From 728fc69976feb50abf6c7de1336303ac6dd24005 Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Fri, 23 Oct 2026 06:02:08 -0700 Subject: [PATCH] ci: cache docker build layers for container_dev (#11980) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * ci: cache docker build layers for container_dev The Go-build image rebuilds its layers on every run; type=gha backend caching reuses them across runs and platforms. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * ci: pin container build to the pushed sha under layer caching Dockerfile.go_build clones master inside the image; a cache-from layer would otherwise keep serving the previous commit's clone and publish stale code under the dev tag. Passing BRANCH=github.sha makes the clone layer's key commit-specific while toolchain layers still hit. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * ci: pass BRANCH via build-args so the per-commit cache key reaches buildx docker/build-push-action has no `args` input — the BRANCH override was silently dropped, leaving the build arg at its `master` default and the clone/checkout layers serving a stale commit under the gha cache. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .github/workflows/container_dev.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/container_dev.yml b/.github/workflows/container_dev.yml index f5d880a8ec..dd8c5843fc 100644 --- a/.github/workflows/container_dev.yml +++ b/.github/workflows/container_dev.yml @@ -197,6 +197,12 @@ jobs: platforms: linux/amd64, linux/arm64 tags: ${{ steps.docker_meta.outputs.tags }} labels: ${{ steps.docker_meta.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max + # Key the checkout layer on the pushed sha so cached layers can't + # serve stale code; the Dockerfile fetch fallback picks it up. + build-args: | + BRANCH=${{ github.sha }} - name: Sign if: github.event_name != 'pull_request'