docs(build): document the temporary no-cache on docker builds by bedatty · Pull Request #955 · LerianStudio/github-actions-shared-workflows

bedatty · 2026-10-21T19:05:54Z

	GitHub Actions Shared Workflows

Description

Documentation follow-up to #954, which is already merged and released in v1.87.1. That PR set no-cache: true + pull: true on the docker/build-push-action steps in build.yml and in the docker-build-ts composite, so a cached rebuild stops replaying the old apk/apt layer and shipping the vulnerable ca-certificates. This PR contains no workflow changes — only the docs that the behaviour change left stale.

File	Change
`docs/build.md`	New "Layer cache — temporarily disabled" section; corrected two passages that still promised layer reuse
`src/build/docker-build-ts/README.md`	Same section for the composite, which documented nothing about caching

docs/build.md claimed the identity-verification layers land in the Actions cache so the push build reuses them for that platform instead of compiling it twice. With no-cache that is false, and nothing told callers that their builds had lost layer reuse, or why.

The new section states what the measure costs: no layer is reused, cache-from: type=gha reads nothing while cache-to keeps writing, and no input was added or removed, so nothing changes in how the workflow is called. It points at #953 for the revert.

Type of Change

feat: New workflow or new input/output/step in an existing workflow
fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)
perf: Performance improvement (e.g. caching, parallelism, reduced steps)
refactor: Internal restructuring with no behavior change
docs: Documentation only (README, docs/, inline comments)
ci: Changes to self-CI (workflows under .github/workflows/ that run on this repo)
chore: Dependency bumps, config updates, maintenance
test: Adding or updating tests
BREAKING CHANGE: Callers must update their configuration after this PR

Breaking Changes

None. No executable file is touched.

Testing

YAML syntax validated locally
Triggered a real workflow run on a caller repository using @this-branch or the beta tag
Verified all existing inputs still work with default values
Confirmed no secrets or tokens are printed in logs
Checked that unrelated workflows are not affected

Documentation only — no run to link. The behaviour it describes shipped in #954 / v1.87.1.

Related Issues

Documents the measure tracked for revert in #953. Follow-up to #954.

The no-cache/pull flags changed behaviour for every caller of build.yml and docker-build-ts, but the docs still promised layer reuse: docs/build.md said the identity-verification layers land in the Actions cache so the push build reuses them, and the composite README said nothing at all. Add a "Layer cache — temporarily disabled" section to both, naming what it costs callers (no layer reuse, cache-from reads nothing while cache-to keeps writing, no input added or removed) and pointing at #953 for the revert.

coderabbitai · 2026-10-21T19:06:05Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Source mode: Auto
Repository: LerianStudio/github-actions-shared-workflows
Branch: hotfix/docker-build-no-cache
File: .coderabbit.yml
Commit: e23c0b4
Layers: Repository YAML
Review profile: ASSERTIVE
Plan: Essentials
Run ID: 15111e19-6b59-4531-bdda-bf8866a413b9

📥 Commits

Reviewing files that changed from the base of the PR and between f5f38df and e23c0b4.

📒 Files selected for processing: 1

src/build/docker-build-ts/README.md

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Walkthrough

The documentation describes temporary Docker layer-cache disabling with no-cache: true and pull: true. It records cache read and write behavior, unchanged caller configuration, rollback criteria, and the effect on platform verification builds. No implementation changes are described.

Changes

Docker build cache documentation

Layer / File(s)	Summary
Cache behavior and verification guidance `docs/build.md`, `src/build/docker-build-ts/README.md`	Documents uncached builds, base-image refreshes, cache behavior, and unchanged action inputs. It notes that platform verification builds compile twice while no-cache mode is active and records the stated reversion criteria.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

Possibly related issues

feat: revert the temporary no-cache on docker builds once every repo is rebuilt #953: The documentation records that the mitigation is temporary and describes its reversion criteria, but this pull request does not remove the mitigation.

Suggested reviewers: fredcamaral

Merge Risk: ⚪ Minimal · up to e23c0

The documentation-only change is mergeable with no identified current-head risk.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the documentation change and the temporary no-cache behavior for Docker builds.
Description check		The description follows the template, explains the purpose and affected files, identifies the change as documentation-only, states that there are no breaking changes, and records the available validat…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description follows the template, explains the purpose and affected files, identifies the change as documentation-only, states that there are no breaking changes, and records the available validation. It also explains why no caller workflow run was linked.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

lerian-studio · 2026-10-21T19:06:48Z

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
Breaking Change Guard	✅ success	yes
Commit Signatures	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

_{🔍 View workflow run}

lerian-studio · 2026-10-21T19:07:43Z

🔍 Lint Analysis

Check	Files Scanned	Status
YAML Lint	no changes	⏭️ skipped
Action Lint	no changes	⏭️ skipped
Pinned Actions	no changes	⏭️ skipped
Markdown Link Check	2 file(s)	✅ success
Spelling Check	2 file(s)	✅ success
Shell Check	no changes	⏭️ skipped
README Check	no changes	⏭️ skipped
Composite Schema	no changes	⏭️ skipped
Deployment Matrix	no changes	⏭️ skipped

_{🔍 View full scan logs}

The section said "the build step" and "builds are therefore slower", but the composite has two mutually exclusive build steps and only the push one carries no-cache/pull. Name the push step, and say why the dry-run step is left alone: push: false, no cache-to, so nothing it builds reaches a published image or seeds the cache the push build reads. docs/build.md needs no equivalent change — in build.yml both steps, including the push: false identity-verification build whose layers feed the push through the GHA cache, carry the flags.

lerian-studio · 2026-10-22T12:40:22Z

@coderabbitai review

coderabbitai · 2026-10-22T12:40:30Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

bedatty requested a review from a team as a code owner October 21, 2026 19:05

lerian-studio assigned bedatty Oct 21, 2026

lerian-studio added size/XS PR changes < 50 lines documentation Improvements or additions to documentation build Changes to build and artifact composite actions (src/build/) labels Oct 21, 2026

This comment has been minimized.

Sign in to view

lerian-studio added the review-ready Required checks passed — CodeRabbit is cleared to review label Oct 21, 2026

This comment has been minimized.

Sign in to view

This comment was marked as resolved.

Sign in to view

bedatty changed the title ~~fix(build): force no-cache so images stop shipping stale ca-certificates~~ docs(build): document the temporary no-cache on docker builds Oct 21, 2026

lerian-studio added size/S PR changes 50–199 lines and removed size/XS PR changes < 50 lines labels Oct 22, 2026

coderabbitai Bot approved these changes Oct 22, 2026

View reviewed changes

bedatty merged commit 69ffcb3 into develop Oct 22, 2026
48 checks passed

fredcamaral deleted the hotfix/docker-build-no-cache branch October 22, 2026 20:03

Navigation Menu

Repository navigation

docs(build): document the temporary no-cache on docker builds - #955

docs(build): document the temporary no-cache on docker builds#955
bedatty merged 2 commits into
developfrom
hotfix/docker-build-no-cache

bedatty commented Oct 21, 2026 •

edited

Loading

GitHub Actions Shared Workflows

Uh oh!

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

lerian-studio commented Oct 21, 2026 •

edited

Loading

Uh oh!

lerian-studio commented Oct 21, 2026 •

edited

Loading

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment was marked as resolved.

Uh oh!

lerian-studio commented Oct 22, 2026

Uh oh!

coderabbitai Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

bedatty commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Actions Shared Workflows

Description

Type of Change

Breaking Changes

Testing

Related Issues

Uh oh!

coderabbitai Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

lerian-studio commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Uh oh!

lerian-studio commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Lint Analysis

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment was marked as resolved.

Uh oh!

lerian-studio commented Oct 22, 2026

Uh oh!

coderabbitai Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bedatty commented Oct 21, 2026 •

edited

Loading

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading

lerian-studio commented Oct 21, 2026 •

edited

Loading

lerian-studio commented Oct 21, 2026 •

edited

Loading

coderabbitai Bot commented Oct 22, 2026 •

edited

Loading