From 221f27acca295eb56bb6254e132241253c1008f1 Mon Sep 17 00:00:00 2001
From: ThePhaseless <kukubaorch@gmail.com>
Date: Sun, 9 Aug 2026 21:17:13 +0200
Subject: [PATCH] fix(ci): hoist ARG VERSION to final stage to stop cache
 busting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Root cause of remaining cache misses: the base stage declared
ARG VERSION, and the build job passed VERSION=${{ github.sha }}.
Since VERSION changes every commit, every base/app layer cache key
changed with it — so layers rebuilt every run regardless of scope.

Additionally the test job passed no build-args while the build job
passed GITHUB_BUILD=true + VERSION, so test's cached base/app layers
had different keys from build's — cross-job reuse never hit either.

Fix:
- Dockerfile: move ARG VERSION / ENV VERSION from base to the final
  runtime stage (FROM app). VERSION is only read at runtime by
  src.consts via Pydantic settings; base/app layers don't use it.
  base/app now cache without per-commit VERSION variation.
- workflow: pass --build-arg GITHUB_BUILD=true in the test step so
  test and build share identical base/app cache keys (cross-job reuse).

VERSION is intentionally NOT passed to the test job: the test stage
(FROM app AS test) doesn't read VERSION, and omitting it keeps the
base/app cache keys identical between test and build.
---
 .github/workflows/docker-publish.yml |  2 ++
 Dockerfile                           | 10 ++++++----
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 8ad744f..7ef231d 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -69,6 +69,8 @@ jobs:
           pull: true
           cache-to: type=gha,mode=max,scope=amd64
           target: test
+          build-args: |
+            GITHUB_BUILD=true
 
   build:
     needs: test
diff --git a/Dockerfile b/Dockerfile
index 9b02061..500af3a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,12 +3,9 @@
 # cannot install firefox deps for (no libgtk-3 -> camoufox fails to launch).
 FROM ubuntu:24.04 AS base
 
-ARG GITHUB_BUILD=false \
-    VERSION
+ARG GITHUB_BUILD=false
 
 ENV GITHUB_BUILD=${GITHUB_BUILD}\
-    VERSION=${VERSION}\
-    DEBIAN_FRONTEND=noninteractive \
     PYTHONUNBUFFERED=1 \
     # prevents python creating .pyc files
     PYTHONDONTWRITEBYTECODE=1 \
@@ -57,6 +54,11 @@ RUN \
     uv run pytest --retries 3
 
 FROM app
+# VERSION is a runtime-only env var (read by src.consts via Pydantic settings).
+# Declared here, not in base, so base/app layer cache keys don't depend on the
+# per-commit SHA — that would bust the cache every run.
+ARG VERSION
+ENV VERSION=${VERSION}
 USER 1000
 EXPOSE $PORT
 HEALTHCHECK --interval=15m --timeout=30s --start-period=5s --retries=3 CMD curl "http://127.0.0.1:${PORT}/health"