CI: BuildKit registry cache + SBOM/provenance attestations for Docker builds

[lencioni]

Summary

• Replaces CircleCI DLC with BuildKit registry cache (enduire/happo-docs:buildcache, mode=max) so layers are reused across cold runners without paying for DLC
• Both test_docker_image and publish-docker jobs now authenticate to Docker Hub and use --cache-from/--cache-to with the same cache ref; docker_layer_caching: false on both
• test_docker_image gains the docker context so DOCKERHUB_USERNAME/DOCKERHUB_PASS are injected on every branch build (previously only the release job had credentials)
• publish-docker upgraded to docker buildx build with SBOM and provenance attestations (--attest type=sbom, --attest type=provenance,mode=max)
• Adds --pull to both builds for reproducible base images

Test plan

• Merge and observe the first CI run — --cache-from will warn that :buildcache doesn't exist yet and proceed cold; --cache-to seeds the tag at the end of that run
• On a subsequent run, confirm build output shows cache hits for pnpm install and pnpm build layers
• Trigger a release tag and confirm publish-docker pushes the versioned image and updates :buildcache; verify SBOM/provenance attestations are present via docker buildx imagetools inspect enduire/happo-docs:<tag>

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates CircleCI Docker build strategy to use BuildKit’s registry-backed cache and adds image attestations on release builds, aiming to speed up builds across cold runners and improve supply-chain metadata.

Changes:

• Switches Docker layer reuse from CircleCI DLC to BuildKit registry cache (--cache-from/--cache-to, mode=max) for both test and publish jobs.
• Updates publish-docker to use docker buildx build with SBOM and provenance attestations.
• Adds Docker Hub auth and a docker context to ensure cache access, and adds --pull to builds.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[lencioni]

Good catch. Fixed in ddcc420 — removed the docker context from test_docker_image in run_all, dropped the Hub login step, and removed --cache-to from that job. Branch builds now only read from the public cache ref (no credentials needed for a public Docker Hub repo). Cache writes stay scoped to the release job only, which already had the context restricted to tag builds.

[lencioni]

Fair point — the framing in the PR description was wrong. --pull ensures the latest tag, not a reproducible build. Removed --pull from both jobs in ddcc420. If we want actual reproducibility in the future, the right move is pinning the base image to a digest in the Dockerfile.