fix: Bypass Docker layer cache when rebuilding for OS patches (#609)

Author: nickclyde

.github/workflows/_build-and-push.yml

@@ -45,6 +45,15 @@ on:
         type: string
         required: false
         default: ""
+      no_cache:
+        description: >-
+          Build without layer cache. Required when the goal is picking up OS
+          package patches: the `microdnf update` layer is keyed on the base
+          image digest, so cached builds silently skip repo updates (e.g.
+          AL2023 security patches) published since the layer was first built.
+        type: boolean
+        required: false
+        default: false
 
 permissions:
   contents: read
@@ -110,6 +119,7 @@ jobs:
           provenance: false
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          no-cache: ${{ inputs.no_cache }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
           secrets: |

.github/workflows/docker-image-push.yml

@@ -18,6 +18,13 @@ on:
       version_tag:
         description: Optional Docker tag
         required: false
+      no_cache:
+        description: >-
+          Build without layer cache so OS package patches are picked up.
+          Disable only when rebuilding for a code change.
+        type: boolean
+        required: false
+        default: true
 
 permissions:
   contents: read
@@ -56,3 +63,7 @@ jobs:
       extra_tag: ${{ github.event.inputs.version_tag || '' }}
       tag_branch: true
       tag_latest: ${{ github.ref_name == 'main' }}
+      # The weekly rebuild exists to pick up base-image/OS patches, which a
+      # cached `microdnf update` layer silently skips — so bust the cache on
+      # schedule and (by default) on manual dispatch. Push builds stay cached.
+      no_cache: ${{ github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && github.event.inputs.no_cache != 'false') }}

.github/workflows/release.yml

@@ -72,6 +72,9 @@ jobs:
       major_tag: ${{ needs.detect-release.outputs.major }}
       tag_latest: true
       tag_branch: false
+      # Versioned images are long-lived; never bake week-old cached OS layers
+      # into a release.
+      no_cache: true
 
   release:
     needs: [detect-release, build]