Use BoringCache for image builds

[gauravtiwari]

Summary

• incorporates the target-by-target Docker Bake cache and publish structure from Build cache discourse/discourse_docker#1088
• uses boringcache/one v1.19.1 for the managed BuildKit builder and Docker layer cache
• wraps the existing Bake targets with BoringCache mount cache and ccache support
• preserves the GHCR registry-cache path as the disabled fallback
• caches the complete Bundler installation and the explicit pnpm store, while still running normal install and verification
• stages the released ccache 4.13.6 binary for native AMD64 and ARM64 builds

This branch starts from current upstream main, including the Mozilla signing-key fix.

Product validation

The clean image-only run completed successfully on both native architectures:

• AMD64: 22m34s
• ARM64: 22m43s
• all dependency, slim, web-only, release, and test image targets passed
• specs were skipped through the fork's SKIP_TESTS=1 repository variable; the workflow still runs them by default when that variable is unset

https://github.com/boringcache/discourse_docker/actions/runs/31793667346

This was an intentionally cold, restore-only pull-request run. It proves the wiring rather than a warm speedup:

• BoringCache identified ccache as an active tool and recorded thousands of real compiler-cache lookups, with zero cache or adapter errors
• ccache reported Remote storage inside the Docker build on both architectures
• Bundler and pnpm cache mounts emitted BoringCache hydrate operations for their exact BuildKit mount IDs
• cold Bundler mounts started at 4 KiB and populated the complete 1.1 GiB bundle
• cold pnpm mounts started at 4 KiB and populated approximately 758–775 MiB
• zero hits are expected because no trusted run has published these cache targets yet

A trusted main or scheduled run must seed the Docker, ccache, and mount caches before a following rolling run can measure warm reuse.

Full-suite validation

An earlier clean product run built the same AMD64 and ARM64 image pipelines and ran the complete Discourse suite:

• AMD64: 45,883 examples, 0 failures, 13 pending
• ARM64: 45,883 examples; one i18n integrity flake passed the workflow's automatic retry, 13 pending

https://github.com/boringcache/discourse_docker/actions/runs/31786679565

Static checks

• workflow YAML parses successfully
• git diff --check passes
• actionlint reports no workflow-structure errors; its remaining findings are pre-existing upstream shellcheck notices
• product and GHCR-fallback Bake graphs resolve with docker buildx bake --print

[gauravtiwari]

Trusted cold → warm benchmark

The integration has now been measured on the same main commit (2e796724) with native GitHub runners, specs skipped, and Docker Hub publishing disabled.

Architecture	Trusted seed	Warm restore	Time saved
AMD64	22m00s	5m54s	16m06s (73%)
ARM64	22m19s	7m54s	14m25s (65%)

Seed: https://github.com/boringcache/discourse_docker/actions/runs/31796197395
Warm: https://github.com/boringcache/discourse_docker/actions/runs/31797852927

The cache mechanisms were verified independently:

• Docker: the warm builds imported the architecture- and target-specific BoringCache manifests. A representative test-image trace had 67 of 80 BuildKit steps cached and restored about 1.52 GB; its largest remaining cost was a 1m32s export to Docker image format.
• ccache: compilation ran during the trusted seed. When the slim build repeated the native work, AMD64 reported 71/71, 366/366, and 389/389 remote hits; ARM64 reported 269/269, 363/363, and 389/389. On the identical warm run, Docker layers correctly prevented compilation from running again.
• mount cache: the seeded AMD64 Bundler archive is storage-verified at 425 MB compressed with 41,296 files. ARM64 then logged explicit warm hits for both the test Bundler mount (7.0s hydrate) and pnpm mount (6.1s hydrate). AMD64 did not need mount hydration because the relevant Docker layers were already reusable.

The benchmark runs intentionally skipped specs. Full image/spec validation remains recorded in run 31786679565 (45,883 examples on each architecture).