From d90dccaed37ba046062aed476ce1076234c9c723 Mon Sep 17 00:00:00 2001
From: ThePhaseless <kukubaorch@gmail.com>
Date: Thu, 20 Feb 2025 20:50:11 +0000
Subject: [PATCH] gha cache fix

---
 .github/workflows/docker-publish.yml | 37 +++++++++++++++++++++++-----
 1 file changed, 31 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index fb77290..74bef22 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -81,13 +81,14 @@ jobs:
           platforms: linux/amd64
           cache-from: type=gha
           pull: true
+          push: ${{ github.event_name != 'pull_request' }}
           cache-to: type=gha,mode=max
           target: test
 
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
-      - name: Build and push Docker image
-        id: build-and-push
+      - name: Build and push Docker image for x64
+        id: build-and-push-x64
         uses: docker/build-push-action@v6
         with:
           context: .
@@ -95,9 +96,33 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          platforms: linux/amd64
+          cache-from: type=gha,scope=buildkit-x64
+          cache-to: type=gha,mode=max,scope=buildkit-x64
+          build-args: GITHUB_BUILD=true,VERSION=${{ github.ref_name }}
+
+      - name: Sign the published Docker image
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+          TAGS: ${{ steps.meta.outputs.tags }}
+          DIGEST: ${{ steps.build-and-push-x64.outputs.digest }}
+        # This step uses the identity token to provision an ephemeral certificate
+        # against the sigstore community Fulcio instance.
+        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
+
+      - name: Build and push Docker image for arm64
+        id: build-and-push-arm64
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          pull: true
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          platforms: linux/arm64
+          cache-from: type=gha,scope=buildkit-arm64
+          cache-to: type=gha,mode=max,scope=buildkit-arm64
           build-args: GITHUB_BUILD=true,VERSION=${{ github.ref_name }}
 
       # Sign the resulting Docker image digest except on PRs.
@@ -110,7 +135,7 @@ jobs:
         env:
           # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
           TAGS: ${{ steps.meta.outputs.tags }}
-          DIGEST: ${{ steps.build-and-push.outputs.digest }}
+          DIGEST: ${{ steps.build-and-push-arm64.outputs.digest }}
         # This step uses the identity token to provision an ephemeral certificate
         # against the sigstore community Fulcio instance.
         run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}