ci(oci): switch OCI build cache to type=gha (GOV-20) #60

Merged

David merged 1 commit from ci/GOV-20-rusty-links-gha-build-cache into main

2026-06-26 10:50:08 +02:00

David commented

2026-06-26 04:47:09 +02:00

Owner

Migrates this single-image repo's OCI build cache from the registry backend to act_runner's built-in Actions cache server, matching the GOV-20 governance template migration.

Changes:

Replace type=registry,ref=...:buildcache (both --cache-from and --cache-to) with type=gha / type=gha,mode=max,ignore-error=true. The registry backend round-tripped ~1.7 GiB over the WAN every build and 499'd the export on slow-upload runners, so cache reuse never worked there.
Add an Export Actions runtime env for buildx gha cache step (crazy-max/ghaction-github-runtime@v3) right after the buildx builder setup. A raw docker buildx build (unlike docker/build-push-action) does not auto-inject the gha backend env, and ACTIONS_RUNTIME_TOKEN is masked from run: steps, so this re-exports ACTIONS_CACHE_URL / ACTIONS_RUNTIME_TOKEN into GITHUB_ENV. Requires the runner's cache server (cache.enabled: true).

The repo already uses the docker-container buildx driver, so no driver change is needed. The provenance-attestation comment in the verify step is unchanged.

#GOV-20

Migrates this single-image repo's OCI build cache from the registry backend to act_runner's built-in Actions cache server, matching the GOV-20 governance template migration. Changes: - Replace `type=registry,ref=...:buildcache` (both `--cache-from` and `--cache-to`) with `type=gha` / `type=gha,mode=max,ignore-error=true`. The registry backend round-tripped ~1.7 GiB over the WAN every build and 499'd the export on slow-upload runners, so cache reuse never worked there. - Add an `Export Actions runtime env for buildx gha cache` step (crazy-max/ghaction-github-runtime@v3) right after the buildx builder setup. A raw `docker buildx build` (unlike docker/build-push-action) does not auto-inject the gha backend env, and ACTIONS_RUNTIME_TOKEN is masked from run: steps, so this re-exports ACTIONS_CACHE_URL / ACTIONS_RUNTIME_TOKEN into GITHUB_ENV. Requires the runner's cache server (cache.enabled: true). The repo already uses the docker-container buildx driver, so no driver change is needed. The provenance-attestation comment in the verify step is unchanged. #GOV-20

David added 1 commit

2026-06-26 04:47:10 +02:00

ci(oci): switch build cache from registry to gha runner cache

Check / clippy + fmt + tests (pull_request) Successful in 54s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

52b0b28d6a

Replace the type=registry :buildcache backend with type=gha so the OCI build caches to act_runner's built-in Actions cache server instead of round-tripping ~1.7 GiB over the WAN every build (which 499'd the export on slow-upload runners so reuse never worked), and add a ghaction-github-runtime step to re-export ACTIONS_CACHE_URL / ACTIONS_RUNTIME_TOKEN into GITHUB_ENV because a raw docker buildx build does not auto-inject the gha backend env, matching the GOV-20 governance template migration.

#GOV-20