gstack/.github/workflows/ci-image.yml

name: Build CI Image
on:
  # Rebuild weekly (Monday 6am UTC) to pick up CLI updates
  schedule:
    - cron: '0 6 * * 1'
  # Rebuild on Dockerfile or lockfile changes
  push:
    branches: [main]
    paths:
      - '.github/docker/Dockerfile.ci'
      - 'package.json'
      - 'bun.lock'
  # Manual trigger
  workflow_dispatch:

jobs:
  build:
    runs-on: ubicloud-standard-8
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v7

      # Copy lockfile + package.json into Docker build context
      - run: cp package.json bun.lock .github/docker/

      # Same content-hash tag expression as evals.yml / evals-periodic.yml.
      # This is the tag the eval matrix looks up first — without pushing it
      # here, the weekly/main prebuild never warms the cache that matters.
      - id: meta
        run: echo "tag=ghcr.io/${{ github.repository }}/ci:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock') }}" >> "$GITHUB_OUTPUT"

      - uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Registry cache export needs a docker-container builder — the default
      # `docker` driver hard-errors on cache-to.
      - uses: docker/setup-buildx-action@v4

      - uses: docker/build-push-action@v7
        with:
          context: .github/docker
          file: .github/docker/Dockerfile.ci
          push: true
          cache-from: type=registry,ref=ghcr.io/${{ github.repository }}/ci:buildcache
          cache-to: type=registry,ref=ghcr.io/${{ github.repository }}/ci:buildcache,mode=max
          tags: |
            ${{ steps.meta.outputs.tag }}
            ghcr.io/${{ github.repository }}/ci:latest
            ghcr.io/${{ github.repository }}/ci:${{ github.sha }}