Use Docker layer caching in GitHub Actions

GitHub-hosted runners are ephemeral, so the local layer cache that makes docker build fast on a laptop is empty at the start of every CI run. Each run re-executes every Dockerfile instruction: base image pull, apt-get, dependency install, compile. Wiring BuildKit's GitHub Actions cache backend into docker/build-push-action persists layers between runs, so a change to application code reuses every layer above it and the build starts from the first instruction whose inputs changed.

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - name: Build image
        uses: docker/build-push-action@v6
        with:
          context: .
          tags: myapp:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

1. 01

   Search for plain builds: grep -rn 'docker build\|docker compose build' .github/workflows/ - a bare docker build on a hosted runner rebuilds every layer every run.

2. 02

   Search for the action: grep -rn 'docker/build-push-action' .github/workflows/ and check each use for cache-from and cache-to; the action builds uncached when both are absent.

• -

  The GitHub Actions cache backend shares the repository's 10 GB cache allowance with actions/cache; mode=max stores every layer (best hit rate, biggest footprint), mode=min stores final-stage layers. Watch eviction on repositories with many large caches.

• -

  Cache entries follow GitHub's branch scoping: a pull request restores from its own branch and the default branch. A first build on a new branch still pays the cold cost once.

• -

  Order Dockerfile instructions so what changes most often comes last; layer caching restores prefixes, and a COPY . . near the top invalidates everything below it on any file change.

• -

  Never write secrets into image layers to make them cacheable; use build secrets (--mount=type=secret), which stay out of layers and out of the cache.

Hand this prompt to your coding agent (Claude Code, Cursor, and the like) to run this audit and open the fix as a reviewable PR.

Audit this repository's Docker builds in CI and add layer caching where it is missing.

1. grep .github/workflows/ for docker build, docker compose build, and
   docker/build-push-action. For each build, note whether cache-from and cache-to are set.
2. For uncached builds, convert to docker/setup-buildx-action + docker/build-push-action
   with cache-from: type=gha and cache-to: type=gha,mode=max, preserving the existing
   context, tags, and push behavior exactly.
3. Read the Dockerfile: if a COPY of the whole source tree sits above dependency
   installation, propose reordering so dependency layers cache independently.
4. Read the Docker GitHub Actions cache docs linked on this page before editing.
5. Show the full diff and open a pull request; do not apply changes blindly. In the PR
   body, state how to verify: re-run the same commit and look for CACHED instructions.