When BUILDKIT_ENDPOINT is set, the build happens on a remote BuildKit instance,
making several runner setup steps unnecessary:
- Rust toolchain installation (not needed for remote builds)
- QEMU setup (cross-platform emulation handled by BuildKit)
- All caching steps (Rust registry, cargo target, apt cache/lib)
- Cache injection step (BuildKit manages its own cache)
- Timelord timestamp caching (not needed with persistent build cache)
Also added output to git SHA and timestamp steps to show their values.
This should significantly reduce build time when using persistent BuildKit
by eliminating ~7 setup steps per matrix job.
Fork PRs now fail during Docker image build with 'tag is needed when
pushing to registry' because BUILTIN_REGISTRY_ENABLED evaluates to false
without proper credentials, leaving the images list empty. This appears
to be due to recent Forgejo permission changes affecting fork access to
repository secrets.
Add fallback to official registry when credentials unavailable, skip
registry login and push operations for forks, and make merge job
conditional since no digests exist without push. This allows forks to
test Docker builds whilst avoiding authentication failures.
Container failed to start when running as non-root (user 1000:1000) because
copied directories had restrictive 770 permissions, likely due to different
umask in persistent BuildKit. Non-root users couldn't access /usr/lib to
load required dynamic libraries.
Introduces prepper stage using Ubuntu to organize files into layered structure
with explicit 755 directory permissions before copying to scratch image.
Also fixes workflow syntax error and removes docker/** from paths-ignore to
ensure Docker changes trigger CI builds.
Allows us to use runners with persistent BuildKit containers for improved
caching and faster build times. Falls back to standard docker-container
driver when BUILDKIT_ENDPOINT environment variable is not set.
Also moves rustup installation to a seperate workflow and
enables caching.
The sccache action required a github.com api token, so we set
all that up too.