perf(build-check): replace login-action + setup-buildx-action with the CLI #84
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "perf/build-check-cli"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The build step in
build-checkalready drivesdocker buildx builddirectly. Only the two setup steps were actions — and act charges the full git history of an action repository on every job:docker/login-action@v3docker logindocker/setup-buildx-action@v4docker buildx createMeasured on run 224. Behaviour is unchanged, including the conditional skip when
HARBOR_ROBOT_TOKENis absent and the buildkit image pinned to the Harbor proxy (run 125's flake).Two things the actions were doing that are now explicit
The builder gets a unique name per job. buildx keeps its builder registry in the client's
~/.docker/buildx— empty in a fresh pod — while the buildkit container lives on the shared per-node dind daemon and outlives it. A fixed name collides with a container the client has no record of. This is whysetup-buildx-actiongenerated a UUID name too.The builder is now removed afterwards.
setup-buildx-actiondid that in a post-step. Nothing here did, so every build-check job so far has left a buildkit container running on its node.What's left
actions/checkoutis the only third-party action remaining in this workflow. That one needs the mini-mirror work, not a rewrite.⚠️ This PR does not exercise its own change
build-checkonly runs when a file underops/docker/changes, and this PR touches only.forgejo/. The ci-runner PR that follows will be the first to run it — merge this one first so that PR'sbuild-checkbecomes the test.Companion to workflows #42, which does the same to the shared fast composite.
4d0aea05074f1f130ffc4f1f130ffcbb22a82c4aCorrection: I claimed above that the old path left buildkit containers on the node. That is wrong. act DOES run action post-steps; they are folded into 'Complete job' rather than shown as their own step, which is why I missed them. Run 226 ends with 'Post Set up Docker Buildx' calling docker buildx rm, and 'Post Log in to Harbor' calling docker logout. So the cleanup step is not new work, it is the cleanup that already existed made visible. My replacement was also missing the docker logout, which is a real behaviour regression I introduced; it is restored now. Nothing was leaking before this PR.
bb22a82c4aaed71dfdf1Rebased onto current main (picks up the #83 seccomp fix) and extended: the builder now prefers forgejo-buildkitd - the shared per-node daemon, confirmed live at 3/3 Ready with workers responding - and falls back to a throwaway docker-container builder when it does not answer. A throwaway builder's LOCAL cache dies with it, so build-check has always been locally cache-cold and leaning entirely on cache-from type=registry, a network round-trip per layer for what should be a disk read. That matters most in this job because it runs more often than any other. Teardown now runs only on the docker-container path, since the remote driver creates nothing remotely - that is the objection about having to remove the builder, answered. Verified before switching: no Dockerfile in ops/docker uses RUN --security=insecure or --network=host, so dropping the entitlement flags on the remote path changes nothing today, and if one ever does it fails loudly rather than silently building something different.