ci(oci): switch OCI build cache to type=gha (GOV-20) #450

Merged

David merged 1 commit from ci/GOV-20-lets-chat-gha-build-cache into main

2026-06-26 10:48:25 +02:00

David commented

2026-06-26 04:45:45 +02:00

Owner

Apply the GOV-20 OCI build-cache migration to lets-chat: swap the single image's build cache from a type=registry :buildcache image to type=gha, act_runner's built-in Actions cache server, matching the governance template change.

The registry cache round-tripped ~1.7 GiB over the WAN on every build and 499'd the export on slow-upload runners, so layer reuse never actually worked there. type=gha keeps the cache local to act_runner (needs the runner's cache.enabled: true).

Because a raw docker buildx build (unlike docker/build-push-action) does not auto-inject the gha backend's env, and ACTIONS_RUNTIME_TOKEN is masked from run: steps, a new step runs crazy-max/ghaction-github-runtime@v3 to re-export ACTIONS_CACHE_URL / ACTIONS_RUNTIME_TOKEN into GITHUB_ENV ahead of the build. The repo already uses the docker-container buildx driver, which type=gha requires, so no driver change was needed.

cache_to keeps mode=max (preserves the dependency-build layer) and ignore-error=true (a cache hiccup or a disabled runner cache will not fail the build).

Validation: workflow YAML still parses. The justfile check/pre-commit suite compiles and tests the entire Rust workspace in Docker and does not lint or parse .forgejo/workflows/*.yml, so it gives no coverage of this YAML-only change; per the GOV-20 task guidance for workflow-only edits, validation rests on the YAML parse.

#GOV-20

Apply the GOV-20 OCI build-cache migration to lets-chat: swap the single image's build cache from a `type=registry` `:buildcache` image to `type=gha`, act_runner's built-in Actions cache server, matching the governance template change. The registry cache round-tripped ~1.7 GiB over the WAN on every build and 499'd the export on slow-upload runners, so layer reuse never actually worked there. `type=gha` keeps the cache local to act_runner (needs the runner's `cache.enabled: true`). Because a raw `docker buildx build` (unlike `docker/build-push-action`) does not auto-inject the gha backend's env, and `ACTIONS_RUNTIME_TOKEN` is masked from `run:` steps, a new step runs `crazy-max/ghaction-github-runtime@v3` to re-export `ACTIONS_CACHE_URL` / `ACTIONS_RUNTIME_TOKEN` into `GITHUB_ENV` ahead of the build. The repo already uses the `docker-container` buildx driver, which `type=gha` requires, so no driver change was needed. `cache_to` keeps `mode=max` (preserves the dependency-build layer) and `ignore-error=true` (a cache hiccup or a disabled runner cache will not fail the build). Validation: workflow YAML still parses. The justfile `check`/`pre-commit` suite compiles and tests the entire Rust workspace in Docker and does not lint or parse `.forgejo/workflows/*.yml`, so it gives no coverage of this YAML-only change; per the GOV-20 task guidance for workflow-only edits, validation rests on the YAML parse. #GOV-20

David added 1 commit

2026-06-26 04:45:45 +02:00

ci(oci): switch build cache from registry to gha runner cache

check-secrets / Nosey parker (push) Successful in 4s

Details

check-secrets / TruffleHog (push) Successful in 4s

Details

check-secrets / Kingfisher (push) Failing after 6s

Details

check-secrets / Nosey parker (pull_request) Successful in 8s

Details

check-secrets / Kingfisher (pull_request) Failing after 9s

Details

check-secrets / TruffleHog (pull_request) Successful in 11s

Details

Check / clippy + fmt + tests (pull_request) Successful in 12m14s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

caae0881e7

Swap the OCI build cache from a type=registry :buildcache image to type=gha (act_runner's built-in Actions cache server), matching the GOV-20 governance template migration: type=registry round-tripped ~1.7 GiB over the WAN every build and 499'd the export on slow-upload runners so reuse never worked, while a raw docker buildx build needs the crazy-max/ghaction-github-runtime action to re-export ACTIONS_CACHE_URL / ACTIONS_RUNTIME_TOKEN into GITHUB_ENV so the type=gha backend can reach the cache server.

#GOV-20