ci: modernize gateway-conformance and docker workflows (#337)

gateway-conformance.yml:
- add permissions, timeout-minutes, defaults.run.shell
- read Go version from go.mod instead of hardcoding
- add fail-fast: false to see all backend failures
- add health check after each rainbow start variant

docker.yml:
- add timeout-minutes
- switch from local buildx cache to GHA cache
- add smoke test: build amd64 image, verify --version, then push multi-platform

Author: lidel

.github/workflows/docker.yml

@@ -13,6 +13,7 @@ env:
 jobs:
   build-and-push-image:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
       packages: write
@@ -28,19 +29,13 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Cache Docker layers
-        uses: actions/cache@v5
-        with:
-          path: /tmp/.buildx-cache
-          key: ${{ runner.os }}-buildx-${{ github.sha }}
-          restore-keys: |
-            ${{ runner.os }}-buildx-
       - name: Log in to the Container registry
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Get tags
         id: tags
         env:
@@ -50,20 +45,32 @@ jobs:
           ./docker/get-docker-tags.sh "$(date -u +%F)" >> $GITHUB_OUTPUT
           echo "EOF" >> $GITHUB_OUTPUT
         shell: bash
-      - name: Build Docker image and publish to Docker Hub
+
+      - name: Build Docker image (amd64, for smoke test)
+        uses: docker/build-push-action@v6
+        with:
+          platforms: linux/amd64
+          context: .
+          load: true
+          file: ./Dockerfile
+          tags: "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:smoke-test"
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Smoke-test Docker image
+        run: |
+          for i in {1..3}; do
+            timeout 15s docker run --rm ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:smoke-test --version && break || [ $i = 3 ] && exit 1
+          done
+        timeout-minutes: 1
+
+      - name: Build and push multi-platform Docker image
         uses: docker/build-push-action@v6
         with:
           platforms: linux/amd64,linux/arm/v7,linux/arm64/v8
           context: .
           push: true
           file: ./Dockerfile
           tags: "${{ steps.tags.outputs.value }}"
-          cache-from: type=local,src=/tmp/.buildx-cache
-          cache-to: type=local,dest=/tmp/.buildx-cache-new
-
-      # https://github.com/docker/build-push-action/issues/252
-      # https://github.com/moby/buildkit/issues/1896
-      - name: Move cache to limit growth
-        run: |
-          rm -rf /tmp/.buildx-cache
-          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/gateway-conformance.yml

@@ -13,14 +13,23 @@ env:
   GATEWAY_CONFORMANCE_TEST: true  # rainbow preset for conformance testing
   KUBO_VER: 'v0.33.0-rc1'         # kubo daemon used as no-libp2p-remote-* backend
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event_name == 'push' && github.sha || github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     strategy:
+      fail-fast: false
       matrix:
         backend: ["libp2p-bitswap", "remote-block-gw", "remote-car-gw"]
 
@@ -68,15 +77,17 @@ jobs:
         uses: ipfs/start-ipfs-daemon-action@v1
 
       # 4. Build rainbow
-      - name: Setup Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: 1.26.x
-
       - name: Checkout rainbow
         uses: actions/checkout@v6
         with:
           path: rainbow
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'rainbow/go.mod'
+          cache-dependency-path: 'rainbow/go.sum'
+
       - name: Build rainbow
         run: go build
         working-directory: rainbow
@@ -94,6 +105,14 @@ jobs:
           ./rainbow --peering=$kuboNodeMultiaddr &
         working-directory: rainbow
 
+      - name: Wait for rainbow (libp2p-bitswap)
+        if: ${{ matrix.backend == 'libp2p-bitswap' }}
+        run: |
+          for i in $(seq 1 30); do
+            curl -s http://127.0.0.1:8090 > /dev/null && break
+            sleep 1
+          done
+
       # 5. Start rainbow variant
       - name: Start rainbow (no libp2p, remote block gateway)
         if: ${{ matrix.backend == 'remote-block-gw' }}
@@ -108,7 +127,15 @@ jobs:
         run: |
           ./rainbow &
         working-directory: rainbow
-          #
+
+      - name: Wait for rainbow (remote-block-gw)
+        if: ${{ matrix.backend == 'remote-block-gw' }}
+        run: |
+          for i in $(seq 1 30); do
+            curl -s http://127.0.0.1:8090 > /dev/null && break
+            sleep 1
+          done
+
       # 5. Start rainbow variant
       - name: Start rainbow (no libp2p, remote car gateway)
         if: ${{ matrix.backend == 'remote-car-gw' }}
@@ -124,6 +151,14 @@ jobs:
           ./rainbow &
         working-directory: rainbow
 
+      - name: Wait for rainbow (remote-car-gw)
+        if: ${{ matrix.backend == 'remote-car-gw' }}
+        run: |
+          for i in $(seq 1 30); do
+            curl -s http://127.0.0.1:8090 > /dev/null && break
+            sleep 1
+          done
+
       # 6. Run the gateway-conformance tests
       - name: Run gateway-conformance tests
         uses: ipfs/gateway-conformance/.github/actions/test@v0.10