ci: add sccache to docker build (#32)

Author: fegmorte

.github/workflows/common-docker.yml

@@ -69,6 +69,10 @@ on:
       rust-version:
         type: string
         required: false
+      lto-release:
+        type: string
+        required: false
+        default: "release-lto-thin"
     outputs:
       image:
         description: "Image Name with Tag generated by this task"
@@ -216,10 +220,17 @@ jobs:
         with:
           build-args: |
             RUST_IMAGE_VERSION=${{ env.RUST_IMAGE_VERSION }}
+            LTO_RELEASE=${{ inputs.lto-release }}
             TARGETARCH=${{ matrix.platform-tag }}
             APP_CACHE_DIR=${{ inputs.app-cache-dir }}
+            SCCACHE_BUCKET=${{ env.RUNS_ON_S3_BUCKET_CACHE }}
+            SCCACHE_REGION=${{ env.RUNS_ON_AWS_REGION }}
+            SCCACHE_S3_PREFIX=sccache/${{ github.repository }}/${{ inputs.app-cache-dir }}/${{ matrix.platform-tag }}
           context: ${{ inputs.docker-context }}
-          secrets: BLOCKCHAIN_ACTIONS_TOKEN=${{ secrets.BLOCKCHAIN_ACTIONS_TOKEN }}
+          secrets: |
+            BLOCKCHAIN_ACTIONS_TOKEN=${{ secrets.BLOCKCHAIN_ACTIONS_TOKEN }}
+            sccache_aws_access_key_id=${{ secrets.AWS_ACCESS_KEY_S3_USER }}
+            sccache_aws_secret_access_key=${{ secrets.AWS_SECRET_KEY_S3_USER }}
           file: ${{ inputs.docker-file }}
           platforms: ${{ matrix.platform }}
           push: ${{ inputs.push_image }}
@@ -230,8 +241,20 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           tags: |
             ghcr.io/zama-ai/${{ inputs.image-name }}:${{ needs.determine-tag.outputs.docker_tag }}-${{ matrix.platform-tag }}-${{ matrix.docker-target }}
-          cache-from: type=s3,blobs_prefix=cache/${{ github.repository }}-${{ inputs.app-cache-dir }}-${{ matrix.platform-tag }}/,manifests_prefix=cache/${{ github.repository }}-${{ inputs.app-cache-dir }}-${{ matrix.platform-tag }}/,region=${{ env.RUNS_ON_AWS_REGION }},bucket=${{ env.RUNS_ON_S3_BUCKET_CACHE }}
-          cache-to: type=s3,blobs_prefix=cache/${{ github.repository }}-${{ inputs.app-cache-dir }}-${{ matrix.platform-tag }}/,manifests_prefix=cache/${{ github.repository }}-${{ inputs.app-cache-dir }}-${{ matrix.platform-tag }}/,region=${{ env.RUNS_ON_AWS_REGION }},bucket=${{ env.RUNS_ON_S3_BUCKET_CACHE }},mode=max
+          # BuildKit layer cache, scoped per-branch with `main` as a fallback baseline.
+          # - cache-from: read from this branch's prefix first, then fall back to `main`.
+          #   On the first build of a feature branch the per-branch prefix is empty,
+          #   so we still benefit from `main`'s warm layers. Subsequent builds on the
+          #   same branch hit their own prefix and avoid clobbering other PRs.
+          # - cache-to: write only to the current branch's prefix to prevent concurrent
+          #   PRs from overwriting each other's manifests. When the current branch IS
+          #   `main`, this naturally writes to `main`, keeping the shared baseline fresh.
+          # Pair this with an S3 lifecycle policy that expires per-branch prefixes after
+          # ~14 days of inactivity so cache storage doesn't grow unboundedly.
+          cache-from: |
+            type=s3,blobs_prefix=cache/${{ github.repository }}-${{ inputs.app-cache-dir }}-${{ matrix.platform-tag }}/${{ github.head_ref || github.ref_name }}/,manifests_prefix=cache/${{ github.repository }}-${{ inputs.app-cache-dir }}-${{ matrix.platform-tag }}/${{ github.head_ref || github.ref_name }}/,region=${{ env.RUNS_ON_AWS_REGION }},bucket=${{ env.RUNS_ON_S3_BUCKET_CACHE }}
+            type=s3,blobs_prefix=cache/${{ github.repository }}-${{ inputs.app-cache-dir }}-${{ matrix.platform-tag }}/main/,manifests_prefix=cache/${{ github.repository }}-${{ inputs.app-cache-dir }}-${{ matrix.platform-tag }}/main/,region=${{ env.RUNS_ON_AWS_REGION }},bucket=${{ env.RUNS_ON_S3_BUCKET_CACHE }}
+          cache-to: type=s3,blobs_prefix=cache/${{ github.repository }}-${{ inputs.app-cache-dir }}-${{ matrix.platform-tag }}/${{ github.head_ref || github.ref_name }}/,manifests_prefix=cache/${{ github.repository }}-${{ inputs.app-cache-dir }}-${{ matrix.platform-tag }}/${{ github.head_ref || github.ref_name }}/,region=${{ env.RUNS_ON_AWS_REGION }},bucket=${{ env.RUNS_ON_S3_BUCKET_CACHE }},mode=max
 
       - name: Export image and digest
         id: export-image-and-digest