Skip to content

fix(ci): scope build cache to branch to prevent stale COPY layers

Jérôme Revillard requested to merge worktree-fix-promote-scan-report into main

Problem

Docker buildx registry cache with a single shared cache tag caused stale COPY overlay layers to be served across branches. Changed file content was ignored — COPY instruction showed CACHED in build logs. This prevented ChatQnA fix from reaching the deployed image despite 3 rebuilds.

Fix

# Before
CACHE_REF="$CI_REGISTRY_IMAGE/tmp/$IMAGE_NAME:cache"  # shared, polluted

# After  
CACHE_REF="$CI_REGISTRY_IMAGE/tmp/$IMAGE_NAME:cache-${CI_COMMIT_REF_SLUG}"  # branch-scoped
CACHE_REF_MAIN="$CI_REGISTRY_IMAGE/tmp/$IMAGE_NAME:cache-main"              # fallback
--cache-from type=registry,ref=$CACHE_REF       # primary (branch)
--cache-from type=registry,ref=$CACHE_REF_MAIN   # fallback (main)
--cache-to type=registry,ref=$CACHE_REF,mode=max # export to branch only
  • Branch cache: no cross-contamination
  • Main fallback: avoids cold start on new branches
  • Cache-to writes branch cache only (main never polluted)

Merge request reports