From f1001bab2a5372d0ebd1b8bf8b566c13dbd84466 Mon Sep 17 00:00:00 2001 From: Yuval Levy Date: Mon, 20 Jul 2026 16:01:40 +0000 Subject: [PATCH] incluster-comp-pr-merged: use registry cache instead of GHA cache Alternative, simpler fix for 'error writing layer blob: failed to reserve cache' (seen e.g. on kubevuln's pr-merged run: https://github.com/kubescape/kubevuln/actions/runs/29737569926/job/88346893168). The failure is caused by GitHub issuing read-only Actions-cache tokens to pull_request_target-triggered runs that resolve to the default branch (policy change 2026-06-26, see https://github.blog/changelog/2026-06-26-read-only-actions-cache-for-untrusted-triggers/ and https://github.com/docker/build-push-action/issues/1571#issuecomment-4924969423). kubevuln's (and every other consumer's) pr-merged.yaml triggers on pull_request_target: types: [closed], so once a PR merges into main, cache-to: type=gha's first blob-write attempt fails with exactly "failed to reserve cache" -- independent of job/matrix structure. Switching cache-from/cache-to to type=registry avoids this mechanism entirely: cache layers become ordinary content-addressed OCI blobs pushed to Quay (already authenticated via the existing Login to Quay step) instead of going through GitHub's actions-cache API, so the trigger-trust restriction can't affect it. All 6 confirmed consumers of this reusable workflow (synchronizer, operator, prometheus-exporter, kubevuln, storage, http-request) build Go binaries with a "--platform=$BUILDPLATFORM" cross-compile pattern in their Dockerfiles and no RUN steps requiring target-arch execution, so this keeps the original single docker-build job, single multi-platform build-push-action call, and QEMU setup entirely unchanged -- only the cache backend changes. Also removes the now-unnecessary actions: write permission (added in a recent main commit specifically to support type=gha cache writes; no longer needed since this job doesn't touch GitHub's Actions Cache Service at all). Cache is stored under "${IMAGE_NAME}:buildcache" in Quay. Unlike GHA cache, it isn't subject to GitHub's 10GB/repo eviction -- worth monitoring Quay storage/retention for this tag over time. Co-Authored-By: Claude Sonnet 5 Signed-off-by: Yuval Levy --- .github/workflows/incluster-comp-pr-merged.yaml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/incluster-comp-pr-merged.yaml b/.github/workflows/incluster-comp-pr-merged.yaml index b8ee7e7..efd8671 100644 --- a/.github/workflows/incluster-comp-pr-merged.yaml +++ b/.github/workflows/incluster-comp-pr-merged.yaml @@ -124,7 +124,6 @@ jobs: IMAGE_TAG_PRERELEASE: ${{ steps.image-prerelease-tag.outputs.IMAGE_TAG_PRERELEASE }} TEST_NAMES: ${{ steps.export_tests_to_env.outputs.TEST_NAMES }} permissions: - actions: write id-token: write packages: write contents: read @@ -177,8 +176,8 @@ jobs: tags: ${{ inputs.IMAGE_NAME }}:${{ steps.image-prerelease-tag.outputs.IMAGE_TAG_PRERELEASE }} build-args: image_version=${{ inputs.IMAGE_TAG }} platforms: ${{ inputs.BUILD_PLATFORM }} - cache-from: type=gha - cache-to: type=gha,mode=max + cache-from: type=registry,ref=${{ inputs.IMAGE_NAME }}:buildcache + cache-to: type=registry,ref=${{ inputs.IMAGE_NAME }}:buildcache,mode=max push: true - name: Attest image provenance