fix(ci): docker caching (#30894)

.github/workflows/test.yml

@@ -397,7 +397,6 @@ jobs:
     runs-on: ${{ matrix.runner }}
     permissions:
       contents: read
-      packages: write
     defaults:
       run:
         working-directory: ./e2e
@@ -441,33 +440,8 @@ jobs:
         run: pnpm install --frozen-lockfile
         if: ${{ !cancelled() }}
 
-      - name: Setup Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        if: ${{ github.event_name == 'push' && !github.event.pull_request.head.repo.fork }}
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Resolve build cache
-        id: cache
-        run: |
-          ref=ghcr.io/immich-app/immich-server-build-cache:e2e-main-${{ runner.arch }}
-          echo "ref=$ref" >> "$GITHUB_OUTPUT"
-          if docker buildx imagetools inspect "$ref" > /dev/null 2>&1; then
-            echo "from=type=registry,ref=$ref" >> "$GITHUB_OUTPUT"
-          else
-            echo "from=" >> "$GITHUB_OUTPUT"
-          fi
-
       - name: Start Docker Compose
         id: docker
-        env:
-          E2E_CACHE_FROM: ${{ steps.cache.outputs.from }}
-          E2E_CACHE_TO: ${{ github.event_name == 'push' && !github.event.pull_request.head.repo.fork && format('type=registry,ref={0},mode=max', steps.cache.outputs.ref) || '' }}
         run: docker compose up -d --build --renew-anon-volumes --force-recreate --remove-orphans --wait --wait-timeout 300
         if: ${{ !cancelled() }}
 
@@ -545,24 +519,8 @@ jobs:
         run: pnpm exec playwright install chromium --only-shell
         if: ${{ !cancelled() }}
 
-      - name: Setup Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-
-      - name: Resolve build cache
-        id: cache
-        run: |
-          ref=ghcr.io/immich-app/immich-server-build-cache:e2e-main-${{ runner.arch }}
-          echo "ref=$ref" >> "$GITHUB_OUTPUT"
-          if docker buildx imagetools inspect "$ref" > /dev/null 2>&1; then
-            echo "from=type=registry,ref=$ref" >> "$GITHUB_OUTPUT"
-          else
-            echo "from=" >> "$GITHUB_OUTPUT"
-          fi
-
       - name: Docker build
         id: docker
-        env:
-          E2E_CACHE_FROM: ${{ steps.cache.outputs.from }}
         run: docker compose up -d --build --renew-anon-volumes --force-recreate --remove-orphans --wait --wait-timeout 300
         if: ${{ !cancelled() }}
 

e2e/docker-compose.yml

@@ -16,9 +16,9 @@ services:
       context: ../
       dockerfile: server/Dockerfile
       cache_from:
-        - ${E2E_CACHE_FROM:-}
-      cache_to:
-        - ${E2E_CACHE_TO:-}
+        # hash is the sha256 of the build-args in docker.yml
+        - type=registry,ref=ghcr.io/immich-app/immich-server-build-cache:linux-amd64-cc099f297acd18c924b35ece3245215b53d106eb2518e3af6415931d055746cd-main
+        - type=registry,ref=ghcr.io/immich-app/immich-server-build-cache:linux-arm64-cc099f297acd18c924b35ece3245215b53d106eb2518e3af6415931d055746cd-main
       args:
         - BUILD_ID=1234567890
         - BUILD_IMAGE=e2e

packages/e2e-auth-server/Dockerfile

@@ -1,9 +1,15 @@
 FROM node:24.19.0-trixie-slim@sha256:0711b541c1c33a8a530ac4f0d391baa9a15b3d804695b1b24a47daa5fb60e74d
 WORKDIR /usr/src/app
-COPY package* pnpm* .pnpmfile.cjs ./
-COPY ./packages ./packages/
-WORKDIR /usr/src/app/packages/e2e-auth-server
+
 RUN corepack enable
+
+COPY package* pnpm* .pnpmfile.cjs ./
+COPY ./packages/e2e-auth-server/package.json ./packages/e2e-auth-server/
+
+WORKDIR /usr/src/app/packages/e2e-auth-server
 RUN pnpm install --frozen-lockfile
+
+COPY ./packages/e2e-auth-server ./
+
 EXPOSE 2286
 CMD ["pnpm", "run", "start"]

server/Dockerfile

@@ -13,38 +13,58 @@ WORKDIR /usr/src/app
 
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .pnpmfile.cjs ./
 
-FROM builder AS server
+FROM builder AS sdk
+
+COPY ./packages/sdk/package.json ./packages/sdk/package.json
+RUN --mount=type=cache,id=pnpm,target=/buildcache/pnpm-store pnpm --filter @immich/sdk install --frozen-lockfile
+
+COPY ./packages/sdk ./packages/sdk/
+RUN --mount=type=cache,id=pnpm,target=/buildcache/pnpm-store pnpm --filter @immich/sdk build
+
+FROM sdk AS plugin-sdk
+
+COPY ./packages/plugin-sdk/package.json ./packages/plugin-sdk/package.json
+RUN --mount=type=cache,id=pnpm,target=/buildcache/pnpm-store pnpm --filter @immich/plugin-sdk install --frozen-lockfile
+
+COPY ./packages/plugin-sdk ./packages/plugin-sdk/
+RUN --mount=type=cache,id=pnpm,target=/buildcache/pnpm-store pnpm --filter @immich/plugin-sdk build
+
+FROM plugin-sdk AS server
+
+COPY ./server/package.json ./server/package.json
+RUN --mount=type=cache,id=pnpm,target=/buildcache/pnpm-store pnpm --filter immich install --frozen-lockfile
 
 COPY ./server ./server/
-COPY ./packages/sdk ./packages/sdk/
-COPY ./packages/plugin-sdk ./packages/plugin-sdk/
-RUN --mount=type=cache,id=pnpm-server,target=/buildcache/pnpm-store \
-  pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter immich build && \
-  pnpm --filter immich --prod --no-optional deploy /output/server-pruned && \
+RUN --mount=type=cache,id=pnpm,target=/buildcache/pnpm-store \
+  pnpm --filter immich build && \
+  pnpm --filter immich --prod --no-optional deploy /output/server-pruned
+RUN --mount=type=cache,id=pnpm,target=/buildcache/pnpm-store \
   SHARP_FORCE_GLOBAL_LIBVIPS=true pnpm --dir /output/server-pruned/node_modules/sharp exec npm run build
 
-FROM builder AS web
+FROM sdk AS web
+
+COPY ./web/package.json ./web/package.json
+RUN --mount=type=cache,id=pnpm,target=/buildcache/pnpm-store pnpm --filter immich-web install --frozen-lockfile
+
+COPY ./i18n ./i18n/
+COPY ./web ./web/
 
 ARG BUILD_ID
 ENV IMMICH_BUILD=${BUILD_ID}
 
-COPY ./web ./web/
-COPY ./i18n ./i18n/
-COPY ./packages/sdk ./packages/sdk/
-RUN --mount=type=cache,id=pnpm-web,target=/buildcache/pnpm-store \
-  pnpm --filter @immich/sdk --filter immich-web install --frozen-lockfile && \
-  pnpm --filter @immich/sdk --filter immich-web build
+RUN --mount=type=cache,id=pnpm,target=/buildcache/pnpm-store pnpm --filter immich-web build
 
-FROM builder AS cli
+FROM sdk AS cli
+
+COPY ./packages/cli/package.json ./packages/cli/package.json
+RUN --mount=type=cache,id=pnpm,target=/buildcache/pnpm-store pnpm --filter @immich/cli install --frozen-lockfile
 
-COPY ./packages/sdk ./packages/sdk/
 COPY ./packages/cli ./packages/cli/
-RUN --mount=type=cache,id=pnpm-cli,target=/buildcache/pnpm-store \
-  pnpm --filter @immich/sdk --filter @immich/cli install --frozen-lockfile && \
-  pnpm --filter @immich/sdk --filter @immich/cli build && \
+RUN --mount=type=cache,id=pnpm,target=/buildcache/pnpm-store \
+  pnpm --filter @immich/cli build && \
   pnpm --filter @immich/cli --prod --no-optional deploy /output/cli-pruned
 
-FROM builder AS plugins
+FROM plugin-sdk AS plugins
 
 ARG TARGETPLATFORM
 
@@ -59,12 +79,10 @@ ENV MISE_DISABLE_TOOLS=flutter
 RUN --mount=type=cache,id=mise-tools-${TARGETPLATFORM},target=/buildcache/mise \
   mise install --locked
 
-COPY ./packages/sdk ./packages/sdk/
 COPY ./packages/plugin-core ./packages/plugin-core/
-COPY ./packages/plugin-sdk ./packages/plugin-sdk/
 
 # Build plugins
-RUN --mount=type=cache,id=pnpm-packages,target=/buildcache/pnpm-store \
+RUN --mount=type=cache,id=pnpm,target=/buildcache/pnpm-store \
   --mount=type=cache,id=mise-tools-${TARGETPLATFORM},target=/buildcache/mise \
   mise //:plugins