ci(actions): restore audit lane and cache Docker builds#51933
Merged
vincentkoc merged 2 commits intomainfrom Mar 21, 2026
Merged
ci(actions): restore audit lane and cache Docker builds#51933vincentkoc merged 2 commits intomainfrom
vincentkoc merged 2 commits intomainfrom
Conversation
Contributor
Greptile SummaryThis PR makes two targeted CI changes: it restores the previously-removed
Confidence Score: 5/5
Prompt To Fix All With AIThis is a comment left during a code review.
Path: .github/workflows/docker-release.yml
Line: 162-163
Comment:
**Shared scope causes slim build to evict full image cache**
Both the full and slim amd64 builds write to the same `scope=docker-release-amd64`. Because `cache-to: type=gha` overwrites the scope entry, the slim build (which runs second) replaces the full image's cached layers. On the next run the full build will get cache hits only on the shared base stages, but will miss the full image's final unique layers, negating the benefit of `mode=max` for those layers.
Consider using distinct scopes so each image variant retains its own complete cache across runs:
```suggestion
cache-from: type=gha,scope=docker-release-amd64-full
cache-to: type=gha,mode=max,scope=docker-release-amd64-full
```
And for the slim build (lines 176-177):
```
cache-from: type=gha,scope=docker-release-amd64-slim
cache-to: type=gha,mode=max,scope=docker-release-amd64-slim
```
The same applies to the arm64 pair (lines 279-280 and 293-294).
How can I resolve this? If you propose a fix, please make it concise.
---
This is a comment left during a code review.
Path: .github/workflows/ci.yml
Line: 495-497
Comment:
**Missing `timeout-minutes` on restored job**
The `secrets` job has no `timeout-minutes` setting, so it will fall back to GitHub Actions' 6-hour default. For an audit job running `detect-private-key`, `zizmor`, and `pnpm-audit-prod`, a typical run should complete in under 10 minutes. Adding an explicit ceiling prevents a hung pre-commit process from holding a Blacksmith runner for hours.
```suggestion
secrets:
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
runs-on: blacksmith-16vcpu-ubuntu-2404
timeout-minutes: 20
```
How can I resolve this? If you propose a fix, please make it concise.Last reviewed commit: "ci(actions): restore..." |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Comment on lines
+162
to
+163
| cache-from: type=gha,scope=docker-release-amd64 | ||
| cache-to: type=gha,mode=max,scope=docker-release-amd64 |
Contributor
There was a problem hiding this comment.
Both the full and slim amd64 builds write to the same scope=docker-release-amd64. Because cache-to: type=gha overwrites the scope entry, the slim build (which runs second) replaces the full image's cached layers. On the next run the full build will get cache hits only on the shared base stages, but will miss the full image's final unique layers, negating the benefit of mode=max for those layers.
Consider using distinct scopes so each image variant retains its own complete cache across runs:
Suggested change
| cache-from: type=gha,scope=docker-release-amd64 | |
| cache-to: type=gha,mode=max,scope=docker-release-amd64 | |
| cache-from: type=gha,scope=docker-release-amd64-full | |
| cache-to: type=gha,mode=max,scope=docker-release-amd64-full |
And for the slim build (lines 176-177):
cache-from: type=gha,scope=docker-release-amd64-slim
cache-to: type=gha,mode=max,scope=docker-release-amd64-slim
The same applies to the arm64 pair (lines 279-280 and 293-294).
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/docker-release.yml
Line: 162-163
Comment:
**Shared scope causes slim build to evict full image cache**
Both the full and slim amd64 builds write to the same `scope=docker-release-amd64`. Because `cache-to: type=gha` overwrites the scope entry, the slim build (which runs second) replaces the full image's cached layers. On the next run the full build will get cache hits only on the shared base stages, but will miss the full image's final unique layers, negating the benefit of `mode=max` for those layers.
Consider using distinct scopes so each image variant retains its own complete cache across runs:
```suggestion
cache-from: type=gha,scope=docker-release-amd64-full
cache-to: type=gha,mode=max,scope=docker-release-amd64-full
```
And for the slim build (lines 176-177):
```
cache-from: type=gha,scope=docker-release-amd64-slim
cache-to: type=gha,mode=max,scope=docker-release-amd64-slim
```
The same applies to the arm64 pair (lines 279-280 and 293-294).
How can I resolve this? If you propose a fix, please make it concise.
Comment on lines
+495
to
+497
| secrets: | ||
| if: github.event_name != 'pull_request' || !github.event.pull_request.draft | ||
| runs-on: blacksmith-16vcpu-ubuntu-2404 |
Contributor
There was a problem hiding this comment.
timeout-minutes on restored job
The secrets job has no timeout-minutes setting, so it will fall back to GitHub Actions' 6-hour default. For an audit job running detect-private-key, zizmor, and pnpm-audit-prod, a typical run should complete in under 10 minutes. Adding an explicit ceiling prevents a hung pre-commit process from holding a Blacksmith runner for hours.
Suggested change
| secrets: | |
| if: github.event_name != 'pull_request' || !github.event.pull_request.draft | |
| runs-on: blacksmith-16vcpu-ubuntu-2404 | |
| secrets: | |
| if: github.event_name != 'pull_request' || !github.event.pull_request.draft | |
| runs-on: blacksmith-16vcpu-ubuntu-2404 | |
| timeout-minutes: 20 |
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/ci.yml
Line: 495-497
Comment:
**Missing `timeout-minutes` on restored job**
The `secrets` job has no `timeout-minutes` setting, so it will fall back to GitHub Actions' 6-hour default. For an audit job running `detect-private-key`, `zizmor`, and `pnpm-audit-prod`, a typical run should complete in under 10 minutes. Adding an explicit ceiling prevents a hung pre-commit process from holding a Blacksmith runner for hours.
```suggestion
secrets:
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
runs-on: blacksmith-16vcpu-ubuntu-2404
timeout-minutes: 20
```
How can I resolve this? If you propose a fix, please make it concise.
JohnJAS
pushed a commit
to JohnJAS/openclaw
that referenced
this pull request
Mar 22, 2026
* ci(actions): restore secrets audit lane * ci(actions): restore audits and cache docker builds
pholpaphankorn
pushed a commit
to pholpaphankorn/openclaw
that referenced
this pull request
Mar 22, 2026
* ci(actions): restore secrets audit lane * ci(actions): restore audits and cache docker builds
MaheshBhushan
pushed a commit
to MaheshBhushan/openclaw
that referenced
this pull request
Mar 22, 2026
* ci(actions): restore secrets audit lane * ci(actions): restore audits and cache docker builds
frankekn
pushed a commit
to artwalker/openclaw
that referenced
this pull request
Mar 23, 2026
* ci(actions): restore secrets audit lane * ci(actions): restore audits and cache docker builds
furaul
pushed a commit
to furaul/openclaw
that referenced
this pull request
Mar 24, 2026
* ci(actions): restore secrets audit lane * ci(actions): restore audits and cache docker builds
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
secretsaudit lane needs to remain active, and Docker Release currently has no explicit cross-run Buildx cache.secretsdropsdetect-private-key,zizmor, andpnpm-audit-prod; missing Docker layer cache leaves the expensive image builds cold on each run.secretsjob inci.ymland added GitHub Actions Buildx cache scopes todocker-release.ymlfor amd64 and arm64 image builds.Change Type (select all)
Scope (select all touched areas)
Linked Issue/PR
User-visible / Behavior Changes
None.
Security Impact (required)
Yes/No): NoYes/No): NoYes/No): NoYes/No): NoYes/No): NoYes, explain risk + mitigation:Repro + Verification
Environment
Steps
secretsaudit job in.github/workflows/ci.yml.type=ghaBuildx cache scopes in.github/workflows/docker-release.ymlfor amd64 and arm64 image builds.Expected
Actual
Evidence
Referenced runs:
Human Verification (required)
What you personally verified (not just CI), and how:
actionlinton.github/workflows/ci.ymland.github/workflows/docker-release.yml; reposcripts/committeron touched files.Review Conversations
Compatibility / Migration
Yes/No): YesYes/No): NoYes/No): NoFailure Recovery (if this breaks)
.github/workflows/ci.yml,.github/workflows/docker-release.ymlsecretscheck, or Docker Release builds failing to read/write Buildx cache.Risks and Mitigations
secretslane increases CI time slightly.AI Assistance