mirror of
https://github.com/garrytan/gstack.git
synced 2026-08-21 13:37:14 +02:00
Garry TanandClaude Fable 5
6e20913f66
Three coupled fixes, atomic because any subset is worse than none: 1. Image tag keys on hashFiles(Dockerfile.ci, bun.lock) — package.json is out: its version field changed on 60/60 recent commits, forcing a ~2min image rebuild per PR for a dependency set only bun.lock determines. 2. ci-image.yml now pushes that same content-hash tag (previously only :latest/:sha, so the weekly prebuild never warmed the tag the eval matrix actually looks up) and both eval workflows get registry layer cache (cache-to export gated to same-repo runs; fork tokens cannot write GHCR). 3. Dockerfile bakes /opt/node_modules_cache/.bun.lock and the runtime Restore-deps guard diffs bun.lock instead of package.json — otherwise every version-only bump made all 14 matrix jobs fall back to a live bun install, which is slower than today's behavior. Worst-case failure mode is self-healing: a missing tag or cache falls back to exactly the previous rebuild-and-install path. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
51 lines
1.6 KiB
YAML
51 lines
1.6 KiB
YAML
name: Build CI Image
|
|
on:
|
|
# Rebuild weekly (Monday 6am UTC) to pick up CLI updates
|
|
schedule:
|
|
- cron: '0 6 * * 1'
|
|
# Rebuild on Dockerfile or lockfile changes
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- '.github/docker/Dockerfile.ci'
|
|
- 'package.json'
|
|
- 'bun.lock'
|
|
# Manual trigger
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubicloud-standard-8
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Copy lockfile + package.json into Docker build context
|
|
- run: cp package.json bun.lock .github/docker/
|
|
|
|
# Same content-hash tag expression as evals.yml / evals-periodic.yml.
|
|
# This is the tag the eval matrix looks up first — without pushing it
|
|
# here, the weekly/main prebuild never warms the cache that matters.
|
|
- id: meta
|
|
run: echo "tag=ghcr.io/${{ github.repository }}/ci:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock') }}" >> "$GITHUB_OUTPUT"
|
|
|
|
- uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- uses: docker/build-push-action@v6
|
|
with:
|
|
context: .github/docker
|
|
file: .github/docker/Dockerfile.ci
|
|
push: true
|
|
cache-from: type=registry,ref=ghcr.io/${{ github.repository }}/ci:buildcache
|
|
cache-to: type=registry,ref=ghcr.io/${{ github.repository }}/ci:buildcache,mode=max
|
|
tags: |
|
|
${{ steps.meta.outputs.tag }}
|
|
ghcr.io/${{ github.repository }}/ci:latest
|
|
ghcr.io/${{ github.repository }}/ci:${{ github.sha }}
|