ci: add Docker registry cache via GHCR for faster CI builds

[IgnatovFedor]

Docker registry cache for GitHub Actions

What problem does this solve?

CI builds cold-start every run - Docker layers are rebuilt from scratch each time, making the build-images job unnecessarily slow. Issue #338.

How do you know this is a real problem?

build-images is the bottleneck in CI; no layer reuse happens between runs on ephemeral GitHub-hosted runners.

How does this solve the problem?

Switches all component Makefiles from docker build to docker buildx build and adds a USE_REGISTRY_CACHE flag. When set to 1, each build passes --cache-from and --cache-to pointing at a dedicated
ghcr.io/gonka-ai/<component>:buildcache tag. The CI workflow authenticates to GHCR before building and passes USE_REGISTRY_CACHE=1.

What risks does this introduce? How can we mitigate those risks?

• Stale cache could theoretically serve outdated layers. Mitigated by mode=max which stores all layers and by the fact that cache misses fall back to a full build.

How do you know this PR fixes the problem?

In the second run make images in integration tests took 5.5 minutes instead of 14.5 minutes on the firs run.

[Copilot]

Pull request overview

This PR aims to speed up GitHub Actions CI by enabling cross-run Docker layer reuse via docker buildx and a GHCR-backed registry cache, reducing cold-start rebuild time for the build-images job.

Changes:

• Switched multiple component builds from docker build to docker buildx build and introduced a USE_REGISTRY_CACHE flag to opt into registry-backed caching.
• Updated the reusable CI workflow to set up Buildx, authenticate to GHCR, and build images with registry cache enabled.
• Added packages: write permission to the integration workflow to support pushing cache layers to GHCR.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
proxy/Makefile	Adds Buildx + registry cache args for proxy image builds.
proxy-ssl/Makefile	Adds Buildx + registry cache args for proxy-ssl image builds.
bridge/Makefile	Adds Buildx + registry cache args for bridge image builds.
inference-chain/Makefile	Adds registry cache args for inferenced builds and upgrade build output.
decentralized-api/Makefile	Adds Buildx + registry cache args for api builds and upgrade build output.
decentralized-api/Dockerfile	Removes an ARG related to build flags (affects build-arg usage).
Makefile	Adds Buildx + registry cache args for mock-server image build.
.github/workflows/test-workflow.yml	Sets up Buildx + GHCR login; enables registry cache during CI image builds.
.github/workflows/integration.yml	Grants packages: write to allow cache export to GHCR.

Comments suppressed due to low confidence (1)

decentralized-api/Dockerfile:12

• BUILD_FLAGS is still passed from decentralized-api/Makefile via --build-arg BUILD_FLAGS=..., but after removing ARG BUILD_FLAGS it will be ignored by Docker. Also, the build step uses -ldflags "$LDFLAGS" but there is no ARG/ENV LDFLAGS declared in this Dockerfile, so ldflags will always be empty. To keep version/commit injection working, reintroduce and use the appropriate build arg (either declare ARG BUILD_FLAGS and use it, or switch to an explicit ARG LDFLAGS and pass that).

FROM golang:1.24.2-alpine3.20 AS builder

ARG GOOS
ARG GOARCH
ARG BLST_PORTABLE=0

ENV GOOS=${GOOS} \

---

You can also share your feedback on Copilot code review. Take the survey.