perf(integration): cache the runner image instead of rebuilding it every run #116

Merged

noe.trevino merged 9 commits from ci-114/cache-integration-runner into nightly

2026-07-20 01:45:37 -05:00

noe.trevino commented

2026-07-18 02:41:01 -05:00

Owner

The integration job spent ~57s of its ~67s standing up Docker, ~10s running specs. Two perf changes:

Prepare the servers and the runner image in parallel (run.sh) — they share no resources, so the image work hides inside the DB pull + healthcheck wait.
Publish the runner image to GHCR instead of rebuilding it every run. The tag is a hash of integration/Dockerfile (runner-image.sh, single source of the ref); a new workflow pushes it on pushes to main/nightly. A pinned-client bump changes the tag, so a stale image can't be served.

Nothing here is required: run.sh resolves local → pull → build, so unpublished tags, fork PRs, and arm64 hosts (image is amd64) just build locally as before. DBUI_IT_RUNNER_IMAGE=<ref> overrides the resolved image.

Also hardened while here: actions pinned by commit SHA, persist-credentials: false, secrets via env (not ${{ }} in argv), superseded PR runs cancelled (never on main), each publish records its digest in the job summary. packages: write exists only on pushes to main/nightly and manual dispatch — never reachable from a PR.

Local timings (make test-integration, all green): build fallback 29s, image local 25s, before this PR 52s. First CI run builds — the tag publishes after merge.

Maintainer setup (first publish, package visibility, repo settings) and the trust model: docs/CI_SETUP.md.

Refs: #114

The integration job spent ~57s of its ~67s standing up Docker, ~10s running specs. Two perf changes: 1. **Prepare the servers and the runner image in parallel** (`run.sh`) — they share no resources, so the image work hides inside the DB pull + healthcheck wait. 2. **Publish the runner image to GHCR instead of rebuilding it every run.** The tag is a hash of `integration/Dockerfile` (`runner-image.sh`, single source of the ref); a new workflow pushes it on pushes to `main`/`nightly`. A pinned-client bump changes the tag, so a stale image can't be served. Nothing here is required: `run.sh` resolves local → pull → build, so unpublished tags, fork PRs, and arm64 hosts (image is amd64) just build locally as before. `DBUI_IT_RUNNER_IMAGE=<ref>` overrides the resolved image. Also hardened while here: actions pinned by commit SHA, `persist-credentials: false`, secrets via env (not `${{ }}` in argv), superseded PR runs cancelled (never on `main`), each publish records its digest in the job summary. `packages: write` exists only on pushes to `main`/`nightly` and manual dispatch — never reachable from a PR. Local timings (`make test-integration`, all green): build fallback 29s, image local 25s, before this PR 52s. First CI run builds — the tag publishes after merge. Maintainer setup (first publish, package visibility, repo settings) and the trust model: `docs/CI_SETUP.md`. Refs: #114