chore(ci): guard the OCI build type=gha cache pattern #483

Merged

nrupard merged 2 commits from chore/PMS-720-oci-gha-cache-guard into main

2026-08-04 19:20:42 +02:00

Claude-Run commented

2026-08-02 20:19:12 +02:00

Member

The type=gha migration itself is already on main: .forgejo/workflows/build-oci-image.yml already creates a docker-container buildx builder (line 131), runs crazy-max/ghaction-github-runtime@v3 to re-export ACTIONS_CACHE_URL / ACTIONS_RUNTIME_TOKEN (line 139), and passes cache_from = "type=gha" / cache_to = "type=gha,mode=max,ignore-error=true" (lines 159-165). The issue's background describes an older state of the file, so re-doing the migration would be a no-op; what is actually missing is the mechanical enforcement, and that is what this adds.

Add scripts/check-oci-build-cache.nu, wired into just check and the Check workflow next to the existing migration / mail-copy / runner-label guards. It asserts the invariant over every workflow that runs docker buildx build: the docker-container driver, the runtime-env export step, and type=gha cache_from/cache_to are all present, and the retired type=inline, type=registry and :buildcache backends are absent. Comment lines are excluded because the workflow's own comments name the retired backends when explaining why they were dropped.

The regression is otherwise invisible: ignore-error=true means a dead or reverted cache still exits 0, and inline / registry caching also builds green, just slowly. Freshness has to be read from the build log's importing cache manifest from gha line, which nothing was checking.

#PMS-720
#GOV-20

The `type=gha` migration itself is already on main: `.forgejo/workflows/build-oci-image.yml` already creates a `docker-container` buildx builder (line 131), runs `crazy-max/ghaction-github-runtime@v3` to re-export ACTIONS_CACHE_URL / ACTIONS_RUNTIME_TOKEN (line 139), and passes `cache_from = "type=gha"` / `cache_to = "type=gha,mode=max,ignore-error=true"` (lines 159-165). The issue's background describes an older state of the file, so re-doing the migration would be a no-op; what is actually missing is the mechanical enforcement, and that is what this adds. Add `scripts/check-oci-build-cache.nu`, wired into `just check` and the Check workflow next to the existing migration / mail-copy / runner-label guards. It asserts the invariant over every workflow that runs `docker buildx build`: the docker-container driver, the runtime-env export step, and `type=gha` cache_from/cache_to are all present, and the retired `type=inline`, `type=registry` and `:buildcache` backends are absent. Comment lines are excluded because the workflow's own comments name the retired backends when explaining why they were dropped. The regression is otherwise invisible: `ignore-error=true` means a dead or reverted cache still exits 0, and inline / registry caching also builds green, just slowly. Freshness has to be read from the build log's `importing cache manifest from gha` line, which nothing was checking. #PMS-720 #GOV-20

Claude-Run added 1 commit

2026-08-02 20:19:12 +02:00

chore(ci): guard the OCI build type=gha cache pattern

Check / fmt + clippy + build + tests (pull_request) Successful in 1m47s

Details

Integration / integration tests (pull_request) Successful in 6m14s

Details

E2E / Playwright against staging (pull_request) Failing after 1m6s

Details

cb578ba383

The `type=gha` migration itself is already on main: `.forgejo/workflows/build-oci-image.yml` already creates a `docker-container` buildx builder (line 131), runs `crazy-max/ghaction-github-runtime@v3` to re-export ACTIONS_CACHE_URL / ACTIONS_RUNTIME_TOKEN (line 139), and passes `cache_from = "type=gha"` / `cache_to = "type=gha,mode=max,ignore-error=true"` (lines 159-165). The issue's background describes an older state of the file, so re-doing the migration would be a no-op; what is actually missing is the mechanical enforcement, and that is what this adds.

Add `scripts/check-oci-build-cache.nu`, wired into `just check` and the Check workflow next to the existing migration / mail-copy / runner-label guards. It asserts the invariant over every workflow that runs `docker buildx build`: the docker-container driver, the runtime-env export step, and `type=gha` cache_from/cache_to are all present, and the retired `type=inline`, `type=registry` and `:buildcache` backends are absent. Comment lines are excluded because the workflow's own comments name the retired backends when explaining why they were dropped.

The regression is otherwise invisible: `ignore-error=true` means a dead or reverted cache still exits 0, and inline / registry caching also builds green, just slowly. Freshness has to be read from the build log's `importing cache manifest from gha` line, which nothing was checking.

#PMS-720
#GOV-20

nrupard added 1 commit

2026-08-04 19:18:39 +02:00