ci-conda: stop shipping compilers, update codecov-cli to 11.2.6 (#353)

`ci-conda` images currently ship a system-installed `gcc` and `g++`.

This proposes removing them.

It also proposes some other minor re-organization of `ci-conda`, combining very-combinable things (like the creation of directories and files whose content rarely changes) into fewer layers.

## Why were they originally added?

Those were added only because we were building the `codecov` CLI from source in these images (#147). That's no longer necessary here in 2026, because newer releases of `codecov-cli` provide `py3-none-any` wheels (e.g. https://pypi.org/project/codecov-cli/11.2.5/#files).

## Benefits of removing them?

Slightly smaller images.

But more importantly...stronger correctness guarantees. conda-based CI jobs in RAPIDS should never be reaching for system-installed compilers... we'd always prefer to use conda-forge's compilers for building conda packages.

Removing these system-installed `gcc` and `g++` reduces the risk of accidentally picking up things from those packages that should have come from conda-provided compilers.

Authors:
  - James Lamb (https://github.com/jameslamb)

Approvers:
  - Gil Forsyth (https://github.com/gforsyth)

URL: #353

Author: jameslamb

ci-conda.Dockerfile

@@ -100,10 +100,10 @@ EOF
 # Ownership & permissions based on https://docs.anaconda.com/anaconda/install/multi-user/#multi-user-anaconda-installation-on-linux
 COPY --from=miniforge-upstream --chown=root:conda --chmod=770 /opt/conda /opt/conda
 
+RUN <<EOF
 # Ensure new files are created with group write access & setgid. See https://unix.stackexchange.com/a/12845
-RUN chmod g+ws /opt/conda
+chmod g+ws /opt/conda
 
-RUN <<EOF
 # Ensure new files/dirs have group write permissions
 umask 002
 
@@ -130,10 +130,10 @@ find /opt/conda -follow -type f -name '*.pyc' -delete
 conda clean -aiptfy
 EOF
 
+RUN <<EOF
 # Reassign root's primary group to root
-RUN usermod -g root root
+usermod -g root root
 
-RUN <<EOF
 # ensure conda environment is always activated
 ln -s /opt/conda/etc/profile.d/conda.sh /etc/profile.d/conda.sh
 echo ". /opt/conda/etc/profile.d/conda.sh; conda activate base" >> /etc/skel/.bashrc
@@ -189,8 +189,6 @@ case "${LINUX_VER}" in
       file
       unzip
       wget
-      gcc
-      g++
     )
     apt-get install -y --no-install-recommends \
       "${PACKAGES_TO_INSTALL[@]}"
@@ -206,8 +204,6 @@ case "${LINUX_VER}" in
       wget
       which
       yum-utils
-      gcc
-      gcc-c++
     )
     dnf -y install --setopt=install_weak_deps=False \
       "${PACKAGES_TO_INSTALL[@]}"
@@ -221,22 +217,21 @@ case "${LINUX_VER}" in
 esac
 EOF
 
-# Install prereq for envsubst
-RUN <<EOF
-rapids-mamba-retry install -y \
-  gettext
-conda clean -aiptfy
-EOF
-
 # Create condarc file from env vars
 ENV RAPIDS_CONDA_BLD_ROOT_DIR=/tmp/conda-bld-workspace
 ENV RAPIDS_CONDA_BLD_OUTPUT_DIR=/tmp/conda-bld-output
 COPY condarc.tmpl /tmp/condarc.tmpl
-RUN cat /tmp/condarc.tmpl | envsubst | tee /opt/conda/.condarc; \
-    rm -f /tmp/condarc.tmpl
 
 # Install CI tools using mamba
 RUN <<EOF
+# Install prereq for envsubst
+rapids-mamba-retry install -y \
+  gettext
+
+# create condarc file from env vars
+cat /tmp/condarc.tmpl | envsubst | tee /opt/conda/.condarc; \
+rm -f /tmp/condarc.tmpl
+
 PYTHON_MAJOR_VERSION=${PYTHON_VERSION%%.*}
 PYTHON_MINOR_VERSION=${PYTHON_VERSION#*.}
 PYTHON_UPPER_BOUND="${PYTHON_MAJOR_VERSION}.$((PYTHON_MINOR_VERSION+1)).0a0"
@@ -269,27 +264,72 @@ rapids-mamba-retry install -y \
 conda clean -aiptfy
 EOF
 
-# Install yq and awscli
+# Install tools
 ARG AWS_CLI_VER=notset
+ARG CODECOV_VER=notset
 ARG REAL_ARCH=notset
 ARG YQ_VER=notset
 RUN <<EOF
+# yq
 rapids-retry wget -q https://github.com/mikefarah/yq/releases/download/v${YQ_VER}/yq_linux_${CPU_ARCH} -O /tmp/yq
 mv /tmp/yq /usr/bin/yq
 chmod +x /usr/bin/yq
 
+# AWS CLI
 # ref: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html#getting-started-install-instructions
 rapids-retry curl -o /tmp/awscliv2.zip \
   -L "https://awscli.amazonaws.com/awscli-exe-linux-${REAL_ARCH}-${AWS_CLI_VER}.zip"
 unzip -q /tmp/awscliv2.zip -d /tmp
 /tmp/aws/install
 rm -rf /tmp/aws /tmp/awscliv2.zip
-EOF
 
-# Install codecov from source distribution
-ARG CODECOV_VER=notset
-RUN <<EOF
-rapids-pip-retry install codecov-cli==${CODECOV_VER}
+# codecov-cli
+#
+# codecov-cli is a noarch Python package, but some of its dependencies require compilation.
+# compilers are installed defensively here to prevent issues like "a dependency of codecov-cli
+# doesn't support CPU_ARCH / LINUX_VER / PYTHON_VER" from slowing down updates to RAPIDS CI.
+#
+
+case "${LINUX_VER}" in
+  "ubuntu"*)
+    COMPILER_PACKAGES=(
+      gcc
+      g++
+    )
+    rapids-retry apt-get update -y
+    apt-get install -y --no-install-recommends \
+      "${COMPILER_PACKAGES[@]}"
+    ;;
+  "rockylinux"*)
+    COMPILER_PACKAGES=(
+      gcc
+      gcc-c++
+    )
+    dnf install -y \
+      "${COMPILER_PACKAGES[@]}"
+    ;;
+esac
+
+rapids-pip-retry install --prefer-binary \
+  "codecov-cli==${CODECOV_VER}"
+
+# remove compiler packages... conda-based CI should use conda-forge's compilers
+case "${LINUX_VER}" in
+  "ubuntu"*)
+    apt-get purge -y \
+      "${COMPILER_PACKAGES[@]}"
+    apt-get autoremove -y
+    rm -rf /var/cache/apt/archives /var/lib/apt/lists/*
+    ;;
+  "rockylinux"*)
+    dnf remove -y \
+      "${COMPILER_PACKAGES[@]}"
+    dnf clean all
+    ;;
+esac
+
+# clear the pip cache, to shrink image size and prevent unintentionally
+# pinning CI to older versions of things
 pip cache purge
 EOF
 

versions.yaml

@@ -1,9 +1,9 @@
-# SPDX-FileCopyrightText: Copyright (c) 2024-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2024-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 # renovate: datasource=github-releases depName=cli/cli
 GH_CLI_VER: 2.83.1
 # renovate: datasource=pypi depName=codecov-cli
-CODECOV_VER: 11.2.5
+CODECOV_VER: 11.2.6
 # renovate: datasource=github-releases depName=mikefarah/yq
 YQ_VER: 4.49.2
 # renovate: datasource=github-releases depName=aws/aws-cli