[DX-4045] Better Docker Caching

[kalverra]

Dependent on: smartcontractkit/.github#1608

Uses docker cache-dance to cache individual layers, mostly the go build cache, which saves us a ton of time on the critical path.

Version	Runtime	Runtime Delta	Cost	Cost Delta
Before (All Cases)	4m 43s	-	$0.0283	-
After (Typical Case)	1m 27s	-3m 16s (-69.3%)	$0.0086	-$0.0197 (-69.6%)
After (Worst Case)	4m 55s	+0m 12s (+4.2%)	$0.0288	+$0.0005 (+1.8%)
After (Best Case)	43s	-4m 00s (-84.8%)	$0.0076	-$0.0207 (-73.1%)

[github-actions]

✅ No conflicts with other open PRs targeting develop

[trunk-io]

   

Failed Test	Failure Summary	Logs
Test_CRE_V2_Sharding	The test failed without a specific error message, but the logs indicate an issue during the setup or execution of the sharding test in the blockcha...	Logs ↗︎

View Full Report ↗︎ ⋅ Docs

[Copilot]

Pull request overview

Risk Rating: MEDIUM — Changes affect Docker build behavior and GitHub Actions caching for images used in integration tests; regressions would impact CI reliability and potentially the runtime characteristics of test images.

This PR improves CI Docker build performance by introducing BuildKit cache mounts for Go build artifacts and narrowing Docker build invalidation via explicit source-tree COPY lists, then wiring GitHub Actions to persist the relevant cache data between runs.

Changes:

• Add BuildKit cache mounts and explicit Go cache locations (GOCACHE, GOMODCACHE) to Docker build stages to speed up go mod download / go install.
• Replace COPY . . with targeted COPY directives to reduce cache busting from unrelated workspace changes.
• Configure integration-tests workflow to use cache-dance style caching (plus ignore cache-dance host directories in .dockerignore).

Scrupulous human review recommended:

• Confirm the integration-test image build still uses the intended dev vs prod build mode (notably CL_IS_PROD_BUILD behavior).
• Verify the explicit Dockerfile COPY lists include everything required for all build targets invoked in these images (including any indirect build-time file dependencies).
• Validate cache-dance configuration compatibility with the ctf-build-image action and runner environments (especially around cache restore/save stability).

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
plugins/chainlink.Dockerfile	Adds Go build/module cache mounts and narrows source copy scope to improve layer caching.
core/chainlink.Dockerfile	Same caching approach for the production Dockerfile and related build stages.
.github/workflows/integration-tests.yml	Enables cache-dance style caching configuration for image builds.
.dockerignore	Excludes additional repo files and cache-dance host dirs from Docker build context to prevent cache invalidation/bloat.
.gitignore	Ignores local agent trial artifacts under .github/.agents/....

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

.github/workflows/integration-tests.yml:352

• Removing docker-additional-build-args means CL_IS_PROD_BUILD is no longer set to false during this workflow build. Since both core/chainlink.Dockerfile and plugins/chainlink.Dockerfile default ARG CL_IS_PROD_BUILD=true, this changes the produced integration-test images from dev builds (make install-chainlink-dev) to prod builds (make install-chainlink). If integration tests still require the dev-tagged binary, reintroduce the explicit build arg here (or set it per-matrix image).

          cache-scope: ${{ matrix.image.cache-scope }}
          # Persist only the Go build cache (GOCACHE), not the module cache.
          # Module cache is large, and doesn't save us much time,
          # at least compared to just using the build cache
          # It also has mysterious failures when trying to upload

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (7)

core/chainlink.Dockerfile:132

• Pinning postgresql-client-17 to an exact PGDG version can break builds when PGDG publishes a new patch version and the old one is removed from the repo. Unless you’re also pinning the PGDG repo to a snapshot, it’s safer to install the major version without an exact package pin.

    && apt-get update && apt-get install -y --no-install-recommends postgresql-client-17=17.10-1.pgdg24.04+1 \

plugins/chainlink.Dockerfile:131

• Pinning postgresql-client-17 to an exact PGDG version can break builds when PGDG publishes a new patch version and the old one is removed from the repo. Unless you’re also pinning the PGDG repo to a snapshot, it’s safer to install the major version without an exact package pin.

    && apt-get update && apt-get install -y --no-install-recommends postgresql-client-17=17.10-1.pgdg24.04+1 \

plugins/chainlink.Dockerfile:119

• Pinning core Ubuntu packages to exact versions (without also pinning the base image by digest) is likely to cause intermittent Docker build failures when the ubuntu:24.04 tag updates and the pinned versions are no longer available. Consider removing the version pins, or pin ubuntu:24.04 by digest if strict reproducibility is desired.

RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates=20260601~24.04.1 \
    gnupg=2.4.4-2ubuntu17.4 \
    lsb-release=12.0-2 \
    curl=8.5.0-2ubuntu10.11 \

core/chainlink.Dockerfile:120

• Pinning core Ubuntu packages to exact versions (without also pinning the base image by digest) is likely to cause intermittent Docker build failures when the ubuntu:24.04 tag updates and the pinned versions are no longer available. Consider removing the version pins, or pin ubuntu:24.04 by digest if strict reproducibility is desired.

RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates=20260601~24.04.1 \
    gnupg=2.4.4-2ubuntu17.4 \
    lsb-release=12.0-2 \
    curl=8.5.0-2ubuntu10.11 \

plugins/chainlink.Dockerfile:12

• Pinning jq to an exact Debian package version makes builds brittle (the version can disappear from apt repos after security updates). Prefer installing jq without an exact version pin, or pin the base image by digest if full reproducibility is required.

This issue also appears in the following locations of the same file:

• line 115
• line 131

RUN apt-get update && apt-get install -y --no-install-recommends jq=1.6-2.1+deb12u2 && rm -rf /var/lib/apt/lists/*

core/chainlink.Dockerfile:10

• Pinning jq to an exact Debian package version makes builds brittle (the version can disappear from apt repos after security updates). Prefer installing jq without an exact version pin, or pin the base image by digest if full reproducibility is required.

This issue also appears in the following locations of the same file:

• line 116
• line 132

RUN apt-get update && apt-get install -y --no-install-recommends jq=1.6-2.1+deb12u2 && rm -rf /var/lib/apt/lists/*

.github/workflows/integration-tests.yml:362

• The last sentence in this comment block is incomplete (“when trying to upload”). Either finish the sentence or merge it into the previous line so the intent is clear for future maintainers.

          # Persist only the Go build cache (GOCACHE), not the module cache.
          # Module cache is large, and doesn't save us much time,
          # at least compared to just using the build cache
          # It also has mysterious failures when trying to upload
          cache-map: |

[cl-sonarqube-production]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE