feat: pin package versions in build scripts for consistency

Author: ilopezluna

Makefile

@@ -25,8 +25,15 @@ DOCKER_BUILD_ARGS := \
 # Test configuration
 BUILD_DMR ?= 1
 
-# Main targets
-.PHONY: build run clean test integration-tests test-docker-ce-installation docker-build docker-build-multiplatform docker-run docker-build-vllm docker-run-vllm docker-build-sglang docker-run-sglang docker-run-impl help validate validate-all lint docker-build-diffusers docker-run-diffusers vllm-metal-build vllm-metal-install vllm-metal-dev vllm-metal-clean diffusers-build diffusers-install diffusers-dev diffusers-clean build-cli install-cli
+# Phony targets grouped by category
+.PHONY: build run clean test integration-tests build-cli install-cli
+.PHONY: validate validate-all lint help
+.PHONY: docker-build docker-build-multiplatform docker-run docker-run-impl
+.PHONY: docker-build-vllm docker-run-vllm docker-build-sglang docker-run-sglang
+.PHONY: docker-build-diffusers docker-run-diffusers
+.PHONY: test-docker-ce-installation
+.PHONY: vllm-metal-build vllm-metal-install vllm-metal-dev vllm-metal-clean
+.PHONY: diffusers-build diffusers-install diffusers-dev diffusers-clean
 # Default target
 .DEFAULT_GOAL := build
 

pkg/inference/backends/diffusers/diffusers.go

@@ -174,7 +174,7 @@ func (d *diffusers) downloadAndExtract(ctx context.Context, _ *http.Client) erro
 	// Copy the extracted self-contained Python installation directly to install dir
 	// (the image contains /diffusers/ with bin/, lib/, etc.)
 	diffusersDir := filepath.Join(extractDir, "diffusers")
-	if err := copyDir(diffusersDir, d.installDir); err != nil {
+	if err := utils.CopyDir(diffusersDir, d.installDir); err != nil {
 		return fmt.Errorf("failed to copy to install dir: %w", err)
 	}
 
@@ -188,54 +188,11 @@ func (d *diffusers) downloadAndExtract(ctx context.Context, _ *http.Client) erro
 	return nil
 }
 
-// copyDir recursively copies a directory.
-func copyDir(src, dst string) error {
-	return filepath.Walk(src, func(path string, info os.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-
-		relPath, err := filepath.Rel(src, path)
-		if err != nil {
-			return err
-		}
-		dstPath := filepath.Join(dst, relPath)
-
-		if info.IsDir() {
-			return os.MkdirAll(dstPath, info.Mode())
-		}
-
-		if info.Mode()&os.ModeSymlink == os.ModeSymlink {
-			link, err := os.Readlink(path)
-			if err != nil {
-				return err
-			}
-			return os.Symlink(link, dstPath)
-		}
-
-		if err := os.MkdirAll(filepath.Dir(dstPath), 0755); err != nil {
-			return err
-		}
-
-		srcFile, err := os.Open(path)
-		if err != nil {
-			return err
-		}
-		defer srcFile.Close()
-
-		dstFile, err := os.OpenFile(dstPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, info.Mode())
-		if err != nil {
-			return err
-		}
-		defer dstFile.Close()
-
-		_, err = dstFile.ReadFrom(srcFile)
-		return err
-	})
-}
-
+// verifyInstallation checks that the diffusers Python package can be imported.
+// Note: d.pythonPath is not user-controlled — it is set internally by Install()
+// to the bundled Python binary path, so the exec.Command usage is safe.
 func (d *diffusers) verifyInstallation(ctx context.Context) error {
-	cmd := exec.CommandContext(ctx, d.pythonPath, "-c", "import diffusers")
+	cmd := exec.CommandContext(ctx, d.pythonPath, "-c", "import diffusers") //nolint:gosec // pythonPath is set internally by Install, not user input
 	if err := cmd.Run(); err != nil {
 		d.status = "import failed"
 		return fmt.Errorf("diffusers import failed: %w", err)

pkg/inference/backends/vllm/vllm_metal.go

@@ -18,6 +18,7 @@ import (
 	"github.com/docker/model-runner/pkg/inference/models"
 	"github.com/docker/model-runner/pkg/inference/platform"
 	"github.com/docker/model-runner/pkg/internal/dockerhub"
+	"github.com/docker/model-runner/pkg/internal/utils"
 	"github.com/docker/model-runner/pkg/logging"
 )
 
@@ -164,7 +165,7 @@ func (v *vllmMetal) downloadAndExtract(ctx context.Context, _ *http.Client) erro
 	// Copy the extracted self-contained Python installation directly to install dir
 	// (the image contains /vllm-metal/ with bin/, lib/, etc.)
 	vllmMetalDir := filepath.Join(extractDir, "vllm-metal")
-	if err := copyDir(vllmMetalDir, v.installDir); err != nil {
+	if err := utils.CopyDir(vllmMetalDir, v.installDir); err != nil {
 		return fmt.Errorf("failed to copy to install dir: %w", err)
 	}
 
@@ -178,52 +179,6 @@ func (v *vllmMetal) downloadAndExtract(ctx context.Context, _ *http.Client) erro
 	return nil
 }
 
-// copyDir recursively copies a directory.
-func copyDir(src, dst string) error {
-	return filepath.Walk(src, func(path string, info os.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-
-		relPath, err := filepath.Rel(src, path)
-		if err != nil {
-			return err
-		}
-		dstPath := filepath.Join(dst, relPath)
-
-		if info.IsDir() {
-			return os.MkdirAll(dstPath, info.Mode())
-		}
-
-		if info.Mode()&os.ModeSymlink == os.ModeSymlink {
-			link, err := os.Readlink(path)
-			if err != nil {
-				return err
-			}
-			return os.Symlink(link, dstPath)
-		}
-
-		if err := os.MkdirAll(filepath.Dir(dstPath), 0755); err != nil {
-			return err
-		}
-
-		srcFile, err := os.Open(path)
-		if err != nil {
-			return err
-		}
-		defer srcFile.Close()
-
-		dstFile, err := os.OpenFile(dstPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, info.Mode())
-		if err != nil {
-			return err
-		}
-		defer dstFile.Close()
-
-		_, err = dstFile.ReadFrom(srcFile)
-		return err
-	})
-}
-
 func (v *vllmMetal) verifyInstallation(ctx context.Context) error {
 	cmd := exec.CommandContext(ctx, v.pythonPath, "-c", "import vllm_metal")
 	if err := cmd.Run(); err != nil {

pkg/internal/utils/copydir.go

@@ -0,0 +1,53 @@
+package utils
+
+import (
+	"os"
+	"path/filepath"
+)
+
+// CopyDir recursively copies a directory tree from src to dst,
+// preserving file modes and symlinks.
+func CopyDir(src, dst string) error {
+	return filepath.Walk(src, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		relPath, err := filepath.Rel(src, path)
+		if err != nil {
+			return err
+		}
+		dstPath := filepath.Join(dst, relPath)
+
+		if info.IsDir() {
+			return os.MkdirAll(dstPath, info.Mode())
+		}
+
+		if info.Mode()&os.ModeSymlink == os.ModeSymlink {
+			link, err := os.Readlink(path)
+			if err != nil {
+				return err
+			}
+			return os.Symlink(link, dstPath)
+		}
+
+		if err := os.MkdirAll(filepath.Dir(dstPath), 0755); err != nil {
+			return err
+		}
+
+		srcFile, err := os.Open(path)
+		if err != nil {
+			return err
+		}
+		defer srcFile.Close()
+
+		dstFile, err := os.OpenFile(dstPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, info.Mode())
+		if err != nil {
+			return err
+		}
+		defer dstFile.Close()
+
+		_, err = dstFile.ReadFrom(srcFile)
+		return err
+	})
+}