chore(migration): step 07b build Docker images from the repository ro…

[surchs]

Title: chore(migration): step 07b build Docker images from the repository root (R2)
Branch: migration/step-07b

Can be squash-merged or merged; it imports no history.

Summary

• Image listings: migration/image-files-<tool>-before.txt for api, federation-api and query-tool, taken from images built the old way (docker build tools/<tool> for the APIs, the materialized context for query-tool) from a clean checkout of main.
• Dockerfiles: COPY lines are now root-relative.
  • api and federation-api: COPY tools/<tool>/pyproject.toml tools/<tool>/uv.lock ./ and COPY tools/<tool>/app /usr/src/app.
  • query-tool: COPY tools/query-tool/ ., COPY examples/ ./neurobagel_examples/ and COPY tools/query-tool/entrypoint.sh /entrypoint.sh.
  • No other Dockerfile line changed.
• Ignore files: an allowlist tools/<tool>/Dockerfile.dockerignore per image. It starts with * and re-includes only what the image needs.
  • The Python images also exclude app/**/__pycache__ and the git-ignored app/_version.py.
  • query-tool's excludes node_modules, dist and the neurobagel_examples symlink.
  • tools/query-tool/.dockerignore is deleted.
• Composite action: .github/actions/docker-build builds with context: . and file: tools/<tool>/Dockerfile. scripts/materialize-context.sh and every reference to it are deleted, including the query-tool path-filter entry.
• just: just build <tool> for api, federation-api and query-tool runs docker build -f tools/<tool>/Dockerfile -t neurobagel/<image>:local . from the root.
• Docs: the api, federation-api and query-tool READMEs give the root build command and say images must be built from the root. Root README: an R2 row and just build in the command list.

Checks run

Check	Result
File listing, new image vs. image-files-<tool>-before.txt	identical for api (20 files), federation-api (18), query-tool (6); built from the working tree and from a clean worktree
BuildKit "transferring context"	api 387 kB, federation-api 324 kB, query-tool 1.15 MB (limit 50 MB)
Runtime	federation-api GET / 200 on 8000; api GET / 200 on 8000 (with NB_GRAPH_USERNAME/PASSWORD and a datasets metadata file, as before); query-tool GET / 200 on 5173 (with NB_API_QUERY_URL)
grep -rn materialize-context .github scripts justfile	nothing
scripts/check-unchanged.sh	OK
api / federation-api / bagel-cli tests	188 / 111 / 215 passed
query-tool and annotation-tool static checks	pass
just lint	passes
CI query-tool-image job (builds through the composite action, serves 200)	to be confirmed on GitHub

Documentation check: every build command in the touched README sections was run verbatim from the root of a fresh clone of this branch. The commands were docker build -f tools/api/Dockerfile -t neurobagel/api:local ., docker build -f tools/api/Dockerfile -t neurobagel/api ., the federation-api and query-tool equivalents, and just build api|federation-api|query-tool; all exit 0. api's Option 3 docker run --env-file=.env needs a user .env and graph, as before, and was not run.

Deviations and findings

• First "before" listing was wrong: it was taken from the working tree and contained app/__pycache__/*.pyc and app/_version.py. api and federation-api have no .dockerignore, so local builds pick up whatever is in app/. CI builds from a clean checkout and never has them. The listings were re-taken from a clean worktree, and the new allowlists exclude both, so local and CI images match. Plan updated.
• Root README: the Step 5 row still says query-tool's image was built from a materialized copy. That was true at Step 5; the R2 row records the change.

🤖 Generated with Claude Code