The mock for subprocess.run in test_extract_wheel_success doesn't correctly simulate the behavior of docker cp. The code under test (_extract_wheel) calls docker cp to copy files into a temporary directory (temp_path), but your mock bypasses this and copies the fake wheel file directly into the final output_dir.

This means the logic inside _extract_wheel that is supposed to find the wheel in temp_path and copy it to output_dir is never actually executed or tested. The test passes because the mock is doing the work that the function under test is supposed to do.

The mock for docker cp should copy the file to the destination specified in the docker cp command arguments, which is temp_path in the function under test.

The steps ray-wheel-build, ray-cpp-core-build, and ray-cpp-wheel-build share a lot of configuration, specifically the matrix and env blocks. This duplication can make the file harder to maintain. For example, if you need to add or remove a Python version, you have to do it in three different places.

You can use YAML anchors and aliases to define these blocks once and reuse them, which would make this file more DRY (Don't Repeat Yourself).

Example:

x-python-matrix: &python-matrix
  - "3.10"
  - "3.11"
  - "3.12"
  - "3.13"

x-default-env: &default-env
  PYTHON_VERSION: "{{matrix}}"
  ARCH_SUFFIX: ""
  HOSTTYPE: "x86_64"
  MANYLINUX_VERSION: "251216.3835fc5"

steps:
  # ...
  - name: ray-wheel-build
    # ...
    matrix: *python-matrix
    env: *default-env
    # ...
  - name: ray-cpp-core-build
    # ...
    matrix: *python-matrix
    env: *default-env
    # ...
  - name: ray-cpp-wheel-build
    # ...
    matrix: *python-matrix
    env: *default-env
    # ...

The subprocess.run call to remove the docker container uses capture_output=True but does not check for errors. If docker rm fails, the error will be suppressed and the script will continue, potentially leaving dangling containers behind. This could consume resources on the build agent over time. It's safer to ensure the command succeeds by adding check=True.

Bug: Test mock copies to wrong directory, bypassing extraction logic

The test mock for docker cp copies wheel files directly to output_dir, but the actual _extract_wheel function copies container contents to an internal temp_path, then searches that path with temp_path.rglob("*.whl") and copies found wheels to output_dir. Since the mock bypasses temp_path entirely, the production code's glob-and-copy loop never actually executes during the test, meaning the core extraction logic is untested. The test passes only because the mock directly populates output_dir, giving false confidence in code coverage.

Bug: Script succeeds silently when no wheels are extracted

When _extract_wheel finds no .whl files in the container image, it only logs a warning and continues. Similarly, when main completes with an empty output directory, it logs a warning but exits successfully with code 0. This could cause silent CI failures where the subsequent copy_build_artifacts.sh wheel step runs against an empty .whl directory, potentially uploading nothing without failing the build.