perf(ci): optimize docker sandbox CI from ~10min to ~3min

Three-pronged optimization for the docker-sandbox-online CI job:

1. Multi-stage Dockerfile: split into sandbox-base/test/full targets.
   Test profiles skip the entire Node.js/pnpm/React UI build stage.
   Full target (default) retains UI+Node for playground/dev/devcontainer.

2. GHA Docker layer cache: both sandbox jobs now use buildx with
   cache-from/cache-to (type=gha), eliminating cold image rebuilds.
   Pre-built images are passed via SANDBOX_IMAGE env var.

3. Clone reference cache: online TestMain pre-clones frequently used
   repos as bare repos; cloneRepo() uses git --reference to reuse
   local objects instead of re-downloading from GitHub on every test.

Author: runkids

.devcontainer/docker-compose.yml

@@ -7,6 +7,7 @@ services:
     build:
       context: ..
       dockerfile: docker/sandbox/Dockerfile
+      target: full
     working_dir: /workspace
     command: sleep infinity
     environment:

.github/workflows/test.yaml

@@ -56,8 +56,24 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build sandbox image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/sandbox/Dockerfile
+          target: test
+          load: true
+          tags: skillshare-sandbox-test:ci
+          cache-from: type=gha,scope=sandbox-test
+          cache-to: type=gha,scope=sandbox-test,mode=max
+
       - name: Docker Sandbox Tests (Offline)
-        run: ./scripts/test_docker.sh
+        run: ./scripts/test_docker.sh --skip-build
+        env:
+          SANDBOX_IMAGE: skillshare-sandbox-test:ci
 
   docker-sandbox-online:
     runs-on: ubuntu-latest
@@ -66,8 +82,24 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build sandbox image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/sandbox/Dockerfile
+          target: test
+          load: true
+          tags: skillshare-sandbox-test:ci
+          cache-from: type=gha,scope=sandbox-test
+          cache-to: type=gha,scope=sandbox-test,mode=max
+
       - name: Docker Sandbox Tests (Online)
-        run: ./scripts/test_docker_online.sh
+        run: ./scripts/test_docker_online.sh --skip-build
+        env:
+          SANDBOX_IMAGE: skillshare-sandbox-test:ci
 
   redteam:
     runs-on: ubuntu-latest

docker-compose.sandbox.yml

@@ -2,6 +2,7 @@ x-sandbox-common: &sandbox-common
   build:
     context: .
     dockerfile: docker/sandbox/Dockerfile
+    target: full
   working_dir: /workspace
   environment:
     GOCACHE: /go/build-cache
@@ -17,9 +18,17 @@ x-sandbox-common: &sandbox-common
         cpus: "2"
         memory: "2G"
 
+x-sandbox-test: &sandbox-test
+  <<: *sandbox-common
+  image: ${SANDBOX_IMAGE:-}
+  build:
+    context: .
+    dockerfile: docker/sandbox/Dockerfile
+    target: test
+
 services:
   sandbox-offline:
-    <<: *sandbox-common
+    <<: *sandbox-test
     profiles:
       - offline
     command:
@@ -30,7 +39,7 @@ services:
       GOCACHE: /go/build-cache
 
   sandbox-online:
-    <<: *sandbox-common
+    <<: *sandbox-test
     profiles:
       - online
     command:

docker/sandbox/Dockerfile

@@ -13,8 +13,8 @@ RUN pnpm install --frozen-lockfile
 COPY ui/ ./
 RUN pnpm run build
 
-# Stage 2: Go sandbox with pre-built frontend
-FROM golang:${GO_VERSION}-bookworm
+# Stage 2: Go sandbox base (shared by test and full targets)
+FROM golang:${GO_VERSION}-bookworm AS sandbox-base
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
@@ -29,18 +29,6 @@ RUN apt-get update \
 RUN go install github.com/air-verse/air@latest \
     && go install github.com/go-delve/delve/cmd/dlv@latest
 
-# Copy node runtime from ui-builder stage (for devcontainer / interactive use)
-COPY --from=ui-builder /usr/local/bin/node /usr/local/bin/
-COPY --from=ui-builder /usr/local/lib/node_modules /usr/local/lib/node_modules
-RUN ln -sf ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
-    && ln -sf ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \
-    && ln -sf ../lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack
-ARG PNPM_VERSION
-RUN npm install -g pnpm@${PNPM_VERSION}
-
-# Copy pre-built frontend for playground UI cache
-COPY --from=ui-builder /ui/dist /ui-dist
-
 COPY docker/sandbox/entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
@@ -52,3 +40,21 @@ RUN mkdir -p /go/build-cache /go/pkg/mod && chmod -R 0777 /go/build-cache /go/pk
 
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["bash", "-c", "./scripts/test.sh"]
+
+# Stage 3: Test target (no UI, no Node.js — for offline/online CI tests)
+FROM sandbox-base AS test
+
+# Stage 4: Full target (with UI + Node.js — for playground/dev/devcontainer)
+FROM sandbox-base AS full
+
+# Copy node runtime from ui-builder stage (for devcontainer / interactive use)
+COPY --from=ui-builder /usr/local/bin/node /usr/local/bin/
+COPY --from=ui-builder /usr/local/lib/node_modules /usr/local/lib/node_modules
+RUN ln -sf ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
+    && ln -sf ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \
+    && ln -sf ../lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack
+ARG PNPM_VERSION
+RUN npm install -g pnpm@${PNPM_VERSION}
+
+# Copy pre-built frontend for playground UI cache
+COPY --from=ui-builder /ui/dist /ui-dist

internal/install/install_git.go

@@ -141,7 +141,12 @@ func cloneRepo(url, destPath, branch string, shallow bool, onProgress ProgressCa
 	} else {
 		args = append(args, "--quiet")
 	}
-	if shallow {
+	// Use a local reference repo when available (speeds up CI by avoiding
+	// redundant network downloads).  --reference is incompatible with
+	// --depth, so we skip shallow when a reference is found.
+	if ref := findCloneReference(url); ref != "" {
+		args = append(args, "--reference", ref)
+	} else if shallow {
 		args = append(args, "--depth", "1")
 	}
 	if branch != "" {
@@ -151,6 +156,37 @@ func cloneRepo(url, destPath, branch string, shallow bool, onProgress ProgressCa
 	return runGitCommandWithProgress(args, "", authEnv(url), onProgress)
 }
 
+// CloneCacheName converts a clone URL to the bare-repo directory name used
+// inside SKILLSHARE_CLONE_CACHE.  The format is "owner__repo.git" to avoid
+// collisions across owners.
+//
+//	"https://github.com/user/repo.git" → "user__repo.git"
+//	"https://github.com/user/repo"     → "user__repo.git"
+//	"user/repo"                         → "user__repo.git"
+//	"repo"                              → "repo.git"
+func CloneCacheName(cloneURL string) string {
+	trimmed := strings.TrimSuffix(cloneURL, ".git")
+	parts := strings.Split(trimmed, "/")
+	if len(parts) >= 2 {
+		return parts[len(parts)-2] + "__" + parts[len(parts)-1] + ".git"
+	}
+	return filepath.Base(trimmed) + ".git"
+}
+
+// findCloneReference checks SKILLSHARE_CLONE_CACHE for a local bare repo
+// matching the given URL.  Returns the path to the bare repo, or "".
+func findCloneReference(cloneURL string) string {
+	cacheDir := os.Getenv("SKILLSHARE_CLONE_CACHE")
+	if cacheDir == "" {
+		return ""
+	}
+	ref := filepath.Join(cacheDir, CloneCacheName(cloneURL))
+	if info, err := os.Stat(ref); err == nil && info.IsDir() {
+		return ref
+	}
+	return ""
+}
+
 // gitPull performs a git pull (quiet mode).
 // If the remote uses HTTPS and a token is available, it injects
 // authentication via GIT_CONFIG env vars (same mechanism as cloneRepo).

internal/install/install_git_test.go

@@ -155,3 +155,50 @@ func runGit(t *testing.T, dir string, args ...string) {
 		t.Fatalf("git %v failed: %s\n%s", args, err, out)
 	}
 }
+
+func TestCloneCacheName(t *testing.T) {
+	tests := []struct {
+		url  string
+		want string
+	}{
+		{"https://github.com/user/repo.git", "user__repo.git"},
+		{"https://github.com/user/repo", "user__repo.git"},
+		{"user/repo", "user__repo.git"},
+		{"https://github.com/runkids/skillshare.git", "runkids__skillshare.git"},
+		{"https://github.com/org/my-skills", "org__my-skills.git"},
+		{"repo", "repo.git"},
+		{"git@github.com:user/repo.git", "git@github.com:user__repo.git"}, // SSH URLs use ":" not "/" — won't match HTTPS cache
+	}
+	for _, tt := range tests {
+		t.Run(tt.url, func(t *testing.T) {
+			got := CloneCacheName(tt.url)
+			if got != tt.want {
+				t.Errorf("CloneCacheName(%q) = %q, want %q", tt.url, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestFindCloneReference(t *testing.T) {
+	// Without SKILLSHARE_CLONE_CACHE, always returns ""
+	t.Setenv("SKILLSHARE_CLONE_CACHE", "")
+	if ref := findCloneReference("https://github.com/user/repo.git"); ref != "" {
+		t.Errorf("expected empty, got %q", ref)
+	}
+
+	// With cache dir containing a matching bare repo
+	cache := t.TempDir()
+	bare := filepath.Join(cache, "user__repo.git")
+	os.MkdirAll(bare, 0755)
+	t.Setenv("SKILLSHARE_CLONE_CACHE", cache)
+
+	ref := findCloneReference("https://github.com/user/repo.git")
+	if ref != bare {
+		t.Errorf("expected %q, got %q", bare, ref)
+	}
+
+	// Non-matching URL returns ""
+	if ref := findCloneReference("https://github.com/other/thing.git"); ref != "" {
+		t.Errorf("expected empty for non-matching URL, got %q", ref)
+	}
+}

internal/install/sparse_checkout.go

@@ -49,7 +49,17 @@ func sparseCloneSubdir(url, subdir, destPath, branch string, extraEnv []string,
 		return fmt.Errorf("sparse checkout requires non-empty subdir")
 	}
 
-	cloneArgs := []string{"clone", "--filter=blob:none", "--no-checkout", "--depth", "1"}
+	cloneArgs := []string{"clone", "--filter=blob:none", "--no-checkout"}
+	// Use a local reference repo when available.  With --reference the
+	// checkout step reads blobs from the local alternates instead of
+	// fetching them from the remote, making the operation nearly instant.
+	// --reference is incompatible with --depth, so we only add --depth
+	// when no reference is found.
+	if ref := findCloneReference(url); ref != "" {
+		cloneArgs = append(cloneArgs, "--reference", ref)
+	} else {
+		cloneArgs = append(cloneArgs, "--depth", "1")
+	}
 	if branch != "" {
 		cloneArgs = append(cloneArgs, "--branch", branch)
 	}

tests/integration/testmain_online_test.go

@@ -0,0 +1,39 @@
+//go:build online
+
+package integration
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+
+	"skillshare/internal/install"
+)
+
+// TestMain pre-clones frequently used repos as bare repos into a temporary
+// cache directory.  Online tests that invoke `skillshare install/update`
+// benefit from git's --reference mechanism: the CLI reuses local objects
+// instead of re-downloading them from GitHub on every test.
+func TestMain(m *testing.M) {
+	cache, err := os.MkdirTemp("", "skillshare-online-cache-*")
+	if err != nil {
+		os.Exit(m.Run()) // fall through — tests still work, just slower
+	}
+
+	repos := []string{
+		"https://github.com/runkids/skillshare.git",
+		"https://github.com/sickn33/antigravity-awesome-skills.git",
+	}
+	for _, url := range repos {
+		dest := filepath.Join(cache, install.CloneCacheName(url))
+		cmd := exec.Command("git", "clone", "--bare", url, dest)
+		cmd.Env = append(os.Environ(), "GIT_TERMINAL_PROMPT=0")
+		_ = cmd.Run() // non-fatal: if it fails, tests just skip the cache
+	}
+
+	os.Setenv("SKILLSHARE_CLONE_CACHE", cache)
+	code := m.Run()
+	os.RemoveAll(cache)
+	os.Exit(code)
+}