ci: inject cache tarballs instead of directory trees

.github/workflows/cacheci.yml

@@ -1,92 +0,0 @@
-name: cacheci
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  actions: write
-
-# Cancelling mid-rotation is safe: the sequential delete-then-save order
-# leaves at most one key missing at any moment.
-concurrency:
-  group: cacheci
-  cancel-in-progress: true
-
-jobs:
-  tests:
-    runs-on: ubuntu-latest
-    steps:
-      - name: checkout
-        uses: actions/checkout@v4
-      - name: restore
-        id: restore
-        uses: actions/cache/restore@v4
-        with:
-          path: ${{ runner.temp }}/cacheci
-          key: tests-primary
-          restore-keys: |
-            tests-secondary
-      - name: inject
-        if: steps.restore.outputs.cache-matched-key != ''
-        run: |
-          cat > "$RUNNER_TEMP/inject.Dockerfile" <<'EOF'
-          FROM busybox:1.37
-          RUN --mount=type=cache,target=/root/.cache/go-build \
-              --mount=type=cache,target=/go/pkg/mod \
-              --mount=type=cache,target=/pnpm/store \
-              --mount=type=bind,target=/restored \
-              tar -xf /restored/go-build.tar -C /root/.cache/go-build && \
-              tar -xf /restored/go-mod.tar -C /go/pkg/mod && \
-              tar -xf /restored/pnpm-store.tar -C /pnpm/store
-          EOF
-          docker build -f "$RUNNER_TEMP/inject.Dockerfile" "$RUNNER_TEMP/cacheci"
-      - name: build
-        run: |
-          docker build -f cmd/enterprise/Dockerfile.integration --build-arg TARGETARCH=amd64 --build-arg ZEUSURL=http://zeus:8080 .
-          docker build -f cmd/enterprise/Dockerfile.with-web.integration --build-arg TARGETARCH=amd64 --build-arg ZEUSURL=http://zeus:8080 .
-      # docker cp instead of --output type=local (the local exporter stalls on
-      # multi-GB outputs); tarballs instead of raw trees so the host never hits
-      # the permission and symlink semantics that broke docker cp.
-      - name: extract
-        run: |
-          rm -rf "$RUNNER_TEMP/cacheci"
-          mkdir -p "$RUNNER_TEMP/cacheci" "$RUNNER_TEMP/extract-context"
-          cat > "$RUNNER_TEMP/extract.Dockerfile" <<'EOF'
-          FROM busybox:1.37
-          RUN --mount=type=cache,target=/root/.cache/go-build \
-              --mount=type=cache,target=/go/pkg/mod \
-              --mount=type=cache,target=/pnpm/store \
-              mkdir -p /out && \
-              tar -cf /out/go-build.tar -C /root/.cache/go-build . && \
-              tar -cf /out/go-mod.tar -C /go/pkg/mod . && \
-              tar -cf /out/pnpm-store.tar -C /pnpm/store .
-          EOF
-          docker build -f "$RUNNER_TEMP/extract.Dockerfile" -t cacheci-extract "$RUNNER_TEMP/extract-context"
-          id=$(docker create cacheci-extract)
-          docker cp "$id":/out/. "$RUNNER_TEMP/cacheci/"
-          docker rm "$id"
-      # Fixed cache keys are immutable, so each key must be deleted before it
-      # can be saved again. Rotating primary and secondary one after the other
-      # keeps at least one key restorable for concurrent test runs.
-      - name: delete-primary
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh cache delete tests-primary --repo "$GITHUB_REPOSITORY" || true
-      - name: save-primary
-        uses: actions/cache/save@v4
-        with:
-          path: ${{ runner.temp }}/cacheci
-          key: tests-primary
-      - name: delete-secondary
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh cache delete tests-secondary --repo "$GITHUB_REPOSITORY" || true
-      - name: save-secondary
-        uses: actions/cache/save@v4
-        with:
-          path: ${{ runner.temp }}/cacheci
-          key: tests-secondary

.github/workflows/e2eci.yaml

@@ -75,6 +75,30 @@ jobs:
           docker rm pw
           echo "PLAYWRIGHT_BROWSERS_PATH=$RUNNER_TEMP/ms-playwright" >> "$GITHUB_ENV"
           cd tests/e2e && pnpm playwright install-deps ${{ matrix.project }}
+      # Restore-only: the cacheci workflow owns cache saves. Seeds the
+      # BuildKit cache mounts so the in-test image build is incremental.
+      - name: restore
+        id: restore
+        uses: actions/cache/restore@v4
+        with:
+          path: ${{ runner.temp }}/cacheci
+          key: tests-primary
+          restore-keys: |
+            tests-secondary
+      - name: inject
+        if: steps.restore.outputs.cache-matched-key != ''
+        run: |
+          cat > "$RUNNER_TEMP/inject.Dockerfile" <<'EOF'
+          FROM busybox:1.37
+          RUN --mount=type=cache,target=/root/.cache/go-build \
+              --mount=type=cache,target=/go/pkg/mod \
+              --mount=type=cache,target=/pnpm/store \
+              --mount=type=bind,target=/restored \
+              tar -xf /restored/go-build.tar -C /root/.cache/go-build && \
+              tar -xf /restored/go-mod.tar -C /go/pkg/mod && \
+              tar -xf /restored/pnpm-store.tar -C /pnpm/store
+          EOF
+          docker build -f "$RUNNER_TEMP/inject.Dockerfile" "$RUNNER_TEMP/cacheci"
       - name: bring-up-stack
         run: |
           cd tests && \

.github/workflows/integrationci.yaml

@@ -110,6 +110,30 @@ jobs:
           sudo mv chromedriver-linux64/chromedriver /usr/local/bin/chromedriver
           chromedriver -version
           google-chrome-stable --version
+      # Restore-only: the cacheci workflow owns cache saves. Seeds the
+      # BuildKit cache mounts so the in-test image build is incremental.
+      - name: restore
+        id: restore
+        uses: actions/cache/restore@v4
+        with:
+          path: ${{ runner.temp }}/cacheci
+          key: tests-primary
+          restore-keys: |
+            tests-secondary
+      - name: inject
+        if: steps.restore.outputs.cache-matched-key != ''
+        run: |
+          cat > "$RUNNER_TEMP/inject.Dockerfile" <<'EOF'
+          FROM busybox:1.37
+          RUN --mount=type=cache,target=/root/.cache/go-build \
+              --mount=type=cache,target=/go/pkg/mod \
+              --mount=type=cache,target=/pnpm/store \
+              --mount=type=bind,target=/restored \
+              tar -xf /restored/go-build.tar -C /root/.cache/go-build && \
+              tar -xf /restored/go-mod.tar -C /go/pkg/mod && \
+              tar -xf /restored/pnpm-store.tar -C /pnpm/store
+          EOF
+          docker build -f "$RUNNER_TEMP/inject.Dockerfile" "$RUNNER_TEMP/cacheci"
       - name: run
         run: |
           cd tests && \