ci(oci): switch build cache from type=registry/inline to type=gha #366

Merged

David merged 2 commits from fix/PMS-525-oci-gha-build-cache into main

2026-06-26 10:49:38 +02:00

David commented

2026-06-26 03:04:35 +02:00

Owner

Brings .forgejo/workflows/build-oci-image.yml in line with the governance GOV-20 / CI.md OCI build-cache pattern (type=gha), replacing the type=registry + type=inline cache it ran on the default docker buildx driver.

The old shape ran a raw docker buildx build on the default docker driver with cache-from type=registry,ref=:latest and cache-to type=inline. Inline only carries the final layer's metadata and misses the heavy dependency-build layer, and the registry pattern round-tripped the full ~1.7 GiB buildx cache over the WAN every build and 499'd the export on slow-upload runners, so reuse never worked there (vervain-server VS-52, propagated org-wide by governance GOV-20).

Changes:

Add a Set up buildx builder step creating a docker-container driver builder. Required because the default docker driver does no cache export.
Add an Export Actions runtime env for buildx gha cache step (crazy-max/ghaction-github-runtime@v3) before the build. A raw docker buildx build does not auto-inject the gha backend env and ACTIONS_RUNTIME_TOKEN is masked from run: steps, so this re-exports ACTIONS_CACHE_URL / ACTIONS_RUNTIME_TOKEN into GITHUB_ENV.
Swap the cache lines to cache_from = "type=gha" and cache_to = "type=gha,mode=max,ignore-error=true", passed via --cache-to on the push build (was --cache-to type=inline).

Scope is the cache pattern only. The CARGO_BUILD_JOBS nproc/2 cap (governance GOV-10) is a separate concern, not in this PR.

Verification note: type=gha only reaches the cache server when the runner has cache.enabled: true; ignore-error=true swallows a disabled-cache runner silently, so confirm reuse from the build log's importing cache manifest from gha / exporting to GitHub Actions Cache lines, not from the exit code.

#PMS-525

Brings `.forgejo/workflows/build-oci-image.yml` in line with the governance GOV-20 / CI.md OCI build-cache pattern (`type=gha`), replacing the `type=registry` + `type=inline` cache it ran on the default `docker` buildx driver. The old shape ran a raw `docker buildx build` on the default `docker` driver with `cache-from type=registry,ref=:latest` and `cache-to type=inline`. Inline only carries the final layer's metadata and misses the heavy dependency-build layer, and the registry pattern round-tripped the full ~1.7 GiB buildx cache over the WAN every build and 499'd the export on slow-upload runners, so reuse never worked there (vervain-server VS-52, propagated org-wide by governance GOV-20). Changes: - Add a `Set up buildx builder` step creating a `docker-container` driver builder. Required because the default `docker` driver does no cache export. - Add an `Export Actions runtime env for buildx gha cache` step (`crazy-max/ghaction-github-runtime@v3`) before the build. A raw `docker buildx build` does not auto-inject the gha backend env and `ACTIONS_RUNTIME_TOKEN` is masked from `run:` steps, so this re-exports `ACTIONS_CACHE_URL` / `ACTIONS_RUNTIME_TOKEN` into `GITHUB_ENV`. - Swap the cache lines to `cache_from = "type=gha"` and `cache_to = "type=gha,mode=max,ignore-error=true"`, passed via `--cache-to` on the push build (was `--cache-to type=inline`). Scope is the cache pattern only. The `CARGO_BUILD_JOBS` nproc/2 cap (governance GOV-10) is a separate concern, not in this PR. Verification note: `type=gha` only reaches the cache server when the runner has `cache.enabled: true`; `ignore-error=true` swallows a disabled-cache runner silently, so confirm reuse from the build log's `importing cache manifest from gha` / `exporting to GitHub Actions Cache` lines, not from the exit code. #PMS-525

David added 1 commit

2026-06-26 03:04:35 +02:00

ci(oci): switch build cache from type=registry/inline to type=gha

E2E / Playwright against staging (pull_request) Successful in 24s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 1m19s

Details

Integration / integration tests (pull_request) Successful in 7m21s

Details

f3b1d12e6f

Bring build-oci-image.yml in line with the governance GOV-20 / CI.md OCI cache pattern. The build ran on the default `docker` buildx driver with `cache-from type=registry,ref=:latest` and `cache-to type=inline`; inline only carries the final layer's metadata and misses the heavy dependency-build layer, and the registry pattern round-tripped the full ~1.7 GiB buildx cache over the WAN every build and 499'd the export on slow-upload runners, so reuse never worked there (vervain-server VS-52).

Add a `docker-container` buildx driver step (required for any cache export), add the crazy-max/ghaction-github-runtime@v3 step to re-export ACTIONS_CACHE_URL / ACTIONS_RUNTIME_TOKEN into GITHUB_ENV (a raw `docker buildx build` does not auto-inject the gha backend env and ACTIONS_RUNTIME_TOKEN is masked from run: steps), and swap the cache lines to `type=gha` cache_from + `type=gha,mode=max,ignore-error=true` cache_to talking to act_runner's on-LAN cache server.

#PMS-525

David added 1 commit

2026-06-26 10:49:25 +02:00

Merge branch 'main' into fix/PMS-525-oci-gha-build-cache

Check / fmt + clippy + build + tests (pull_request) Successful in 1m36s

Details

Create release / Gate (release-branch merges only) (pull_request) Successful in 5m30s

Details

E2E / Playwright against staging (pull_request) Successful in 6m27s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

Integration / integration tests (pull_request) Successful in 20m32s