Skip to content

ci: bypass layer cache on non-commit rebuilds #25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fatherlinux merged 1 commit into from
Oct 22, 2026
Merged

ci: bypass layer cache on non-commit rebuilds #25

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .gemini/styleguide.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
## CI
- Workflows MUST include weekly cron trigger for base image security updates
- Build caching is MANDATORY: `cache-from: type=gha` / `cache-to: type=gha,mode=max`
- Never use `no-cache: true` in CI workflows
- Set `no-cache` only on non-commit builds (`schedule`, `repository_dispatch`, `workflow_dispatch`); never on `push` or `pull_request` builds

@github-actions github-actions Bot Oct 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH (Constitution): This changes the CI rule to permit no-cache on non-commit builds, contradicting the in-force requirement to never use no-cache: true in CI workflows. This file is not one of the specified constitution amendment files.

Suggestion: Keep the prohibition on no-cache: true in CI workflows, or amend the constitution through an authorized constitution file.

Evidence:

- Set `no-cache` only on non-commit builds (`schedule`, `repository_dispatch`, `workflow_dispatch`); never on `push` or `pull_request` builds

@fatherlinux fatherlinux Oct 22, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a bug: constitution #68 (9b6fa10) and #69 now require no-cache on non-commit builds; the quoted rule is the old text this PR replaces.

- Dual-push (Quay + GHCR) uses two separate jobs, not steps

## Versioning
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,8 @@ jobs:
RHSM_ORG_ID=/tmp/RHSM_ORG_ID
cache-from: type=gha
cache-to: type=gha,mode=max
# Non-commit rebuilds exist to pick up errata; a cached dnf layer ships none.
no-cache: ${{ github.event_name != 'push' && github.event_name != 'pull_request' }}

@github-actions github-actions Bot Oct 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM (Performance Check): Every non-push/non-pull-request build disables the build cache for the entire image. Scheduled or manually dispatched rebuilds therefore repeat work in unrelated layers, increasing build time and resource use even though the stated goal is to refresh the DNF layer.

Suggestion: Invalidate or rebuild only the package-install portion needed to pick up errata, while retaining cached results for unaffected layers.

Evidence:

no-cache: ${{ github.event_name != 'push' && github.event_name != 'pull_request' }}

@fatherlinux fatherlinux Oct 22, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a bug: full rebuilds only on weekly cron and parent dispatch, about 3 minutes each; per-layer busting would need an ARG in every Containerfile for no real saving.

@github-actions github-actions Bot Oct 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH (Constitution): For scheduled, repository-dispatch, and workflow-dispatch runs, this expression sets no-cache to true, violating the in-force CI requirement to never use no-cache: true.

Suggestion: Remove the no-cache setting so all CI builds comply with the prohibition.

Evidence:

no-cache: ${{ github.event_name != 'push' && github.event_name != 'pull_request' }}

@fatherlinux fatherlinux Oct 22, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a bug: constitution #68 (9b6fa10) and #69 now require no-cache on non-commit builds; the quoted rule is the old text this PR replaces.


- name: Save image as tarball
run: docker save ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest -o /tmp/image.tar
Expand Down
Loading