build: mirrored images, Docker dependency-layer caching, opt-in binary release

- test and builder images now pull from ghcr.io/openprojectx/dockerhub
  mirrors (rustfs, k3s, rust)
- Dockerfile builds dependencies against dummy sources in a separate layer
  keyed on Cargo.toml, so source-only changes reuse the cached deps layer
  via the buildx GHA cache
- GitHub release binary is now opt-in (repository variable
  RELEASE_BINARY=true); release always attaches crds.yaml

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: CoderYellow

.github/workflows/release.yml

@@ -44,18 +44,24 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@v4
+      # Binary artifact is opt-in: set the repository variable
+      # RELEASE_BINARY=true to build and attach it.
       - uses: dtolnay/rust-toolchain@stable
+        if: vars.RELEASE_BINARY == 'true'
       - uses: Swatinem/rust-cache@v2
+        if: vars.RELEASE_BINARY == 'true'
       - name: Build release binary
+        if: vars.RELEASE_BINARY == 'true'
         run: |
           cargo build --release --bin rustfs-operator
           cp target/release/rustfs-operator rustfs-operator-linux-amd64
       - uses: softprops/action-gh-release@v2
         with:
           generate_release_notes: true
+          # the glob matches nothing when the binary step is skipped
           files: |
             deploy/crds.yaml
-            rustfs-operator-linux-amd64
+            rustfs-operator-linux-amd64*
 
   charts:
     runs-on: ubuntu-latest

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rustfs-operator"
-version = "0.2.0"
+version = "0.2.1"
 edition = "2024"
 rust-version = "1.92"
 license = "MIT OR Apache-2.0"

Dockerfile

@@ -1,8 +1,20 @@
-FROM rust:1.97.0-trixie AS builder
+FROM ghcr.io/openprojectx/dockerhub/library/rust:1.97.0-trixie AS builder
 WORKDIR /build
+
+# Dependency layer: build all dependencies against dummy sources so the
+# layer is keyed on Cargo.toml only and survives source-code changes
+# (persisted across CI runs by the buildx GHA cache).
 COPY Cargo.toml ./
+RUN mkdir src \
+    && echo 'fn main() {}' > src/main.rs \
+    && touch src/lib.rs \
+    && cargo build --release --bin rustfs-operator \
+    && rm -rf src
+
 COPY src ./src
-RUN cargo build --release --bin rustfs-operator
+# touch so cargo rebuilds the crate itself against the real sources
+RUN touch src/main.rs src/lib.rs \
+    && cargo build --release --bin rustfs-operator
 
 FROM debian:trixie-slim
 RUN apt-get update \

README.md

@@ -66,7 +66,8 @@ cargo run --release -- run
 Push a `v*` tag. The release workflow builds and pushes
 `ghcr.io/openprojectx/rustfs-operator:<version>`, packages the Helm chart to
 the `gh-pages` chart repository, and creates a GitHub release with the CRD
-manifest and a linux-amd64 binary attached.
+manifest attached. Set the repository variable `RELEASE_BINARY=true` to also
+build and attach a linux-amd64 binary.
 
 ## Behavior notes
 

tests/common/mod.rs

@@ -7,7 +7,10 @@ use testcontainers::core::{IntoContainerPort, WaitFor};
 use testcontainers::runners::AsyncRunner;
 use testcontainers::{ContainerAsync, GenericImage, ImageExt};
 
-pub const RUSTFS_IMAGE: (&str, &str) = ("rustfs/rustfs", "1.0.0-beta.8");
+pub const RUSTFS_IMAGE: (&str, &str) = (
+    "ghcr.io/openprojectx/dockerhub/rustfs/rustfs",
+    "1.0.0-beta.8",
+);
 
 /// Container tests talk to 127.0.0.1; a system proxy must not intercept
 /// those connections (kube also refuses proxy env vars unless its proxy

tests/e2e_k3s.rs

@@ -26,6 +26,7 @@ use rustfs_operator::crd::{
 use rustfs_operator::provider::RustFs;
 use rustfs_operator::reconcile;
 
+const K3S_IMAGE: &str = "ghcr.io/openprojectx/dockerhub/rancher/k3s";
 const K3S_TAG: &str = "v1.34.9-k3s1";
 const NS: &str = "default";
 
@@ -86,6 +87,7 @@ async fn operator_reconciles_crs_against_rustfs() {
     let conf_dir = tempfile::tempdir().expect("tempdir");
     let k3s = K3s::default()
         .with_conf_mount(conf_dir.path())
+        .with_name(K3S_IMAGE)
         .with_tag(K3S_TAG)
         .with_privileged(true)
         .with_userns_mode("host")