Merge pull request #5 from RoopsyDaisy/claude/a4-buildx-cache

A4: opt-in buildx GHA layer cache for CI builds

Author: RoopsyDaisy

.github/workflows/ci.yaml

@@ -37,9 +37,15 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: recursive  # vendor/fvs (+NVEL), fvs-build, fvs-interface
+      # buildx + the GHA cache backend (CACHE=gha) so unchanged layers (the FVS
+      # compile, renv restore) are reused across PR/branch runs. publish.yaml
+      # deliberately omits this -- release builds miss the cache for
+      # reproducibility (docs/UPSTREAM_REVIEW.md A4).
+      - uses: docker/setup-buildx-action@v3
       - name: Build + smoke test
         run: bash scripts/build_images.sh
         env:
           ENGINE: docker
           FVS_VARIANT: ie
           FVS_BASE: source
+          CACHE: gha

scripts/build_images.sh

@@ -51,16 +51,35 @@ img_for() {
   esac
 }
 
+# Layer caching (opt-in via CACHE; default off so local/podman builds are
+# unchanged). CACHE=gha uses buildx + the GitHub Actions cache backend, which is
+# why ci.yaml sets it but publish.yaml does NOT -- release builds intentionally
+# miss the cache for reproducibility (see docs/UPSTREAM_REVIEW.md A4). Cache is
+# scoped per target so webgui and cluster don't evict each other. buildx needs
+# --load to put the image in the local store for the smoke/test `docker run`.
+CACHE="${CACHE:-}"
+
 for t in $TARGETS; do
   tag="$(img_for "$t")"
-  echo ">>> build target=$t -> $tag  (FVS_VARIANT=$FVS_VARIANT FVS_BASE=$FVS_BASE)"
-  "$ENGINE" build -f docker/Dockerfile --target "$t" \
-    --build-arg "FVS_VARIANT=${FVS_VARIANT}" \
-    --build-arg "FVS_BASE=${FVS_BASE}" \
-    --build-arg "VCS_REF=${VCS_REF}" \
-    --build-arg "FVS_SOURCE_REF=${FVS_SOURCE_REF}" \
-    --build-arg "BUILD_DATE=${BUILD_DATE}" \
-    -t "$tag" .
+  echo ">>> build target=$t -> $tag  (FVS_VARIANT=$FVS_VARIANT FVS_BASE=$FVS_BASE CACHE=${CACHE:-off})"
+  common_args=(
+    -f docker/Dockerfile --target "$t"
+    --build-arg "FVS_VARIANT=${FVS_VARIANT}"
+    --build-arg "FVS_BASE=${FVS_BASE}"
+    --build-arg "VCS_REF=${VCS_REF}"
+    --build-arg "FVS_SOURCE_REF=${FVS_SOURCE_REF}"
+    --build-arg "BUILD_DATE=${BUILD_DATE}"
+    -t "$tag"
+  )
+  if [ "$CACHE" = "gha" ]; then
+    scope="${FVS_VARIANT}-${FVS_BASE}-${t}"
+    "$ENGINE" buildx build "${common_args[@]}" \
+      --cache-from "type=gha,scope=${scope}" \
+      --cache-to "type=gha,mode=max,scope=${scope}" \
+      --load .
+  else
+    "$ENGINE" build "${common_args[@]}" .
+  fi
 done
 
 # Smoke test inside each built image. smoke_test.R is baked into the image (at