From f5f38df61b88198271cd3bedbf3e2ce43b08bc25 Mon Sep 17 00:00:00 2001 From: Lucas Bedatty <79675696+bedatty@users.noreply.github.com> Date: Wed, 21 Oct 2026 16:05:26 -0300 Subject: [PATCH 1/2] docs(build): document the temporary no-cache on docker builds MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The no-cache/pull flags changed behaviour for every caller of build.yml and docker-build-ts, but the docs still promised layer reuse: docs/build.md said the identity-verification layers land in the Actions cache so the push build reuses them, and the composite README said nothing at all. Add a "Layer cache — temporarily disabled" section to both, naming what it costs callers (no layer reuse, cache-from reads nothing while cache-to keeps writing, no input added or removed) and pointing at #953 for the revert. --- docs/build.md | 30 +++++++++++++++++++++++++++-- src/build/docker-build-ts/README.md | 16 +++++++++++++++ 2 files changed, 44 insertions(+), 2 deletions(-) diff --git a/docs/build.md b/docs/build.md index c33a4dc4..ebbfb9c8 100644 --- a/docs/build.md +++ b/docs/build.md @@ -192,6 +192,28 @@ The workflow automatically selects platforms based on the tag type: | RC | `true` | `linux/amd64,linux/arm64` | Multi-arch needed in staging | | Release | N/A | `linux/amd64,linux/arm64` | Always full multi-arch support | +## Layer cache — temporarily disabled + +Every Docker build in this workflow currently runs with `no-cache: true` and +`pull: true`. A cached rebuild replays the old `apk`/`apt` layer and would ship +the vulnerable `ca-certificates` again; `no-cache` re-runs every step, and `pull` +re-resolves `FROM`, because `no-cache` alone leaves a base image that still +carries the bad package untouched. + +What this costs callers while the measure is in place: + +- **Builds are slower.** No layer is reused — dependency layers, the toolchain + layer and the compile step all run on every build, on every platform. +- **`cache-from: type=gha` reads nothing.** The export (`cache-to`) still runs, + so the Actions cache keeps being written and is never read back. +- **Nothing in the caller's configuration changes.** There is no input to turn + this off and no input was removed — the flags are set inside the workflow and + the composite. + +This is temporary. It is reverted once every repository has been rebuilt and +redeployed; the revert is tracked in +[#953](https://github.com/LerianStudio/github-actions-shared-workflows/issues/953). + ## Docker Image Tags Generated tags based on semantic versioning: @@ -234,7 +256,9 @@ workflow. `BUILD_TIME` changes on every run, so the layers from its `ARG` onward rebuild each time; put the three `ARG` lines as late as the build stage allows to keep -dependency layers cached. +dependency layers cached. While the temporary `no-cache` measure above is in +place no layer is reused anyway, but the placement still matters for when it is +reverted. ## Build identity contract @@ -291,7 +315,9 @@ For an image whose Dockerfile has adopted the contract, this workflow builds the image for the runner's native platform first, runs `--version` against it, and only then builds and pushes the real multi-arch image. The local image is tagged `build-identity-verify/:` and never leaves the runner; its layers land in the GitHub Actions cache, so the -push build reuses them for that platform instead of compiling it twice. +push build reuses them for that platform instead of compiling it twice — except +while the temporary `no-cache` measure above is in place, where that platform is +compiled twice. The check runs the image with no network and never pulls it, so a tag that is not in the runner's daemon fails locally: diff --git a/src/build/docker-build-ts/README.md b/src/build/docker-build-ts/README.md index e6baff6b..0e9a9985 100644 --- a/src/build/docker-build-ts/README.md +++ b/src/build/docker-build-ts/README.md @@ -78,3 +78,19 @@ Dockerfiles must mount the `npmrc` secret for installing private packages: ```dockerfile RUN --mount=type=secret,id=npmrc,target=/root/.npmrc npm install ``` + +## Layer cache — temporarily disabled + +The build step currently runs with `no-cache: true` and `pull: true`. A cached +rebuild replays the old `apk`/`apt` layer and would ship the vulnerable +`ca-certificates` again; `no-cache` re-runs every step, and `pull` re-resolves +`FROM`, because `no-cache` alone leaves a base image that still carries the bad +package untouched. + +Builds are therefore slower — no layer is reused — and `cache-from: type=gha` +reads nothing while the export keeps writing. No input was added or removed, so +nothing changes in how this action is called. + +This is temporary and is reverted once every repository has been rebuilt and +redeployed; see +[#953](https://github.com/LerianStudio/github-actions-shared-workflows/issues/953). From e23c0b49c3b9b02b963102ad4d7ca1fd60ff2084 Mon Sep 17 00:00:00 2001 From: Lucas Bedatty <79675696+bedatty@users.noreply.github.com> Date: Thu, 22 Oct 2026 09:39:09 -0300 Subject: [PATCH 2/2] docs(build): scope the no-cache note to the push build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The section said "the build step" and "builds are therefore slower", but the composite has two mutually exclusive build steps and only the push one carries no-cache/pull. Name the push step, and say why the dry-run step is left alone: push: false, no cache-to, so nothing it builds reaches a published image or seeds the cache the push build reads. docs/build.md needs no equivalent change — in build.yml both steps, including the push: false identity-verification build whose layers feed the push through the GHA cache, carry the flags. --- src/build/docker-build-ts/README.md | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/src/build/docker-build-ts/README.md b/src/build/docker-build-ts/README.md index 0e9a9985..0a39e131 100644 --- a/src/build/docker-build-ts/README.md +++ b/src/build/docker-build-ts/README.md @@ -81,15 +81,20 @@ RUN --mount=type=secret,id=npmrc,target=/root/.npmrc npm install ## Layer cache — temporarily disabled -The build step currently runs with `no-cache: true` and `pull: true`. A cached -rebuild replays the old `apk`/`apt` layer and would ship the vulnerable -`ca-certificates` again; `no-cache` re-runs every step, and `pull` re-resolves -`FROM`, because `no-cache` alone leaves a base image that still carries the bad -package untouched. - -Builds are therefore slower — no layer is reused — and `cache-from: type=gha` -reads nothing while the export keeps writing. No input was added or removed, so -nothing changes in how this action is called. +The **push** build step (`dry-run` unset or `false`) currently runs with +`no-cache: true` and `pull: true`. A cached rebuild replays the old `apk`/`apt` +layer and would ship the vulnerable `ca-certificates` again; `no-cache` re-runs +every step, and `pull` re-resolves `FROM`, because `no-cache` alone leaves a +base image that still carries the bad package untouched. + +Push builds are therefore slower — no layer is reused — and `cache-from: +type=gha` reads nothing while the export keeps writing. No input was added or +removed, so nothing changes in how this action is called. + +The `dry-run: true` step is deliberately left alone. It is mutually exclusive +with the push step, sets `push: false`, and declares no `cache-to`, so nothing +it builds can reach a published image or seed the cache the push build reads. +Forcing a cold rebuild there would cost time without closing any gap. This is temporary and is reverted once every repository has been rebuilt and redeployed; see