ci: stop version bumps rebuilding the eval Docker image (cache key trio)

Three coupled fixes, atomic because any subset is worse than none:

1. Image tag keys on hashFiles(Dockerfile.ci, bun.lock) — package.json is
   out: its version field changed on 60/60 recent commits, forcing a ~2min
   image rebuild per PR for a dependency set only bun.lock determines.
2. ci-image.yml now pushes that same content-hash tag (previously only
   :latest/:sha, so the weekly prebuild never warmed the tag the eval
   matrix actually looks up) and both eval workflows get registry layer
   cache (cache-to export gated to same-repo runs; fork tokens cannot
   write GHCR).
3. Dockerfile bakes /opt/node_modules_cache/.bun.lock and the runtime
   Restore-deps guard diffs bun.lock instead of package.json — otherwise
   every version-only bump made all 14 matrix jobs fall back to a live
   bun install, which is slower than today's behavior.

Worst-case failure mode is self-healing: a missing tag or cache falls
back to exactly the previous rebuild-and-install path.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/docker/Dockerfile.ci

@@ -113,7 +113,8 @@ RUN bun --version && node --version && claude --version && jq --version && gh --
 # if we move it out of the way and symlink back
 # Save node_modules + package.json snapshot for cache validation at runtime
 RUN mv /workspace/node_modules /opt/node_modules_cache \
-    && cp /workspace/package.json /opt/node_modules_cache/.package.json
+    && cp /workspace/package.json /opt/node_modules_cache/.package.json \
+    && cp /workspace/bun.lock /opt/node_modules_cache/.bun.lock
 
 # Claude CLI refuses --dangerously-skip-permissions as root.
 # Create a non-root user for eval runs (GH Actions overrides USER, so

.github/workflows/ci-image.yml

@@ -25,6 +25,12 @@ jobs:
       # Copy lockfile + package.json into Docker build context
       - run: cp package.json bun.lock .github/docker/
 
+      # Same content-hash tag expression as evals.yml / evals-periodic.yml.
+      # This is the tag the eval matrix looks up first — without pushing it
+      # here, the weekly/main prebuild never warms the cache that matters.
+      - id: meta
+        run: echo "tag=ghcr.io/${{ github.repository }}/ci:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock') }}" >> "$GITHUB_OUTPUT"
+
       - uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -36,6 +42,9 @@ jobs:
           context: .github/docker
           file: .github/docker/Dockerfile.ci
           push: true
+          cache-from: type=registry,ref=ghcr.io/${{ github.repository }}/ci:buildcache
+          cache-to: type=registry,ref=ghcr.io/${{ github.repository }}/ci:buildcache,mode=max
           tags: |
+            ${{ steps.meta.outputs.tag }}
             ghcr.io/${{ github.repository }}/ci:latest
             ghcr.io/${{ github.repository }}/ci:${{ github.sha }}

.github/workflows/evals-periodic.yml

@@ -25,7 +25,9 @@ jobs:
       - uses: actions/checkout@v4
 
       - id: meta
-        run: echo "tag=${{ env.IMAGE }}:${{ hashFiles('.github/docker/Dockerfile.ci', 'package.json', 'bun.lock') }}" >> "$GITHUB_OUTPUT"
+        # Keep in sync with evals.yml — key on Dockerfile + lockfile only
+        # (package.json's version field would bust the key on every ship).
+        run: echo "tag=${{ env.IMAGE }}:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock') }}" >> "$GITHUB_OUTPUT"
 
       - uses: docker/login-action@v3
         with:
@@ -51,6 +53,9 @@ jobs:
           context: .github/docker
           file: .github/docker/Dockerfile.ci
           push: true
+          # Cron-triggered in the base repo only, so cache export is always safe here.
+          cache-from: type=registry,ref=${{ env.IMAGE }}:buildcache
+          cache-to: type=registry,ref=${{ env.IMAGE }}:buildcache,mode=max
           tags: |
             ${{ steps.meta.outputs.tag }}
             ${{ env.IMAGE }}:latest
@@ -107,7 +112,7 @@ jobs:
       # are on different overlay-fs layers, so cross-device hardlink fails.
       - name: Restore deps
         run: |
-          if [ -d /opt/node_modules_cache ] && diff -q /opt/node_modules_cache/.package.json package.json >/dev/null 2>&1; then
+          if [ -d /opt/node_modules_cache ] && diff -q /opt/node_modules_cache/.bun.lock bun.lock >/dev/null 2>&1; then
             cp -r /opt/node_modules_cache node_modules
           else
             bun install

.github/workflows/evals.yml

@@ -25,7 +25,12 @@ jobs:
       - uses: actions/checkout@v4
 
       - id: meta
-        run: echo "tag=${{ env.IMAGE }}:${{ hashFiles('.github/docker/Dockerfile.ci', 'package.json', 'bun.lock') }}" >> "$GITHUB_OUTPUT"
+        # Key on Dockerfile + lockfile only. package.json is deliberately NOT
+        # hashed: its version field changes on every ship (60/60 recent commits),
+        # which rebuilt the image each time for a dependency set that only
+        # bun.lock determines. A stale baked package.json is harmless — checkout
+        # overwrites /workspace and node_modules comes from the lockfile.
+        run: echo "tag=${{ env.IMAGE }}:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock') }}" >> "$GITHUB_OUTPUT"
 
       - uses: docker/login-action@v3
         with:
@@ -55,6 +60,10 @@ jobs:
           context: .github/docker
           file: .github/docker/Dockerfile.ci
           push: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+          # Registry layer cache: reads are safe everywhere; the export is gated
+          # to same-repo runs because a fork PR's token can't write GHCR.
+          cache-from: type=registry,ref=${{ env.IMAGE }}:buildcache
+          cache-to: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && format('type=registry,ref={0}:buildcache,mode=max', env.IMAGE) || '' }}
           tags: |
             ${{ steps.meta.outputs.tag }}
             ${{ env.IMAGE }}:latest
@@ -142,7 +151,7 @@ jobs:
       # vastly cheaper than rerunning `bun install` (network + resolution).
       - name: Restore deps
         run: |
-          if [ -d /opt/node_modules_cache ] && diff -q /opt/node_modules_cache/.package.json package.json >/dev/null 2>&1; then
+          if [ -d /opt/node_modules_cache ] && diff -q /opt/node_modules_cache/.bun.lock bun.lock >/dev/null 2>&1; then
             cp -r /opt/node_modules_cache node_modules
           else
             bun install