.forgejo/workflows/build.yml

@@ -504,6 +504,15 @@ jobs:
             --format '{{ index .Image.Config.Labels "fc.revision" }}' \
             2>/dev/null || echo "")
           echo "reuse: $IMAGE:$T carries fc.revision=${PUBLISHED:-<none>}; derived=$DERIVED"
+          if [ -z "$PUBLISHED" ] && docker buildx imagetools inspect "$IMAGE:$T" >/dev/null 2>&1; then
+            # The tag resolves but carries no readable label. Expected exactly
+            # once per artifact, during the migration onto labels. If it recurs
+            # every push, something is rewriting the channel tag as a manifest
+            # index — see the repoint step's note.
+            echo "reuse: NOTE $IMAGE:$T exists but has no readable fc.revision."
+            echo "reuse: NOTE Fine once, while migrating. Every push means the"
+            echo "reuse: NOTE tag is being index-wrapped and reuse is dead."
+          fi
 
           if [ -n "$PUBLISHED" ] && [ "$PUBLISHED" = "$DERIVED" ]; then
             echo "hit=true" >> "$GITHUB_OUTPUT"
@@ -625,20 +634,42 @@ jobs:
           TAGS: ${{ steps.tag.outputs.tags }}
         run: |
           set -euf
+          # The source tag is EXCLUDED from the targets, and that is load-
+          # bearing rather than an optimisation.
+          #
+          # `imagetools create` wraps the source manifest in an INDEX. Point it
+          # at the channel tag with that same tag as a target and the tag stops
+          # being a plain image — after which `.Image.Config.Labels` no longer
+          # resolves through it and the fc.revision label reads as absent. The
+          # next push then misses and rebuilds, so reuse worked exactly once
+          # and every subsequent push paid full price. Observed on run 4751:
+          # ml:dev reported fc.revision=<none> one push after run 4749 had read
+          # a7e626a67a79 off it. Nothing failed; the savings just evaporated.
+          #
+          # Excluding the source means the channel tag is only ever written by
+          # a real build, so it stays a plain image and stays readable. On dev
+          # that leaves nothing to do — :dev already points at the right
+          # content, which is what the hit established. On main it leaves
+          # :c-<sha>, which rule 145 requires of every main push whether or not
+          # a build ran.
+          #
           # steps.tag emits ONE comma-separated list, because that is the shape
           # docker/build-push-action takes; imagetools wants a -t per ref.
           ARGS=""
           IFS=,
-          for t in $TAGS; do ARGS="$ARGS -t $t"; done
+          for t in $TAGS; do
+            [ "$t" = "$SOURCE" ] && continue
+            ARGS="$ARGS -t $t"
+          done
           unset IFS
-          # Source is the channel tag itself — the image we just confirmed
-          # carries this revision. On dev the only target IS that tag, so this
-          # is a no-op that keeps the code path uniform. On main it is what
-          # gives the new commit its :c-<sha>, which rule 145 requires of every
-          # main push whether or not a build ran.
+          if [ -z "$ARGS" ]; then
+            echo "repoint: $SOURCE already carries this revision and is the"
+            echo "repoint: only tag for this channel — nothing to write."
+            exit 0
+          fi
           # shellcheck disable=SC2086
           docker buildx imagetools create $ARGS "$SOURCE"
-          echo "repointed to $SOURCE: $TAGS"
+          echo "repointed from $SOURCE:$ARGS"
 
   build-ml:
     runs-on: python-ci
@@ -775,6 +806,15 @@ jobs:
             --format '{{ index .Image.Config.Labels "fc.revision" }}' \
             2>/dev/null || echo "")
           echo "reuse: $IMAGE:$T carries fc.revision=${PUBLISHED:-<none>}; derived=$DERIVED"
+          if [ -z "$PUBLISHED" ] && docker buildx imagetools inspect "$IMAGE:$T" >/dev/null 2>&1; then
+            # The tag resolves but carries no readable label. Expected exactly
+            # once per artifact, during the migration onto labels. If it recurs
+            # every push, something is rewriting the channel tag as a manifest
+            # index — see the repoint step's note.
+            echo "reuse: NOTE $IMAGE:$T exists but has no readable fc.revision."
+            echo "reuse: NOTE Fine once, while migrating. Every push means the"
+            echo "reuse: NOTE tag is being index-wrapped and reuse is dead."
+          fi
 
           if [ -n "$PUBLISHED" ] && [ "$PUBLISHED" = "$DERIVED" ]; then
             echo "hit=true" >> "$GITHUB_OUTPUT"
@@ -815,20 +855,42 @@ jobs:
           TAGS: ${{ steps.tag.outputs.tags }}
         run: |
           set -euf
+          # The source tag is EXCLUDED from the targets, and that is load-
+          # bearing rather than an optimisation.
+          #
+          # `imagetools create` wraps the source manifest in an INDEX. Point it
+          # at the channel tag with that same tag as a target and the tag stops
+          # being a plain image — after which `.Image.Config.Labels` no longer
+          # resolves through it and the fc.revision label reads as absent. The
+          # next push then misses and rebuilds, so reuse worked exactly once
+          # and every subsequent push paid full price. Observed on run 4751:
+          # ml:dev reported fc.revision=<none> one push after run 4749 had read
+          # a7e626a67a79 off it. Nothing failed; the savings just evaporated.
+          #
+          # Excluding the source means the channel tag is only ever written by
+          # a real build, so it stays a plain image and stays readable. On dev
+          # that leaves nothing to do — :dev already points at the right
+          # content, which is what the hit established. On main it leaves
+          # :c-<sha>, which rule 145 requires of every main push whether or not
+          # a build ran.
+          #
           # steps.tag emits ONE comma-separated list, because that is the shape
           # docker/build-push-action takes; imagetools wants a -t per ref.
           ARGS=""
           IFS=,
-          for t in $TAGS; do ARGS="$ARGS -t $t"; done
+          for t in $TAGS; do
+            [ "$t" = "$SOURCE" ] && continue
+            ARGS="$ARGS -t $t"
+          done
           unset IFS
-          # Source is the channel tag itself — the image we just confirmed
-          # carries this revision. On dev the only target IS that tag, so this
-          # is a no-op that keeps the code path uniform. On main it is what
-          # gives the new commit its :c-<sha>, which rule 145 requires of every
-          # main push whether or not a build ran.
+          if [ -z "$ARGS" ]; then
+            echo "repoint: $SOURCE already carries this revision and is the"
+            echo "repoint: only tag for this channel — nothing to write."
+            exit 0
+          fi
           # shellcheck disable=SC2086
           docker buildx imagetools create $ARGS "$SOURCE"
-          echo "repointed to $SOURCE: $TAGS"
+          echo "repointed from $SOURCE:$ARGS"
 
   # The desktop GPU agent (#114) — published so the operator pulls + runs it on
   # the GPU machine instead of building locally. Independent of web/ml (its own
@@ -963,6 +1025,15 @@ jobs:
             --format '{{ index .Image.Config.Labels "fc.revision" }}' \
             2>/dev/null || echo "")
           echo "reuse: $IMAGE:$T carries fc.revision=${PUBLISHED:-<none>}; derived=$DERIVED"
+          if [ -z "$PUBLISHED" ] && docker buildx imagetools inspect "$IMAGE:$T" >/dev/null 2>&1; then
+            # The tag resolves but carries no readable label. Expected exactly
+            # once per artifact, during the migration onto labels. If it recurs
+            # every push, something is rewriting the channel tag as a manifest
+            # index — see the repoint step's note.
+            echo "reuse: NOTE $IMAGE:$T exists but has no readable fc.revision."
+            echo "reuse: NOTE Fine once, while migrating. Every push means the"
+            echo "reuse: NOTE tag is being index-wrapped and reuse is dead."
+          fi
 
           if [ -n "$PUBLISHED" ] && [ "$PUBLISHED" = "$DERIVED" ]; then
             echo "hit=true" >> "$GITHUB_OUTPUT"
@@ -1003,17 +1074,39 @@ jobs:
           TAGS: ${{ steps.tag.outputs.tags }}
         run: |
           set -euf
+          # The source tag is EXCLUDED from the targets, and that is load-
+          # bearing rather than an optimisation.
+          #
+          # `imagetools create` wraps the source manifest in an INDEX. Point it
+          # at the channel tag with that same tag as a target and the tag stops
+          # being a plain image — after which `.Image.Config.Labels` no longer
+          # resolves through it and the fc.revision label reads as absent. The
+          # next push then misses and rebuilds, so reuse worked exactly once
+          # and every subsequent push paid full price. Observed on run 4751:
+          # ml:dev reported fc.revision=<none> one push after run 4749 had read
+          # a7e626a67a79 off it. Nothing failed; the savings just evaporated.
+          #
+          # Excluding the source means the channel tag is only ever written by
+          # a real build, so it stays a plain image and stays readable. On dev
+          # that leaves nothing to do — :dev already points at the right
+          # content, which is what the hit established. On main it leaves
+          # :c-<sha>, which rule 145 requires of every main push whether or not
+          # a build ran.
+          #
           # steps.tag emits ONE comma-separated list, because that is the shape
           # docker/build-push-action takes; imagetools wants a -t per ref.
           ARGS=""
           IFS=,
-          for t in $TAGS; do ARGS="$ARGS -t $t"; done
+          for t in $TAGS; do
+            [ "$t" = "$SOURCE" ] && continue
+            ARGS="$ARGS -t $t"
+          done
           unset IFS
-          # Source is the channel tag itself — the image we just confirmed
-          # carries this revision. On dev the only target IS that tag, so this
-          # is a no-op that keeps the code path uniform. On main it is what
-          # gives the new commit its :c-<sha>, which rule 145 requires of every
-          # main push whether or not a build ran.
+          if [ -z "$ARGS" ]; then
+            echo "repoint: $SOURCE already carries this revision and is the"
+            echo "repoint: only tag for this channel — nothing to write."
+            exit 0
+          fi
           # shellcheck disable=SC2086
           docker buildx imagetools create $ARGS "$SOURCE"
-          echo "repointed to $SOURCE: $TAGS"
+          echo "repointed from $SOURCE:$ARGS"