ci: separate openclaw-base build from manager/worker release

- Add build-base.yml: triggers on openclaw-base/ changes, pushes openclaw-base:latest
- build.yml: remove push-openclaw-base from release flow, only build manager+worker
- Makefile: make build/push both use registry openclaw-base:latest for layer sharing
  build no longer rebuilds base locally; use make build-openclaw-base if needed

Author: johnlanni

.github/workflows/build-base.yml

@@ -0,0 +1,60 @@
+name: Build Base Image
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - 'openclaw-base/**'
+
+env:
+  REGISTRY: higress-registry.cn-hangzhou.cr.aliyuncs.com
+  REPO: higress
+
+jobs:
+  build-base:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Free Up GitHub Actions Ubuntu Runner Disk Space 🔧
+        uses: jlumbroso/free-disk-space@main
+        with:
+          tool-cache: false
+          android: true
+          dotnet: true
+          haskell: true
+          large-packages: true
+          swap-storage: true
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Build and push multi-arch base image
+        run: |
+          make push-openclaw-base \
+            VERSION=latest \
+            REGISTRY=${{ env.REGISTRY }} \
+            REPO=${{ env.REPO }}
+
+      - name: Summary
+        run: |
+          echo "### Base Image Build Summary" >> $GITHUB_STEP_SUMMARY
+          echo "- OpenClaw Base: \`${{ env.REGISTRY }}/${{ env.REPO }}/openclaw-base:latest\`" >> $GITHUB_STEP_SUMMARY
+          echo "- Platforms: \`linux/amd64, linux/arm64\`" >> $GITHUB_STEP_SUMMARY
+          echo "- Trigger: \`${{ github.event_name }}\` on \`${{ github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY

.github/workflows/build.yml

@@ -62,7 +62,7 @@ jobs:
       # also pushes :latest in the same buildx call, so no separate step needed.
       - name: Build and push multi-arch images
         run: |
-          make push \
+          make push-manager push-worker \
             VERSION=${{ steps.meta.outputs.version }} \
             REGISTRY=${{ env.REGISTRY }} \
             REPO=${{ env.REPO }}
@@ -74,7 +74,7 @@ jobs:
           WORKER_IMAGE: ${{ env.REGISTRY }}/${{ env.REPO }}/hiclaw-worker
         run: |
           echo "### Build Summary" >> $GITHUB_STEP_SUMMARY
-          echo "- OpenClaw Base: \`${OPENCLAW_BASE_IMAGE}:${{ steps.meta.outputs.version }}\`" >> $GITHUB_STEP_SUMMARY
           echo "- Manager: \`${MANAGER_IMAGE}:${{ steps.meta.outputs.version }}\`" >> $GITHUB_STEP_SUMMARY
           echo "- Worker: \`${WORKER_IMAGE}:${{ steps.meta.outputs.version }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "- Base: \`${OPENCLAW_BASE_IMAGE}:latest\` (pre-built, not rebuilt here)" >> $GITHUB_STEP_SUMMARY
           echo "- Platforms: \`linux/amd64, linux/arm64\`" >> $GITHUB_STEP_SUMMARY

Makefile

@@ -82,7 +82,7 @@ all: build
 
 # ---------- Build ----------
 
-build: build-openclaw-base build-manager build-worker ## Build all images
+build: build-manager build-worker ## Build all images (base image pulled from registry, not rebuilt locally)
 
 build-openclaw-base: ## Build OpenClaw base image
 	@echo "==> Building OpenClaw base image: $(LOCAL_OPENCLAW_BASE) (registry: $(HIGRESS_REGISTRY))"
@@ -91,8 +91,10 @@ build-openclaw-base: ## Build OpenClaw base image
 		./openclaw-base/
 
 # build targets use the locally-built openclaw-base; push targets use the registry image
-OPENCLAW_BASE_BUILD_ARG = --build-arg OPENCLAW_BASE_IMAGE=$(LOCAL_OPENCLAW_BASE)
-OPENCLAW_BASE_PUSH_ARG  = --build-arg OPENCLAW_BASE_IMAGE=$(OPENCLAW_BASE_TAG)
+# Both build and push targets use the registry :latest base image for layer sharing
+OPENCLAW_BASE_BUILD_ARG = --build-arg OPENCLAW_BASE_IMAGE=$(OPENCLAW_BASE_IMAGE):latest
+# push targets always use :latest so manager/worker layers are shared across releases
+OPENCLAW_BASE_PUSH_ARG  = --build-arg OPENCLAW_BASE_IMAGE=$(OPENCLAW_BASE_IMAGE):latest
 
 build-manager: ## Build Manager image
 	@echo "==> Building Manager image: $(LOCAL_MANAGER) (registry: $(HIGRESS_REGISTRY))"
@@ -141,7 +143,7 @@ else
 	fi
 endif
 
-push: push-openclaw-base push-manager push-worker ## Build + push multi-arch images (amd64 + arm64)
+push: push-manager push-worker ## Build + push multi-arch images (amd64 + arm64); base image built separately via build-base.yml
 
 push-openclaw-base: buildx-setup ## Build + push multi-arch OpenClaw base image
 	@echo "==> Building + pushing multi-arch OpenClaw base: $(OPENCLAW_BASE_TAG) [$(MULTIARCH_PLATFORMS)]"