From 5d55ebaf61faa618021ff5f542e1ad54488fb045 Mon Sep 17 00:00:00 2001 From: manavgup Date: Sun, 19 Jul 2026 13:35:54 -0400 Subject: [PATCH] fix(ci): stop amd64 builds clobbering the arm64 publish cache MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The multi-arch GHCR publish timed out at 30 minutes on two of the last three main builds, cancelling the run and skipping the deploy each time. Root cause: the amd64-only build job writes to the same weekly GHA cache scope on every PR and push, evicting the arm64 layers the publish job caches — so every publish rebuilt arm64 from scratch under QEMU (~30 min, exactly at the limit). Give the publish job its own prod-multiarch- cache scope: it still reads the shared amd64 scope for layer reuse, but its arm64 layers now survive between publishes. Bump the timeout to 45 min so the one cold build per week (or busy day) clears the limit instead of dying at 99%. Co-Authored-By: Claude Fable 5 --- .github/workflows/docker.yml | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index bbf4e588..f84bf994 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -251,7 +251,10 @@ jobs: name: publish prod image to GHCR needs: [build, scan] runs-on: ubuntu-latest - timeout-minutes: 30 + # 45 min: a cold arm64 build under QEMU takes ~30 min, which sat + # exactly at the old limit and cancelled two of three main builds + # (skipping their deploys). Warm-cache publishes are much faster. + timeout-minutes: 45 permissions: contents: read packages: write @@ -300,8 +303,16 @@ jobs: push: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha,scope=prod-${{ steps.cache-key.outputs.week }} - cache-to: type=gha,scope=prod-${{ steps.cache-key.outputs.week }},mode=max + # Dedicated multi-arch scope: the amd64-only `build` job writes + # to the plain weekly scope on every PR/push, clobbering arm64 + # layers cached there — which forced a full ~30min QEMU rebuild + # on every publish. Reading both scopes keeps amd64 layer reuse; + # writing only the multiarch scope preserves arm64 layers + # between publishes. + cache-from: | + type=gha,scope=prod-multiarch-${{ steps.cache-key.outputs.week }} + type=gha,scope=prod-${{ steps.cache-key.outputs.week }} + cache-to: type=gha,scope=prod-multiarch-${{ steps.cache-key.outputs.week }},mode=max # --------------------------------------------------------------- # Alert — auto-create an issue when the deploy pipeline breaks