fix(ci): make the docker dependency cache work and unbreak Dockerfile.bins

[beardthelion]

Two container builds that do not work, both found while adding --locked to the shipping builds in #243.

Closes #265. Closes #266.

The dependency-cache layer never cached anything

Dockerfile primed its dependency cache from four crate manifests, but the workspace has six members and crates/gl takes a path dependency on icaptcha-client. Cargo loads the whole workspace before resolving anything, so the layer aborted on the missing manifest and || true swallowed it. Every image build has been a cold build of the full dependency graph since icaptcha-client was added, including the docker-build smoke test on every PR.

Copying all six manifests fixes it. Dropping the || true is the part that keeps it fixed: the guard is what let this sit unnoticed, and this layer has no reason to tolerate failure.

Before, building the first 24 lines unchanged:

--- target/release/deps rlib count ---
0
--- registry cache size ---
no registry cache

After:

--- rlib count after the fixed cache layer ---
619
--- registry cache ---
508M	/usr/local/cargo/registry

Dockerfile.bins could not build at all

It pinned rust:1.85-bookworm against a workspace rust-version = "1.91". An unmet MSRV is a hard cargo error, so scripts/build-bins.sh has been broken for both Linux musl targets. Nothing in CI builds this file, which is why it stayed quiet. Released binaries are unaffected: release.yml builds those on matching-arch runners.

Bumping the base image to rust:1.91-bookworm, matching the main Dockerfile, is the whole fix. Verified by building it: it now completes and produces a 158 MB image.

Verification

Real docker build runs, not reasoning about the files:

• The full gitlawb-node image builds end to end with the fixed cache layer.
• Removing one member manifest from the fixed layer now fails the build with exit 101 (failed to read /build/crates/icaptcha-client/Cargo.toml) instead of continuing silently, so the removed || true is load-bearing and the next crate added to the workspace cannot break this quietly again.
• Dockerfile.bins with the new base image builds to completion for aarch64-unknown-linux-musl; on the old base it fails with error: rustc 1.85.1 is not supported by the following packages. It fails identically with and without --locked, so ci: keep Cargo.lock in sync through releases and build --locked (#242) #243's flag was never the cause.

One consequence worth naming: until now the cache layer produced no artifacts at all, so the dummy-binary guard at Dockerfile:26-38 (mtime bump, binary removal, fingerprint removal) was never actually exercised. It is now. I checked the built image rather than assuming it held: it ships a 36 MB gitlawb-node reporting 0.7.0 and a 12 MB gl reporting 0.7.0, not the fn main() {} stubs.

Base

Stacked on ci/242-lock-sync-release (#243), which touches the same Dockerfile line. GitHub will retarget this to main when #243 merges. Nothing here depends on #243 semantically, only textually.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 450c1345-cd08-43c7-96cb-21d1ddf95484

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/docker-build-cache-and-msrv

---

_{Comment @coderabbitai help to get the list of available commands.}

[jatmn]

LGTM