feat: run neutron unit tests during build via tox

Add a neutron-build stage that COPYs the neutron source, runs the
full unit test suite via tox, then produces a wheel. The build stage
installs from the tested wheel instead of raw source, structurally
forcing tests to pass before the image can be built.

This follows the Debian packaging pattern where tests run as part of
the build process, catching broken patches and dependency issues
before the image is shipped.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: mnaser

Dockerfile

@@ -6,27 +6,51 @@ WORKDIR /src
 COPY --from=ovsinit-src / /src
 RUN cargo install --path .
 
+# TODO: move all this to the venv builder image
+FROM ghcr.io/vexxhost/openstack-venv-builder:main@sha256:423e0a09ce69554f25fd508ceff39945fd16f01a5f2c7cfeeb9cf15a1c18ad33 AS builder
+WORKDIR /src
+ENV TOX_CONSTRAINTS_FILE=/upper-constraints.txt
+ONBUILD RUN uvx tox -epy3
+ONBUILD RUN uv build
+
+FROM builder AS neutron-build
+COPY --from=neutron / /src
+
+FROM builder AS neutron-dynamic-routing-build
+COPY --from=neutron-dynamic-routing / /src
+
+FROM builder AS neutron-vpnaas-build
+COPY --from=neutron-vpnaas / /src
+
+FROM builder AS networking-baremetal-build
+COPY --from=networking-baremetal / /src
+
+FROM builder AS networking-generic-switch-build
+COPY --from=networking-generic-switch / /src
+
+FROM builder AS neutron-policy-server-build
+COPY --from=neutron-policy-server / /src
+
+FROM builder AS neutron-ovn-network-logging-parser-build
+COPY --from=neutron-ovn-network-logging-parser / /src
+
+FROM builder AS tap-as-a-service-build
+COPY --from=tap-as-a-service / /src
+
 FROM ghcr.io/vexxhost/openstack-venv-builder:main@sha256:423e0a09ce69554f25fd508ceff39945fd16f01a5f2c7cfeeb9cf15a1c18ad33 AS build
 RUN \
-  --mount=type=bind,from=neutron,source=/,target=/src/neutron,readwrite \
-  --mount=type=bind,from=neutron-dynamic-routing,source=/,target=/src/neutron-dynamic-routing,readwrite \
-  --mount=type=bind,from=neutron-vpnaas,source=/,target=/src/neutron-vpnaas,readwrite \
-  --mount=type=bind,from=networking-baremetal,source=/,target=/src/networking-baremetal,readwrite \
-  --mount=type=bind,from=networking-generic-switch,source=/,target=/src/networking-generic-switch,readwrite \
-  --mount=type=bind,from=neutron-policy-server,source=/,target=/src/neutron-policy-server,readwrite \
-  --mount=type=bind,from=neutron-ovn-network-logging-parser,source=/,target=/src/neutron-ovn-network-logging-parser,readwrite \
-  --mount=type=bind,from=tap-as-a-service,source=/,target=/src/tap-as-a-service,readwrite <<EOF bash -xe
+  --mount=type=bind,from=neutron-build,source=/src/dist,target=/build/neutron \
+  --mount=type=bind,from=neutron-dynamic-routing-build,source=/src/dist,target=/build/neutron-dynamic-routing \
+  --mount=type=bind,from=neutron-vpnaas-build,source=/src/dist,target=/build/neutron-vpnaas \
+  --mount=type=bind,from=networking-baremetal-build,source=/src/dist,target=/build/networking-baremetal \
+  --mount=type=bind,from=networking-generic-switch-build,source=/src/dist,target=/build/networking-generic-switch \
+  --mount=type=bind,from=neutron-policy-server-build,source=/src/dist,target=/build/neutron-policy-server \
+  --mount=type=bind,from=neutron-ovn-network-logging-parser-build,source=/src/dist,target=/build/neutron-ovn-network-logging-parser \
+  --mount=type=bind,from=tap-as-a-service-build,source=/src/dist,target=/build/tap-as-a-service <<EOF bash -xe
 uv pip install \
-    --constraint /upper-constraints.txt \
-        /src/neutron \
-        /src/neutron-dynamic-routing \
-        /src/neutron-vpnaas \
-        /src/networking-baremetal \
-        /src/networking-generic-switch \
-        /src/neutron-policy-server \
-        /src/neutron-ovn-network-logging-parser \
-        /src/tap-as-a-service \
-        pymemcache
+  --constraint /upper-constraints.txt \
+    /build/*/*.whl \
+    pymemcache
 EOF
 
 FROM ghcr.io/vexxhost/python-base:main@sha256:df0f7c05b006fbfa355077571a42745b36e610e674c8ca77f5ac8de2e0fd0fba