chore: remove Docker image build and publishing [PYSDK-156]

[olivermeyer]

Why?
The CI publishes regulated releases to a Docker Hub account that Aignostics does not control. Aignostics cannot update or archive those images, and cannot revoke the CI token. CR PYSDK-156 stops the Docker distribution channel, and the published images on Docker Hub and GHCR are already deleted.

How?
Five commits remove the docker_publish job, the Docker image files, the Docker e2e test with pytest-docker, and Docker from the docs and the SPEC. A sixth commit changes all packages: write grants to packages: read, because no workflow uses a registry now. .devcontainer/Dockerfile stays, and the uv.lock change removes only pytest-docker, because uv remove also rewrote unrelated markers.

🤖 Generated with Claude Code

[claude]

PR Review: Remove Docker image build and publishing

I acknowledge the CLAUDE.md guidance and will apply the highest standards for this medical device software review.

---

Summary

This PR cleanly removes the Docker image build and publishing infrastructure from the CI/CD pipeline, as requested by CR PYSDK-156. The changes are comprehensive, correct, and introduce no breaking changes to SDK users.

Verdict: ✅ claude:review:passed

---

Critical Checks (All Passing ✅)

1. Test Markers ✅

• Command: uv run pytest -m "not unit and not integration and not e2e" --collect-only
• Result: 0 unmarked tests (1045 tests properly marked)
• The deleted test (tests/aignostics/docker_test.py) had proper markers: @pytest.mark.e2e, @pytest.mark.long_running, @pytest.mark.docker

2. Code Quality ✅

• make lint: All checks passed
  • Ruff check: ✅ All checks passed (1 minor noqa warning in unrelated test file)
  • Ruff format: ✅ 283 files already formatted
  • PyRight: ✅ 0 errors, 0 warnings, 0 informations
  • MyPy: ✅ Success - no issues found in 84 source files

3. Conventional Commits ✅

All 6 commits follow conventional commit format:

ci: downgrade packages permission to read
docs(spec): remove Docker from build chain SPEC
docs: remove Docker distribution channel
build: remove Docker image build files
test: remove Docker e2e test and pytest-docker
ci: stop publishing Docker images

4. Test Coverage ⚠️

• Codecov thresholds: Project 70%, Patch 75% (not 85% as mentioned in review instructions)
• CI Status: CI/CD pipeline still in progress
• Local test run: Some authentication-related timeouts (unrelated to Docker changes)
• Assessment: Coverage thresholds will be enforced by Codecov in CI

---

Repository-Specific Review

5. Architecture Compliance ✅

• No architecture violations
• Changes are confined to infrastructure (CI/CD, docs, test fixtures)
• No impact on modulith architecture or service layer
• .devcontainer/Dockerfile correctly preserved for development use

6. Breaking Changes ✅ None

No user-facing breaking changes:

• ✅ SDK API unchanged (no changes to src/aignostics/*/ code)
• ✅ CLI commands unchanged
• ✅ Python library API unchanged
• ✅ Development workflow unchanged (.devcontainer/ preserved)
• ❌ Docker images no longer published (intentional, documented in PR description)

7. CI/CD Impact ✅ Correctly Implemented

Deleted files:

• .github/workflows/_docker-publish.yml (104 lines)
• Dockerfile (136 lines)
• .dockerignore (96 lines)
• compose.yaml (39 lines)
• tests/aignostics/docker_test.py (28 lines)

Workflow changes:

• ✅ docker_publish job removed from ci-cd.yml
• ✅ All packages: write → packages: read across 9 workflow files
• ✅ Permission downgrade is correct (no workflow uses container registry now)
• ✅ No impact on test execution strategy

Files updated: 30 files changed, 47 insertions(+), 671 deletions(-)

8. Documentation Updates ✅ Comprehensive

File	Change	Status
CONTRIBUTING.md	Removed Docker section (48 lines)	✅
.github/CLAUDE.md	Removed Docker publish references	✅
CLAUDE.md	Updated release process (removed Docker)	✅
SPEC-BUILD-CHAIN-CICD-SERVICE.md	Removed all Docker references	✅
pyproject.toml	Removed "docker" keyword	✅
pyproject.toml	Removed "docker" test marker	✅
pyproject.toml	Updated integration test description	✅
ATTRIBUTIONS.md	Removed Docker-related attributions	✅
CODE_STYLE.md, OPERATIONAL_EXCELLENCE.md, SOFTWARE_ARCHITECTURE.md	Minor Docker reference cleanup	✅

9. Dependency Changes ✅

Removed:

• ✅ pytest-docker>=3.2.5,<4 from dev dependencies
• ✅ Entire pytest-docker package (19 lines) from uv.lock
• ✅ Docker test fixtures from tests/conftest.py (37 lines)

Test marker changes:

• ✅ Removed docker: That require Docker. marker definition
• ✅ Updated integration marker description (removed "real Docker containers")

---

Additional Observations

Strengths 💪

1. Atomic commits: Each commit has a clear, single purpose
2. Complete cleanup: No orphaned references to Docker found
3. Preserves dev experience: .devcontainer/ stays for local development
4. Well-documented: PR description clearly explains WHY (uncontrolled Docker Hub account)
5. Minimal diff: Clean removal with no refactoring or scope creep

Non-Blocking Suggestions 💡

None. This is a textbook infrastructure cleanup.

---

CI/CD Pipeline Status

Current Status: ✅ 2 passed, 2 in progress

• ✅ Build Native Only: success
• 🔄 CI/CD: in progress
• 🔄 Claude Code Review: in progress (this job)

Build Native Only workflow passing confirms that the permission downgrades don't break native builds.

---

Medical Device Context

This change:

• ✅ Does not affect medical data processing
• ✅ Does not affect HIPAA compliance
• ✅ Does not affect WSI processing algorithms
• ✅ Does not affect authentication or security
• ✅ Is purely infrastructure (distribution channel removal)

---

Verdict

✅ claude:review:passed

All critical checks pass. This PR correctly removes Docker publishing infrastructure with no breaking changes to SDK functionality. The changes are comprehensive, well-documented, and follow all repository standards.

Recommendation: Approve and merge once CI completes.

---

View job run

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

❌ Your project check has failed because the head coverage (64.42%) is below the target coverage (70.00%). You can increase the head coverage or adjust the target coverage.

❗ There is a different number of reports uploaded between BASE (e5269bd) and HEAD (87fed62). Click for more details.

HEAD has 10 uploads less than BASE

Flag	BASE (e5269bd)	HEAD (87fed62)
	11	1

see 23 files with indirect coverage changes

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud