builder-cache.yml

# Publishes the dependency-heavy `builder` stage to GHCR whenever the
# dependency set changes. Local developers then run `make warm-cache` to
# prime their docker build cache and skip the ~30-minute cold vcpkg build.
name: builder-cache

on:
  push:
    branches: [master]
    paths:
      - vcpkg.json
      - docker/Dockerfile
  workflow_dispatch:

permissions:
  contents: read
  packages: write

jobs:
  publish-builder-cache:
    runs-on: ubuntu-latest
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3.12.0

      - name: Expose Actions cache env for sccache
        # Same credential pass-through as ci.yml: the compile inside the
        # builder stage goes through sccache when these secrets are present.
        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0

      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push builder stage with inline cache
        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25  # v5.4.0
        with:
          context: .
          file: docker/Dockerfile
          target: builder
          push: true
          tags: ghcr.io/${{ github.repository }}/builder:cache
          build-args: |
            BUILDKIT_INLINE_CACHE=1
          secrets: |
            actions_results_url=${{ env.ACTIONS_RESULTS_URL }}
            actions_runtime_token=${{ env.ACTIONS_RUNTIME_TOKEN }}
          cache-from: type=registry,ref=ghcr.io/${{ github.repository }}/builder:cache
          cache-to: type=inline