Fix/attestation last attestation time race #160
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker Image Cache | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '17 3 * * 1' | |
| permissions: | |
| contents: read | |
| packages: write | |
| security-events: write | |
| concurrency: | |
| group: docker-image-cache-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| IMAGE_NAME: ghcr.io/${{ github.repository }}/verinode-backend | |
| CACHE_SCOPE: verinode-backend-node22 | |
| CACHE_MODE: max | |
| jobs: | |
| docker-build: | |
| name: Build cached Docker image | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| outputs: | |
| image-digest: ${{ steps.build.outputs.digest }} | |
| image-metadata: ${{ steps.meta.outputs.json }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| with: | |
| install: true | |
| - name: Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=ref,event=branch | |
| type=ref,event=pr | |
| type=sha,prefix=sha- | |
| - name: Build image with GitHub Actions cache | |
| id: build | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| target: runtime | |
| push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} | |
| load: false | |
| provenance: false | |
| sbom: false | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha,scope=${{ env.CACHE_SCOPE }} | |
| cache-to: type=gha,scope=${{ env.CACHE_SCOPE }},mode=${{ env.CACHE_MODE }} | |
| - name: Cache effectiveness summary | |
| shell: bash | |
| run: | | |
| cat >> "$GITHUB_STEP_SUMMARY" <<'SUMMARY' | |
| ## Docker layer cache | |
| - BuildKit cache backend: `type=gha` | |
| - Cache scope: `${{ env.CACHE_SCOPE }}` | |
| - Cache mode: `${{ env.CACHE_MODE }}` | |
| - Runtime image digest: `${{ steps.build.outputs.digest }}` | |
| Review the build logs for `CACHED` layer entries and elapsed time regressions. | |
| SUMMARY | |
| canary-analysis: | |
| name: Cache canary analysis | |
| runs-on: ubuntu-latest | |
| needs: docker-build | |
| if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch' | |
| steps: | |
| - name: Report canary guardrails | |
| shell: bash | |
| run: | | |
| cat >> "$GITHUB_STEP_SUMMARY" <<'SUMMARY' | |
| ## Canary guardrails | |
| - Dependency and runtime stages must remain separated so app source changes do not invalidate `npm ci` layers. | |
| - Pull requests must keep cache-hit builds below 3 minutes and cache-miss builds below 8 minutes. | |
| - Security review is required for base-image digest or dependency-install changes. | |
| SUMMARY |