Apply suggestions from code review

Co-authored-by: kirkrodrigues <2454684+kirkrodrigues@users.noreply.github.com>

Author: jackluo923

.github/workflows/yscope-velox-builder-img.yml

@@ -89,6 +89,12 @@ jobs:
             echo "Image does not exist, will build"
           fi
 
+      - name: Extract GitHub metadata
+        if: steps.check-image.outputs.exists == 'false'
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{steps.image-tag.outputs.tag}}
+
       - name: Set up Docker Buildx
         if: steps.check-image.outputs.exists == 'false'
         uses: docker/setup-buildx-action@v3

.github/zizmor.yml

@@ -15,6 +15,7 @@ rules:
   use-trusted-publishing:
     ignore:
       - build_pyvelox.yml
+
   # linux-build-base.yml uses ghcr.io/y-scope/docker-github-actions-runner:ubuntu-jammy
   # which is our own self-maintained image - we intentionally use the floating tag to
   # receive security and maintenance updates automatically

scripts/docker/yscope-velox-builder.dockerfile

@@ -57,14 +57,12 @@ ENV CCACHE_MAXSIZE=5G
 # by CI builds (which run in /__w/velox/velox/)
 ENV CCACHE_NOHASHDIR=true
 
-# Copy velox source for warmup build to populate ccache
-COPY . /tmp/velox-src/
-WORKDIR /tmp/velox-src
-
 # Build velox once to warm up ccache
 # NOTE:
 # - We set `CCACHE_BASEDIR` so cache keys use relative paths.
 # - We clear the stats after warmup so that CI builds only show their own cache hits.
+COPY . /tmp/velox-src/
+WORKDIR /tmp/velox-src
 RUN CCACHE_BASEDIR=/tmp/velox-src make release \
     && echo "CCache statistics after warmup build:" \
     && ccache --verbose --show-stats \