Repository navigation
ci: bypass layer cache on non-commit rebuilds - #25
Conversation
Scheduled, dispatched and manual rebuilds reused the cached dnf install layer and shipped no errata. Push and PR builds keep the cache. Per constitution 9b6fa10 (container image profile 1.4.0). Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01QgDmtt1RqsYSj7ykDFfZC4
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| cache-from: type=gha | ||
| cache-to: type=gha,mode=max | ||
| # Non-commit rebuilds exist to pick up errata; a cached dnf layer ships none. | ||
| no-cache: ${{ github.event_name != 'push' && github.event_name != 'pull_request' }} |
There was a problem hiding this comment.
MEDIUM (Performance Check): Every non-push/non-pull-request build disables the build cache for the entire image. Scheduled or manually dispatched rebuilds therefore repeat work in unrelated layers, increasing build time and resource use even though the stated goal is to refresh the DNF layer.
Suggestion: Invalidate or rebuild only the package-install portion needed to pick up errata, while retaining cached results for unaffected layers.
Evidence:
no-cache: ${{ github.event_name != 'push' && github.event_name != 'pull_request' }}
There was a problem hiding this comment.
Not a bug: full rebuilds only on weekly cron and parent dispatch, about 3 minutes each; per-layer busting would need an ARG in every Containerfile for no real saving.
| - Workflows MUST include weekly cron trigger for base image security updates | ||
| - Build caching is MANDATORY: `cache-from: type=gha` / `cache-to: type=gha,mode=max` | ||
| - Never use `no-cache: true` in CI workflows | ||
| - Set `no-cache` only on non-commit builds (`schedule`, `repository_dispatch`, `workflow_dispatch`); never on `push` or `pull_request` builds |
There was a problem hiding this comment.
HIGH (Constitution): This changes the CI rule to permit no-cache on non-commit builds, contradicting the in-force requirement to never use no-cache: true in CI workflows. This file is not one of the specified constitution amendment files.
Suggestion: Keep the prohibition on no-cache: true in CI workflows, or amend the constitution through an authorized constitution file.
Evidence:
- Set `no-cache` only on non-commit builds (`schedule`, `repository_dispatch`, `workflow_dispatch`); never on `push` or `pull_request` builds
There was a problem hiding this comment.
Not a bug: constitution #68 (9b6fa10) and #69 now require no-cache on non-commit builds; the quoted rule is the old text this PR replaces.
| cache-from: type=gha | ||
| cache-to: type=gha,mode=max | ||
| # Non-commit rebuilds exist to pick up errata; a cached dnf layer ships none. | ||
| no-cache: ${{ github.event_name != 'push' && github.event_name != 'pull_request' }} |
There was a problem hiding this comment.
HIGH (Constitution): For scheduled, repository-dispatch, and workflow-dispatch runs, this expression sets no-cache to true, violating the in-force CI requirement to never use no-cache: true.
Suggestion: Remove the no-cache setting so all CI builds comply with the prohibition.
Evidence:
no-cache: ${{ github.event_name != 'push' && github.event_name != 'pull_request' }}
There was a problem hiding this comment.
Not a bug: constitution #68 (9b6fa10) and #69 now require no-cache on non-commit builds; the quoted rule is the old text this PR replaces.
Per constitution #68/#69. Scheduled, dispatched and manual rebuilds reused the cached
dnf installlayer and shipped no errata (ubi10-httpd-php shipped php 8.3.33 on 2026-10-22 after 8.3.36 hit UBI). Push/PR builds keep the cache.🤖 Generated with Claude Code
https://claude.ai/code/session_01QgDmtt1RqsYSj7ykDFfZC4