fix(ci): skip cache-to on tag builds (MAPPS-121) #45

Merged

nrupard merged 1 commit from fix/oci-cache-skip-tag-builds-MAPPS-121 into main

2026-05-28 16:58:46 +02:00

nrupard commented

2026-05-28 16:57:04 +02:00

Owner

Summary

Skip --cache-to on tag builds in .forgejo/workflows/build-oci-image.yml so the redundant mode=max cache export no longer fires after every tag push. Tag builds run against a commit that was already built on main, so the registry cache is already populated; the second export only re-uploads identical blobs, and those large PUTs to dev.a8n.run were timing out at the reverse proxy (returning 499) - the symptom tracked in MAPPS-121. cache-from stays unconditional, so tag builds still benefit from cache reuse.

Details

Detect tag builds with $env.GITHUB_REF | str starts-with "refs/tags/".
On tag builds, prepend an empty list to the buildx args (no --cache-to).
On branch builds, behavior is unchanged (mode=max,ignore-error=true).
Validated the Nushell branching snippet locally against nu 0.112.2.

Test plan

Push a new tag (e.g. v0.2.1) and confirm the build logs show Tag build: skipping cache-to ... and no error writing layer blob ... 499 lines in the export step.
Push a commit to main and confirm cache-to still runs (exporting cache to registry appears, cache layers refresh).
Confirm the resulting image still pulls cleanly from dev.a8n.run/psa-systems-private/mokosh-www:<tag>.

## Summary Skip `--cache-to` on tag builds in `.forgejo/workflows/build-oci-image.yml` so the redundant `mode=max` cache export no longer fires after every tag push. Tag builds run against a commit that was already built on main, so the registry cache is already populated; the second export only re-uploads identical blobs, and those large PUTs to `dev.a8n.run` were timing out at the reverse proxy (returning 499) - the symptom tracked in MAPPS-121. `cache-from` stays unconditional, so tag builds still benefit from cache reuse. ## Details - Detect tag builds with `$env.GITHUB_REF | str starts-with "refs/tags/"`. - On tag builds, prepend an empty list to the buildx args (no `--cache-to`). - On branch builds, behavior is unchanged (`mode=max,ignore-error=true`). - Validated the Nushell branching snippet locally against `nu 0.112.2`. ## Test plan - [ ] Push a new tag (e.g. `v0.2.1`) and confirm the build logs show `Tag build: skipping cache-to ...` and no `error writing layer blob ... 499` lines in the export step. - [ ] Push a commit to `main` and confirm cache-to still runs (`exporting cache to registry` appears, cache layers refresh). - [ ] Confirm the resulting image still pulls cleanly from `dev.a8n.run/psa-systems-private/mokosh-www:<tag>`.

nrupard added 1 commit

2026-05-28 16:57:04 +02:00

fix(ci): skip cache-to on tag builds (MAPPS-121)

Check / clippy + fmt + tests (pull_request) Successful in 1m30s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

b9c0285297

Tag builds run after the same commit was already built on main, so the registry cache is populated and a second mode=max export only re-uploads identical blobs to dev.a8n.run. Those redundant ~17MB+ blob PUTs were hitting the reverse-proxy's ~60s window and returning 499 (client closed request), producing the cache-export errors tracked in MAPPS-121.

Detect tag builds via GITHUB_REF starting with refs/tags/ and drop --cache-to in that case. cache-from stays unconditional so tag builds still benefit from the cache pushed by main.