cancel-redundant-workflows.yml had some overhead as it was spawning an extra
workflow_run job per workflow. With concurrency groups, a new push cancels the
PR's previous run directly.
A cancelled step can leave its docker container running against the shared
sstate. Label containers with the runner name and remove them in the cleanup
step. Rename docker-prune-images to docker-cleanup accordingly.
Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
We were rebuilding Docker images from scratch with --no-cache, tagged by PR
number. With this, we were building multiple images per PR for the same
context.
This change tags the images by the git tree hash of the build context and only
build if the tag is missing. This naturally covers rebuilding on build context
changes.
Finally, this change handles refreshing images every 7 days (for example to
refresh OS packages) and prune by CI label after 14 days. The gap ensures an
image a running job just picked up isn't pruned under it.
Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
Drop the dependency on tj-actions/changed-files and replace it with a local
composite action. Especially given it was compromised in the past - see
CVE-2025-30066.
The action diffs HEAD^1..HEAD of the PR merge commit that actions/checkout
checks out by default. It fails if HEAD is not a merge commit, so a change to
the checkout ref can't silently diff the wrong range.
With this in place, both of the workflows can share a consistent list of paths.
Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
It provides support for building a locally defined image. It also
includes a retry logic to handle eventual concurrent cleanups on the
runner.
Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
Andrei Gherzan
Martin Jansa
Zygmunt Krynicki
Andrei Gherzan