ci(check): build check-docker to cacheonly instead of exporting a tagged image #257

Merged

David merged 2 commits from chore/BUNYIP-227-check-docker-cacheonly into main

2026-06-26 19:14:07 +02:00

David commented

2026-06-26 11:56:26 +02:00

Owner

What

check-docker built the api Dockerfile builder stage with --tag bunyip-api-builder:check, which made BuildKit export and unpack the builder stage as a local image after every run: exporting layers (~16s), unpacking (~1.5s), plus an attestation/provenance manifest list. Nothing consumes that image; the recipe is purely a build-success gate. It also left a dangling bunyip-api-builder:check image that dev-clean-all had to clean up.

This switches the recipe to --output type=cacheonly --provenance=false. The full builder stage still runs (including the BUNYIP-58 stub-leak size guard), but the resulting image is discarded instead of exported and unpacked. The now-dead bunyip-api-builder:check cleanup entry is removed from dev-clean-all.

Why

The image export and unpack were ~17.6s of wasted work on every check run, and the leftover tagged image served no purpose. cacheonly keeps all the validation (compile + size guard) with none of the export cost.

Verification

just check-docker exits 0.
Build output ends at the size guard step with no exporting to image / exporting layers / unpacking stage and no attestation manifest.
The BUNYIP-58 stub-leak guard still runs and reports 62045712 bytes (> 5 MB).
No bunyip-api-builder:check image remains after the run.
just pre-commit (full fmt + clippy + build + lib tests) passes.

Closes BUNYIP-227.

## What `check-docker` built the api Dockerfile `builder` stage with `--tag bunyip-api-builder:check`, which made BuildKit export and unpack the builder stage as a local image after every run: `exporting layers` (~16s), `unpacking` (~1.5s), plus an attestation/provenance manifest list. Nothing consumes that image; the recipe is purely a build-success gate. It also left a dangling `bunyip-api-builder:check` image that `dev-clean-all` had to clean up. This switches the recipe to `--output type=cacheonly --provenance=false`. The full `builder` stage still runs (including the BUNYIP-58 stub-leak size guard), but the resulting image is discarded instead of exported and unpacked. The now-dead `bunyip-api-builder:check` cleanup entry is removed from `dev-clean-all`. ## Why The image export and unpack were ~17.6s of wasted work on every check run, and the leftover tagged image served no purpose. `cacheonly` keeps all the validation (compile + size guard) with none of the export cost. ## Verification - `just check-docker` exits 0. - Build output ends at the size guard step with no `exporting to image` / `exporting layers` / `unpacking` stage and no attestation manifest. - The BUNYIP-58 stub-leak guard still runs and reports `62045712 bytes` (> 5 MB). - No `bunyip-api-builder:check` image remains after the run. - `just pre-commit` (full fmt + clippy + build + lib tests) passes. Closes BUNYIP-227.

David added 1 commit

2026-06-26 11:56:26 +02:00

ci(check): build check-docker to cacheonly, drop tagged image export

E2E / Playwright against deployment (pull_request) Successful in 1m16s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 29m1s

Details

023150c9a7

check-docker passed --tag bunyip-api-builder:check, so BuildKit exported and unpacked the builder stage as a local image after every run (exporting layers ~16s + unpacking ~1.5s + an attestation/provenance manifest list), then left a dangling bunyip-api-builder:check image that dev-clean-all had to remove. Nothing consumes that image; the recipe is only a build-success gate. Switch to --output type=cacheonly --provenance=false so the full builder stage still runs (the BUNYIP-58 stub-leak size guard included) but the image is discarded instead of exported, and drop the now-dead bunyip-api-builder:check cleanup entry from dev-clean-all.

Verified: just check-docker exits 0, output ends at the size guard with no exporting/unpacking stage and no attestation manifest, the guard still reports 62 MB (> 5 MB), and no bunyip-api-builder:check image remains afterward.
Signed-off-by: David Randall <David@NiceGuyIT.biz>

#BUNYIP-227

David added 1 commit

2026-06-26 18:21:55 +02:00

Merge branch 'main' into chore/BUNYIP-227-check-docker-cacheonly

E2E / Playwright against deployment (pull_request) Successful in 22s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 17m15s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

030e470416