ci: isolate repository Docker caches from pull requests

[mfethe1]

Summary

Same-repository PR builds in mfethe1/buzz attempted to export BuildKit caches into ghcr.io/block/* even though image publication was disabled. Three inspected jobs in Docker run 34140327403 compiled their release binaries, then failed during registry cache export with permission_denied.

Resolve relay and public push gateway cache names from the lowercase current repository, independently of GHCR_IMAGE. Skip registry login and cache export on every PR. Cache export requires a protected ref and a push or workflow_dispatch event. PR image builds still run, and build failures remain failures.

Add a production-workflow contract test to the CI changes job and local checks. It executes the actual cache-resolution shell and evaluates the actual workflow expressions with GitHub's expression library.

Related issue

No duplicate cache-fix PR or issue found. The failure was observed on PR #18; its Docker workflow and Dockerfiles were unchanged from its base.

Testing

Evidence is bound to base adeec6eb5c4ff425aa03d8a744a295da4429f67f and head cac8ad256548125471bf103efea687b2d813952b.

• just docker-cache-check: 6 tests passed, covering 60 event/protection/head-repository cases plus cache ownership for three repository names and both architectures.
• Six deliberate mutations were rejected: upstream cache ownership, PR cache writes, unprotected cache writes, image override controlling cache import, ignored cache export errors, and PR registry login. Restored tests passed.
• Actionlint, Biome, relay-image eligibility and required-context isolation contracts passed. Independent review of the complete six-file diff was clean.
• Full just ci after the documented dependency setup: exit 1 at the final mobile test stage, with 2,241 passed and eight baseline golden failures. Desktop JavaScript tests passed 6,583/6,583 and the preceding recipe stages completed. All eight rendered mobile PNGs are byte-identical to the saved exact-base Airy outputs; expected images are unchanged.
• Hosted Docker run 34146214188 passed all four build jobs and six image builds on merge 517c2d03684307a5c288c5cfd334cb4ea00a3867, whose parents are the exact base and head above. All four registry logins and all publication jobs were skipped. Actual build commands used mfethe1 cache refs, no cache-export argument, and push=false.
• All six anonymous cache imports returned HTTP 403; the builds succeeded without remote cache reuse. Useful cache hits and protected-ref cache exports remain unqualified. No registry credentials or writes were used by the local contract tests.

Limits

This remains a draft because full CI is red and required merge gates are incomplete. The existing image qualification and publication paths are unchanged. Fork image publication still needs separate qualification: the relay defaults to ghcr.io/block/buzz unless GHCR_IMAGE is configured, and the gateway publication destination remains ghcr.io/block/buzz-push-gateway.

Existing build-job token permissions are also unchanged. This patch limits registry login and cache export; it does not claim to remove all ambient package or OIDC permissions. No images have been published or deployed as part of this fix.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 8eda1708-aa3f-4015-a96f-f9293f5e2da2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mfethe1]

minio image fix: Docker Hub → quay.io (digest-pinned)

Problem: Docker Hub pulls of minio/minio and minio/mc are denied for all PR CI in this fork, so every job running docker compose up -d postgres redis minio minio-init (in _ci-relay.yml ×2 and mesh-lifecycle.yml) fails on the image pull. Upstream also stopped publishing free Docker Hub images on 2025-10-23.

Investigation: ghcr.io/minio/* does not exist as a public mirror (manifest lookup fails). The upstream releases ARE published on quay.io under the same tags.

Fix (commit 8f4b8524): in docker-compose.yml (the file CI actually composes up) and docker-compose.harness.yml:

• minio/minio:latest → quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z@sha256:9966a92a734f9411e32f4f41d7d9d826fcdc0f68c4e20b70295bd4e7c11f8a2f
• minio/mc:latest → quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z@sha256:37d109dddbbb2c95873f5fc81ac93f37023264770fc580a7564148892087b1b7

Tags intentionally match the pins already in deploy/compose/compose.yml; deploy/ itself is untouched (internal registry deploys, not CI). Moving from latest to digest pins is also a supply-chain win.

Verification: both digests resolve on quay.io (docker manifest inspect), the mc image pulls locally by digest, and both compose files pass docker-compose config. Workflow files themselves only reference the compose services, not image names — no .github/workflows/ edits were needed. The docker-cache-isolation part of this PR is unchanged. CI on this branch is the real end-to-end proof; next run should get past docker compose up.

[mfethe1]

Follow-up: merged product/main into the branch. Trunk #47 (d425838f0) had already landed a chainguard digest-pinned minio fix with an adapted healthcheck — better vetted than my quay.io experiment. Compose conflicts resolved in favor of trunk's fix; this branch's docker-cache isolation is unchanged. No merge performed.

[mfethe1]

Fixed the cargo-deny RUSTSEC-2026-0285 failure (rustls 0.23.42, TLS 1.3 handshake messages accepted across encryption level boundaries).

Fix: bumped the lockfile to rustls 0.23.45 (the advisory's patched version, released on crates.io today) via cargo update -p rustls --precise 0.23.45:

Updating aws-lc-rs v1.17.0 -> v1.18.1
Updating aws-lc-sys v0.41.0 -> v0.45.0
Updating rustls v0.23.42 -> v0.23.45
Updating rustls-webpki v0.103.13 -> v0.103.15

Lockfile-only change (10 insertions, 9 deletions; Cargo.lock verified to pin rustls 0.23.45). No deny.toml ignore entry needed. Commit: 484cd2cc0