from membership in the International Color Consortium (ICC). If your organization relies on our projects, please become a member. Membership dues are an essential source of funding and investment for these projects.

• If you are an individual writing the code on your own time and you are SURE you are the sole owner of any intellectual property you contribute, you can sign the CLA as an individual contributor.

• If you are writing the code as part of your job, or if there is any possibility that your employer might think they own any intellectual property you create, then you should use the Corporate Contributor Licence Agreement

License

ICC software is licensed under the BSD 3-Clause "New" or "Revised" License. Contributions to ICC software projects should abide by that license unless otherwised specified or approved by the ICC.

Copyright Notices

All new source files must begin with the ICC Copyright notice and include or reference the BSD 3-Clause "New" or "Revised" License.

INTELLECTUAL PROPERTY & PATENTS

Participation in ICC's development activities is subject to ICC's Patent Policy.

Maintainer Review Required

If you have questions, contact a listed Maintainer.

[Copilot]

Pull request overview

This PR updates the Docker PR verification lane to use the published maintainer regression image as a build cache (instead of rebuilding the image per PR) and expands the “fast lane” envelope to build + run a label-filtered CTest pass inside the container. It also updates the related maintainer documentation/prompts and keeps UBSAN suppression lists in sync with libstdc++ 15 noise sources.

Changes:

• Switch ci-docker-pr from building a per-PR regression image to pulling ghcr.io/.../iccdev-ci-regression:latest, mounting the PR workspace read-only, copying to scratch, and building/testing there.
• Run CTest in the Docker PR lane (excluding only slow and calculator labels) after a full build + build-test-binaries.
• Extend UBSAN noise suppression (runtime and compile-time ignorelists) to include additional libstdc++ internals (vector.tcc, ext/string_conversions.h) and update maintainer docs/prompts accordingly.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
Testing/silence.txt	Adds additional runtime UBSAN noise patterns for libstdc++ internals.
docs/regression-workflow-governance.md	Documents the Docker PR lane’s use of the published regression image and required safety properties (digest reporting, RO mount, scratch copy, fast envelope).
docs/regression-container.md	Updates local reproduction guidance to match the new PR lane behavior (pull latest, copy to scratch, build + label-filtered CTest).
.github/workflows/ci-docker.yml	Keeps the generated silence.txt content in sync with the new libstdc++ noise entries.
.github/workflows/ci-docker-pr.yml	Core workflow change: pull maintainer image, mount/copy PR tree, build and run CTest (excluding slow/calculator).
.github/skills/regression-container-maintainer/SKILL.md	Updates maintainer skill guidance to align with the new workflow expectations (digest, scratch copy, CTest envelope).
.github/scripts/iccdev-stdobserver-regression-tests.sh	Extends runtime UBSAN noise filtering patterns to match updated suppression set.
.github/scripts/iccdev-mluc-setter-regression-tests.sh	Extends runtime UBSAN noise filtering patterns to match updated suppression set.
.github/scripts/iccdev-calculator-regression-tests.sh	Extends runtime UBSAN noise filtering patterns to match updated suppression set.
.github/prompts/regression-container-maintainer.prompt.md	Updates the maintainer prompt steps to match the new container verification flow.
.github/ci/ubsan-ignorelist.txt	Adds compile-time ignorelist entries for additional libstdc++ noise sources.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/ci-docker-pr.yml:149

• docker image inspect currently concatenates all entries in .RepoDigests without separators ({{range .RepoDigests}}{{.}}{{end}}), which can produce ambiguous/unreadable output when multiple digests are present. Prefer selecting a single resolved digest explicitly (e.g., the first entry) so the job log reliably captures the digest being reported.

          docker pull "$TEST_IMAGE"
          docker image inspect \
            --format 'image={{.Id}} digest={{range .RepoDigests}}{{.}}{{end}}' \
            "$TEST_IMAGE"

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/skills/regression-container-maintainer/SKILL.md:46

• This step text says to always “reject compiler warnings”, but the Docker PR lane supports a configurable warning policy (defaulting to fail). The maintainer guidance should match the workflow behavior by noting the default and that warnings may be recorded instead of failing when configured.

   scratch space. Run the Docker PR verification build (the configured tool and
   test target set with strict Clang sanitizer flags), reject compiler warnings,
   and run CTest excluding only the `slow` and `calculator` labels.

.github/prompts/regression-container-maintainer.prompt.md:39

• This prompt currently states “zero compiler warnings” as a hard requirement for the Docker PR verification build, but the Docker PR workflow has a configurable warning policy (defaulting to fail). The prompt should describe the default behavior and allow for the warn-only configuration when explicitly requested.

   scratch space. Run the Docker PR verification build: strict Clang sanitizer
   flags, the configured tool and test target set, zero compiler warnings, and
   CTest excluding only the `slow` and `calculator` labels.
8. If the changed behavior is in an excluded suite, run its focused CTest in
   addition to the routine Docker PR envelope.