ci(release): cache Docker layers for the release-selfhost multi-arch build

[JSONbored]

Summary

• The multi-arch (linux/amd64 + linux/arm64, QEMU-emulated) docker/build-push-action step in .github/workflows/release-selfhost.yml had no cache-from/cache-to, so every Orb release build was fully cold with zero layer reuse across runs — unlike selfhost.yml's own CI build of the same Dockerfile, which already sets --cache-from type=gha --cache-to type=gha,mode=max.
• Every tagged orb-v* release (and every workflow_dispatch run) rebuilt the entire image from scratch for both platforms, including the slow apt-get install ca-certificates and npm install -g @anthropic-ai/claude-code @openai/codex layers in runtime-base — especially costly under QEMU emulation for the arm64 leg, and unable to inherit the cache the same-commit selfhost.yml CI run already built and pushed to the GHA cache backend.
• Added cache-from: type=gha / cache-to: type=gha,mode=max to the build-push-action step. Neither workflow sets a custom cache scope:, so both land in the GHA cache backend's default scope — letting a release build reuse layers from prior releases and from selfhost.yml's own build of the identical Dockerfile/commit.

Closes #2502.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally — this is a .github/workflows/**/test/** change with no src/** lines, so it carries no Codecov patch obligation; the new workflow-structure assertion passes.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. — N/A.
• API/OpenAPI/MCP behavior is updated and tested where needed. — N/A.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. — N/A, no UI changes.
• Visible UI changes include a UI Evidence section below — N/A, no UI changes.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• Part of the chore(selfhost): beta-stable release readiness roadmap #1936 self-host beta-stable release readiness batch. Last of the 13 filed sub-issues.
• Touches .github/workflows/**, a guarded path — expect this to be held for owner review rather than auto-merged, which is fine since I'm the repo owner.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-02 09:53:00 UTC}

2 files · 1 AI reviewer · no blockers · readiness 80/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review

Review summary
This change adds GHA-backed BuildKit caching to the release self-host image build and a focused regression test that pins the release workflow to the same cache backend already used by the selfhost CI build. The workflow syntax is correct for docker/build-push-action v6, and the test covers the intended contract without touching runtime source. The most notable risk is maintainability of the string-slice test, not release behavior.

Nits — 6 non-blocking

• nit: test/unit/release-selfhost-docker-cache.test.ts:10 should assert the build step marker exists before slicing so a renamed step fails with a clearer error than missing cache strings.
• nit: test/unit/release-selfhost-docker-cache.test.ts:18 only checks `scope=` in the release build step, so it does not prove the accompanying comment's claim that selfhost.yml also omits a custom GHA cache scope.
• test/unit/release-selfhost-docker-cache.test.ts:10 add `expect(releaseWorkflow.indexOf("- name: Build + push (linux/amd64 + linux/arm64)")).toBeGreaterThan(-1)` before `slice`.
• test/unit/release-selfhost-docker-cache.test.ts:18 either parse both workflow snippets and assert neither cache config includes `scope=`, or narrow the comment to only the release workflow guarantee being tested.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2502
Related work	⚠️ 2 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (size label size:XS; 1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 65 registered-repo PR(s), 55 merged, 553 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 65 PR(s), 553 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 65 PR(s), 553 issue(s).
• Related work: Items reference the same linked issue ci(release): cache Docker layers for the release-selfhost multi-arch build #2502. (issue #2502)
• Related work: Open PR work references issue ci(release): cache Docker layers for the release-selfhost multi-arch build #2502. (issue #2502)

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Review top overlaps.
• Add a concise scope and risk note.
• No action.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.98%. Comparing base (09aa0f1) to head (b43e87d).
⚠️ Report is 27 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2578      +/-   ##
==========================================
+ Coverage   95.96%   95.98%   +0.02%     
==========================================
  Files         226      229       +3     
  Lines       25470    25810     +340     
  Branches     9263     9389     +126     
==========================================
+ Hits        24442    24774     +332     
- Misses        417      425       +8     
  Partials      611      611              

see 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.