From 89a70121354887f6a31d66ebaf0559c504d84eb1 Mon Sep 17 00:00:00 2001
From: JonnyTran <nhat.c.tran@gmail.com>
Date: Fri, 28 Aug 2026 17:34:43 -0700
Subject: [PATCH] ci(server): give the docker build a registry layer cache
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`cache-from`/`cache-to` were unset, so every CI build refetched the 231 MB lance
extension and re-ran both apt layers from scratch. None of the layer ordering in
the Dockerfile bought anything on CI.

Registry cache rather than `type=gha`: the image is ~1.9 GB, and `mode=max` on it
would churn through the 10 GB Actions cache quota. The cache tag follows
`SERVER_DOCKER_IMAGE`, so dev and release caches never mix — and neither do their
platform sets. `image-manifest=true,oci-mediatypes=true` is what Docker Hub will
accept for the cache manifest.

PR previews read the cache but do not write it: they push from divergent trees and
would only evict trunk's entries. The `latest` push rebuilds the same context, so
it reads the cache and does not re-export it.
---
 .../extralit-server.build-docker-images.yml       | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/extralit-server.build-docker-images.yml b/.github/workflows/extralit-server.build-docker-images.yml
index 3ce6a58e1..0d795dd3f 100644
--- a/.github/workflows/extralit-server.build-docker-images.yml
+++ b/.github/workflows/extralit-server.build-docker-images.yml
@@ -54,14 +54,16 @@ jobs:
           if [[ $IS_RELEASE == true ]]; then
             echo "PLATFORMS=linux/amd64,linux/arm64" >> $GITHUB_ENV
             echo "IMAGE_TAG=v$PACKAGE_VERSION" >> $GITHUB_ENV
-            echo "SERVER_DOCKER_IMAGE=extralit/extralit-server" >> $GITHUB_ENV
+            SERVER_IMAGE=extralit/extralit-server
+            echo "SERVER_DOCKER_IMAGE=$SERVER_IMAGE" >> $GITHUB_ENV
             echo "HF_SPACES_DOCKER_IMAGE=extralit/extralit-hf-space" >> $GITHUB_ENV
             echo "DOCKER_USERNAME=$DOCKER_USERNAME" >> $GITHUB_ENV
             echo "DOCKER_PASSWORD=$DOCKER_PASSWORD" >> $GITHUB_ENV
             echo "PUBLISH_LATEST=$PUBLISH_LATEST" >> $GITHUB_ENV
           else
             echo "PLATFORMS=linux/amd64" >> $GITHUB_ENV
-            echo "SERVER_DOCKER_IMAGE=extralitdev/extralit-server" >> $GITHUB_ENV
+            SERVER_IMAGE=extralitdev/extralit-server
+            echo "SERVER_DOCKER_IMAGE=$SERVER_IMAGE" >> $GITHUB_ENV
             echo "HF_SPACES_DOCKER_IMAGE=extralitdev/extralit-hf-space" >> $GITHUB_ENV
             echo "DOCKER_USERNAME=$DOCKER_USERNAME_DEV" >> $GITHUB_ENV
             echo "DOCKER_PASSWORD=$DOCKER_PASSWORD_DEV" >> $GITHUB_ENV
@@ -74,6 +76,12 @@ jobs:
               echo "PUBLISH_LATEST=true" >> $GITHUB_ENV
             fi
           fi
+          # Layer cache. Only the wheel differs between two builds of the same tree; the lance
+          # extension fetch and both apt layers do not. image-manifest is what Docker Hub accepts.
+          echo "CACHE_FROM=type=registry,ref=$SERVER_IMAGE:buildcache" >> $GITHUB_ENV
+          if [[ -z "$PR_NUMBER" ]]; then
+            echo "CACHE_TO=type=registry,ref=$SERVER_IMAGE:buildcache,mode=max,image-manifest=true,oci-mediatypes=true" >> $GITHUB_ENV
+          fi
         env:
           IS_RELEASE: ${{ inputs.is_release }}
           PUBLISH_LATEST: ${{ inputs.publish_latest }}
@@ -119,6 +127,8 @@ jobs:
           platforms: ${{ env.PLATFORMS }}
           tags: ${{ env.SERVER_DOCKER_IMAGE }}:${{ env.IMAGE_TAG }}
           labels: ${{ steps.meta.outputs.labels }}
+          cache-from: ${{ env.CACHE_FROM }}
+          cache-to: ${{ env.CACHE_TO }}
           push: true
 
       - name: Test CLI command in docker image
@@ -133,6 +143,7 @@ jobs:
           platforms: ${{ env.PLATFORMS }}
           tags: ${{ env.SERVER_DOCKER_IMAGE }}:latest
           labels: ${{ steps.meta.outputs.labels }}
+          cache-from: ${{ env.CACHE_FROM }}
           push: true
 
       # Cross-repo, so the token must be scoped past this repository explicitly: GITHUB_TOKEN