fix: improve Docker build caching strategy (#336)

* fix: improve Docker build caching strategy

* fix: enhance Docker build caching with GitHub Container registry login

Author: Neunerlei

.github/workflows/publish-version.yml

@@ -42,6 +42,14 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
+      # Required for the registry-backed build cache below
+      - name: Log in to the GitHub Container registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Build and push Docker image
         id: push
         uses: docker/build-push-action@v7
@@ -54,8 +62,12 @@ jobs:
           tags: |
             digitalenvironments/hawki:latest
             digitalenvironments/hawki:${{ steps.version.outputs.version }}
-          cache-from: type=gha,scope=${{ steps.version.outputs.version }}
-          cache-to: type=gha,mode=max,scope=${{ steps.version.outputs.version }}
+          cache-from: |
+            type=registry,ref=ghcr.io/hawk-digital-environments/hawki:buildcache-amd64
+            type=registry,ref=ghcr.io/hawk-digital-environments/hawki:buildcache-arm64
+          # No cache-to on purpose: exporting a combined multi-arch cache here
+          # is what triggered the 504s, and nothing reads such a ref anyway -
+          # the test matrix keeps both per-arch refs up to date.
 
       - name: Generate artifact attestation
         uses: actions/attest@v4

.github/workflows/rebuild-latest-image.yml

@@ -49,6 +49,14 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
+      # Required to read the registry-backed build cache below
+      - name: Log in to the GitHub Container registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Build and push Docker image
         id: push
         uses: docker/build-push-action@v7
@@ -61,8 +69,14 @@ jobs:
           tags: |
             digitalenvironments/hawki:latest
             digitalenvironments/hawki:${{ steps.get_version.outputs.version }}
-          cache-from: type=gha,scope=${{ steps.get_version.outputs.version }}
-          cache-to: type=gha,mode=max,scope=${{ steps.get_version.outputs.version }}
+          # Imports the per-arch caches written by the release gate in
+          # trigger-release.yml. A hotfix rebuild of main may only hit these
+          # partially, which just means a slower build - never a failure.
+          cache-from: |
+            type=registry,ref=ghcr.io/hawk-digital-environments/hawki:buildcache-amd64
+            type=registry,ref=ghcr.io/hawk-digital-environments/hawki:buildcache-arm64
+          # No cache-to on purpose: exporting a combined multi-arch cache is
+          # what triggered the 504s, and nothing reads such a ref anyway.
 
       - name: Generate artifact attestation
         uses: actions/attest@v4

.github/workflows/trigger-release.yml

@@ -22,9 +22,24 @@ jobs:
         uses: hawk-digital-environments/hawk-pipeline-actions/validate-release-branch@v1
 
   test-docker-build:
-    name: Test Docker Build
-    runs-on: ubuntu-latest
+    name: Test Docker Build (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
     needs: validate
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      # Always test both architectures, so an arch-specific breakage is
+      # visible instead of being masked by the other job failing first.
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            arch: amd64
+            runner: ubuntu-latest
+          - platform: linux/arm64
+            arch: arm64
+            runner: ubuntu-latest
     steps:
       - name: Checkout release branch
         uses: actions/checkout@v7
@@ -35,17 +50,30 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
+      # Required for the registry-backed build cache below
+      - name: Log in to the GitHub Container registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Test Docker build
         uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile
           push: false
+          # Runs the full build, then discards the image. Keeps this a real
+          # build test while populating the cache for the publish pipeline.
+          outputs: type=cacheonly
           target: app_prod
-          platforms: linux/amd64,linux/arm64
-          tags: digitalenvironments/hawki:release-test
-          cache-from: type=gha,scope=${{ needs.validate.outputs.version }}
-          cache-to: type=gha,mode=max,scope=${{ needs.validate.outputs.version }}
+          platforms: ${{ matrix.platform }}
+          # One cache ref per architecture: keeps each export small enough to
+          # avoid the 504s seen when exporting one combined multi-arch cache.
+          cache-from: type=registry,ref=ghcr.io/hawk-digital-environments/hawki:buildcache-${{ matrix.arch }}
+          # ignore-error: a flaky cache export must not fail the release gate
+          cache-to: type=registry,ref=ghcr.io/hawk-digital-environments/hawki:buildcache-${{ matrix.arch }},mode=max,ignore-error=true
 
   release:
     name: Merge and Tag Release