ci: enable Docker layer caching for cspell spellcheck job#3278
ci: enable Docker layer caching for cspell spellcheck job#3278arkid15r merged 6 commits intoOWASP:mainfrom
Conversation
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings. WalkthroughAdds Docker Buildx and GitHub Actions layer caching to the spellcheck CI job by building a cached Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In @.github/workflows/run-ci-cd.yaml:
- Around line 110-118: The workflow step using the docker/build-push-action is
pinned to the version tag "@v5", which is a supply-chain risk; update that step
(the action reference in the "Build cspell image with cache" job) to use the
same commit SHA used elsewhere (e.g. "263435318d21b8e681c14492fe198d362a7d2c83")
instead of "@v5" so the uses: value matches the pinned SHA form used in other
occurrences of docker/build-push-action in this file.
- Around line 107-108: The "Set up Docker buildx" step currently uses the
floating tag docker/setup-buildx-action@v3; replace it with the pinned commit
SHA docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f to match
the other occurrences and prevent supply-chain risks, i.e., update the uses
entry in the "Set up Docker buildx" job to reference that exact SHA.
🧹 Nitpick comments (1)
.github/workflows/run-ci-cd.yaml (1)
110-118: Consider adding cache compression and registry fallback.Other Docker build jobs in this workflow (e.g., lines 184-188) use
compression=zstdfor cache-to and include a registry fallback for cache-from. These optimizations could reduce cache storage/transfer time and provide redundancy.⚡ Optional optimization
- name: Build cspell image with cache uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 with: context: cspell file: cspell/Dockerfile tags: cspell:ci load: true - cache-from: type=gha - cache-to: type=gha,mode=max + cache-from: | + type=gha + type=registry,ref=owasp/nest:cspell-ci-cache + cache-to: | + type=gha,compression=zstd,mode=maxNote: This assumes you have push access to the registry and want to maintain a registry cache. If not needed, you can just add compression:
- cache-to: type=gha,mode=max + cache-to: type=gha,compression=zstd,mode=max
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/run-ci-cd.yamlcspell/Makefile
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-12-21T19:03:59.068Z
Learnt from: ahmedxgouda
Repo: OWASP/Nest PR: 1139
File: .github/workflows/setup-backend-environment/action.yaml:16-27
Timestamp: 2025-12-21T19:03:59.068Z
Learning: Composite actions (runs: using: composite) execute as steps within the calling job's context and can access the job context, including job.services.* properties (e.g., job.services.<service_id>.id, job.services.<service_id>.ports). Service containers must be defined at the job level, but a composite action's steps can reference them via the job context.
Applied to files:
.github/workflows/run-ci-cd.yaml
🔇 Additional comments (1)
cspell/Makefile (1)
3-6: LGTM! Conditional logic correctly implements cache reuse.The new conditional logic properly checks for a pre-built
cspell:ciimage and tags it ascspell, falling back to building a fresh image if unavailable. This efficiently reuses the cached image from CI while preserving local development workflow. The removal ofDOCKER_BUILDKIT=1and--cache-fromis appropriate given the new CI-based caching approach.
| --cache-from cspell \ | ||
| cspell \ | ||
| -t cspell | ||
| @docker image inspect cspell:ci >/dev/null 2>&1 && \ |
There was a problem hiding this comment.
What's goal of these changes?
There was a problem hiding this comment.
The goal is to avoid rebuilding the cspell Docker image from scratch on every CI run.
The workflow now builds the image once using Buildx with the GitHub Actions cache and tags it as cspell:ci.
The Makefile change simply reuses that image when it’s already available and falls back to a local build otherwise, so CI benefits from caching without changing local behavior.
|
arkid15r
left a comment
arkid15r
left a comment
There was a problem hiding this comment.
LGTM
// it didn't make any visible changes for this CI/CD step in terms of duration.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
cspell/Makefile (1)
6-8: Optional: Consider splitting the shell command for readability.The one-liner with
&&and||operators is functionally correct but could be more readable if split into separate Makefile recipe lines or wrapped in a small shell script block.♻️ Alternative with explicit conditional structure
- @docker image inspect cspell:ci >/dev/null 2>&1 && \ - docker tag cspell:ci cspell || \ - docker build -t cspell cspell + @if docker image inspect cspell:ci >/dev/null 2>&1; then \ + docker tag cspell:ci cspell; \ + else \ + docker build -t cspell cspell; \ + fi
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/run-ci-cd.yamlcspell/Makefile
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/run-ci-cd.yaml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Run frontend e2e tests
🔇 Additional comments (1)
cspell/Makefile (1)
4-8: LGTM! Caching approach is sound.The conditional logic correctly handles both CI (reusing
cspell:civia tag) and local development (building from scratch). The fallback todocker buildensures the target always produces a usablecspellimage.
* ci: enable Docker layer caching for cspell spellcheck job * ci: pin Docker GitHub Actions to commit SHAs * ci: scope GHA cache for cspell Docker build * Update code --------- Co-authored-by: Arkadii Yakovets <arkadii.yakovets@owasp.org> Co-authored-by: Arkadii Yakovets <2201626+arkid15r@users.noreply.github.com>
3 participants
Proposed change
Resolves #3269
This PR optimizes the Docker-based spellcheck job by enabling Docker Buildx with GitHub Actions cache for the
cspellimage.Previously, the spellcheck job rebuilt the Docker image from scratch on every CI run (~26s on recent
mainruns). With this change, the first run populates the cache and subsequent runs can reuse Docker layers, avoiding repeated cold builds.Summary of changes
spellcheckjobcspell:ciimage when availableNotes
Checklist
make check-testlocally and all tests passed(Not applicable — this change only affects CI configuration and Docker build caching)