Context
Found while investigating why `doc.yaml`'s docs-image build showed no cache hits on a second run: `tools/ci/pre-commit/build_doc.sh` (the docs toolchain image builder) never wires up a registry cache, unlike `tools/e2e/scripts/build.sh` (the E2E workspace image builder), which already accepts a `CACHE_REF` env var and passes `--cache-from`/`--cache-to` to `podman build` — populated in `ci.yaml`'s `build-workspace` job via a `ghcr.io//dc-workspace-cache` ref.
Every GitHub Actions run is a fresh VM, so podman's build cache is local-only and never survives between runs unless it round-trips through a registry the way the workspace image already does. `doc.yaml` never logs into `ghcr.io` or computes a cache ref, so its (fairly heavy — Rust toolchain + 5 `cargo install`s + strictdoc) image rebuilds from scratch on every single run, first or hundredth.
Scope
- Add `CACHE_REF` support to `tools/ci/pre-commit/build_doc.sh`, mirroring `tools/e2e/scripts/build.sh`'s pattern.
- Wire `doc.yaml` to log into `ghcr.io`, compute a `dc-doc-cache` ref, and pass it through — mirroring `ci.yaml`'s `build-workspace` job.
Out of scope
`ci.yaml`'s `build-e2e-image` job also runs a bare `podman build` (for `tools/e2e/Containerfile.e2e`) with no cache flags — but its `FROM` is the just-built, SHA-tagged workspace image, which changes every run. A registry cache keyed on the previous layer's digest can never hit there regardless of ref, and the layer itself is just 3 `COPY`s + a `chmod` (sub-second), so there's nothing worth caching. Left as-is.
Context
Found while investigating why `doc.yaml`'s docs-image build showed no cache hits on a second run: `tools/ci/pre-commit/build_doc.sh` (the docs toolchain image builder) never wires up a registry cache, unlike `tools/e2e/scripts/build.sh` (the E2E workspace image builder), which already accepts a `CACHE_REF` env var and passes `--cache-from`/`--cache-to` to `podman build` — populated in `ci.yaml`'s `build-workspace` job via a `ghcr.io//dc-workspace-cache` ref.
Every GitHub Actions run is a fresh VM, so podman's build cache is local-only and never survives between runs unless it round-trips through a registry the way the workspace image already does. `doc.yaml` never logs into `ghcr.io` or computes a cache ref, so its (fairly heavy — Rust toolchain + 5 `cargo install`s + strictdoc) image rebuilds from scratch on every single run, first or hundredth.
Scope
Out of scope
`ci.yaml`'s `build-e2e-image` job also runs a bare `podman build` (for `tools/e2e/Containerfile.e2e`) with no cache flags — but its `FROM` is the just-built, SHA-tagged workspace image, which changes every run. A registry cache keyed on the previous layer's digest can never hit there regardless of ref, and the layer itself is just 3 `COPY`s + a `chmod` (sub-second), so there's nothing worth caching. Left as-is.