ci(oci): switch build cache from type=registry to type=gha #47

Merged

David merged 1 commit from fix/vapp-36-oci-gha-cache into main

2026-06-26 04:27:52 +02:00

David commented

2026-06-26 04:26:17 +02:00

Owner

Switch .forgejo/workflows/build-oci-image.yml from the registry build-cache pattern (a dedicated :buildcache tag with type=registry cache_from/cache_to) to type=gha, pointing buildx at act_runner's built-in on-LAN Actions cache server. The registry pattern round-tripped the full ~1.7 GiB buildx cache over the WAN every build and 499'd the export on slow-upload runners, so layer reuse never worked. This replicates the governance GOV-20 fix, first proven on vervain-server in VS-53.

Changes:

Add a crazy-max/ghaction-github-runtime@v3 step after the buildx-builder setup. A raw docker buildx build (unlike docker/build-push-action) does not auto-inject the gha cache backend's env, and ACTIONS_RUNTIME_TOKEN is masked from run: steps, so the action re-exports ACTIONS_CACHE_URL / ACTIONS_RUNTIME_TOKEN into GITHUB_ENV. Requires the runner's cache.enabled: true.
Set cache_from = "type=gha" and cache_to = "type=gha,mode=max,ignore-error=true", dropping the unused :buildcache cache-ref computation.
Refresh the stale type=registry comments on the buildx-driver and cache lines.

No scope= is added: this repo builds a single image (vervain-web), so the GOV-21 multi-image isolation knob does not apply.

just pre-commit passes (fmt, clippy, check, wasm check, 21 tests).

Closes VAPP-36.

Switch `.forgejo/workflows/build-oci-image.yml` from the registry build-cache pattern (a dedicated `:buildcache` tag with `type=registry` cache_from/cache_to) to `type=gha`, pointing buildx at act_runner's built-in on-LAN Actions cache server. The registry pattern round-tripped the full ~1.7 GiB buildx cache over the WAN every build and 499'd the export on slow-upload runners, so layer reuse never worked. This replicates the governance GOV-20 fix, first proven on vervain-server in VS-53. Changes: - Add a `crazy-max/ghaction-github-runtime@v3` step after the buildx-builder setup. A raw `docker buildx build` (unlike docker/build-push-action) does not auto-inject the gha cache backend's env, and `ACTIONS_RUNTIME_TOKEN` is masked from `run:` steps, so the action re-exports `ACTIONS_CACHE_URL` / `ACTIONS_RUNTIME_TOKEN` into `GITHUB_ENV`. Requires the runner's `cache.enabled: true`. - Set `cache_from = "type=gha"` and `cache_to = "type=gha,mode=max,ignore-error=true"`, dropping the unused `:buildcache` cache-ref computation. - Refresh the stale `type=registry` comments on the buildx-driver and cache lines. No `scope=` is added: this repo builds a single image (`vervain-web`), so the GOV-21 multi-image isolation knob does not apply. `just pre-commit` passes (fmt, clippy, check, wasm check, 21 tests). Closes VAPP-36.

David added 1 commit

2026-06-26 04:26:17 +02:00

ci(oci): switch build cache from type=registry to type=gha

Check / fmt + clippy + build + tests (pull_request) Successful in 29s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

77c704fc54

Swap the build-oci-image.yml cache pattern from the registry cache (a dedicated `:buildcache` tag + `type=registry` cache_from/cache_to) to `type=gha`, pointing buildx at act_runner's built-in on-LAN Actions cache server. The registry pattern round-tripped the full ~1.7 GiB buildx cache over the WAN every build and 499'd the export on slow-upload runners, so reuse never worked. This replicates the governance GOV-20 fix (first proven on vervain-server in VS-53).

Add a `crazy-max/ghaction-github-runtime@v3` step after the buildx-builder setup: a raw `docker buildx build` (unlike docker/build-push-action) does not auto-inject the gha cache backend's env, and ACTIONS_RUNTIME_TOKEN is masked from run: steps, so the action re-exports ACTIONS_CACHE_URL / ACTIONS_RUNTIME_TOKEN into GITHUB_ENV (needs the runner's cache.enabled: true). Drop the unused `:buildcache` cache-ref computation and refresh the stale type=registry comments. No scope= is added: this repo builds a single image (vervain-web), so the GOV-21 multi-image isolation knob does not apply.

#VAPP-36