fix(ci): registry login for chart attestation; tolerate gha cache export errors

[mitasovr]

What broke

The merge run of #1298 (run 27353068335) failed twice:

1. backend-analytics-api — GHA cache backend 504 during layer-blob write (third spurious cache failure in three days). Recovered by re-run.
2. publish-chart → Attest chart provenance — No credentials found for registry ghcr.io. helm registry login writes to helm's own config; attest-build-provenance with push-to-registry: true reads Docker credentials, which nothing in that job ever provided. Image jobs were unaffected (they run docker/login-action).

Fallout of (2): the job aborted before "Commit version bumps back to main" — chart 0.1.53 was pushed unattested, and main still pins all backend appVersions to the pre-attestation tag 2026.06.09.10.55-9ef2224.

Fix

• docker/login-action in publish-chart before the attest step.
• Refreshed rebuild markers in the three backend Dockerfiles → merging this PR rebuilds + attests api-gateway/analytics-api/identity, and publish-chart re-publishes 0.1.53 (recomputed from main's 0.1.52) with attested backend pins, attests the chart digest, and commits the bumps back.
• ignore-error=true on every cache-to: type=gha export — cache export is an optimization; by that point the image is already built and pushed. A flaky cache service must not fail the job (and with it the whole publish chain). cache-from already tolerates cache unavailability.

Verify after merge

gh attestation verify oci://ghcr.io/constructorfabric/charts/insight:0.1.53 --repo constructorfabric/insight
gh attestation verify oci://ghcr.io/constructorfabric/insight-api-gateway:<new-tag> --repo constructorfabric/insight

Known-red: Run E2E suite (pre-existing cost_cents migration mismatch, tracked separately).

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Improved CI/CD build resilience by tolerating cache layer failures during image builds.
  • Fixed chart publication workflow by adding required Docker registry authentication for provenance attestation steps.
  • Updated build metadata comments across service images.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: add050f3-2253-4c28-9cc4-6fb0e536e21a

📥 Commits

Reviewing files that changed from the base of the PR and between cb61d6a and b31f37d.

📒 Files selected for processing (4)

• .github/workflows/build-images.yml
• src/backend/services/analytics-api/Dockerfile
• src/backend/services/api-gateway/Dockerfile
• src/backend/services/identity/Dockerfile

---

📝 Walkthrough

Walkthrough

The pull request adds cache-write error tolerance to Docker builds across five image pipelines (api-gateway, analytics-api, identity, toolbox, and matrix-driven connectors) by extending cache-to configurations with ignore-error=true. It also establishes GHCR credentials via docker/login-action before chart provenance attestation, and updates rebuild marker comments in backend service Dockerfiles to document the republish context.

Changes

Build cache and chart provenance fixes

Layer / File(s)	Summary
Cache resilience and attestation credentials in workflow .github/workflows/build-images.yml	Five docker/build-push-action cache-to configurations add ignore-error=true for api-gateway, analytics-api, identity, toolbox, and connector matrix builds; docker/login-action@v3 is inserted before chart provenance attestation to supply GHCR credentials using github.actor and secrets.GITHUB_TOKEN.
Rebuild markers in backend Dockerfiles src/backend/services/api-gateway/Dockerfile, src/backend/services/analytics-api/Dockerfile, src/backend/services/identity/Dockerfile	Rebuild marker comments updated to reflect "take 2" republish attempts and document prior publish-chart failures, missing registry-login credentials during attestation, and chart-pinned tag advancement. Build and runtime instructions remain unchanged.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• constructorfabric/insight#1298: Both PRs update .github/workflows/build-images.yml around umbrella chart provenance attestation and align with rebuild-marker updates in backend Dockerfiles to advance chart-pinned tags.

Poem

🐰 Cache resilience hops along,
Docker builds singing their strong song,
GHCR credentials in place so right,
Chart attestation shines so bright!
Rebuild markers mark the way,
As publish-flow errors hold no sway. 🚀

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately summarizes the two main fixes in this PR: adding registry login for chart attestation and making CI tolerant of GHA cache export errors.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Tools execution failed with the following error:

Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}