build: debian runtime mirror, release-to-release Docker cache

- runtime base image from ghcr.io/openprojectx/dockerhub mirror
- dependency layer keyed on a version-normalized Cargo.toml so release
  version bumps don't invalidate it
- CI builds the image (push=false) on master to seed the buildx GHA cache;
  tag runs can only restore caches from the default branch

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: CoderYellow

.github/workflows/ci.yml

@@ -39,3 +39,18 @@ jobs:
         run: cargo test --features integration --test integration_rustfs
       - name: E2E tests (k3s + RustFS containers)
         run: cargo test --features e2e --test e2e_k3s
+
+  # Validates the Dockerfile and seeds the buildx GHA cache on the default
+  # branch, so tag-triggered release builds can restore it (Actions cache is
+  # isolated per ref except for the default branch).
+  image-build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rustfs-operator"
-version = "0.2.1"
+version = "0.2.2"
 edition = "2024"
 rust-version = "1.92"
 license = "MIT OR Apache-2.0"

Dockerfile

@@ -1,22 +1,32 @@
-FROM ghcr.io/openprojectx/dockerhub/library/rust:1.97.0-trixie AS builder
+FROM ghcr.io/openprojectx/dockerhub/library/rust:1.97.0-trixie AS base
+
+# Normalize the manifest so routine version bumps don't invalidate the
+# dependency layer below.
+FROM base AS manifest
+COPY Cargo.toml /normalized/Cargo.toml
+RUN sed -i 's/^version = ".*"/version = "0.0.0"/' /normalized/Cargo.toml
+
+FROM base AS builder
 WORKDIR /build
 
 # Dependency layer: build all dependencies against dummy sources so the
-# layer is keyed on Cargo.toml only and survives source-code changes
-# (persisted across CI runs by the buildx GHA cache).
-COPY Cargo.toml ./
+# layer is keyed on the (normalized) Cargo.toml only and survives source
+# changes. Persisted across CI runs by the buildx GHA cache, seeded from
+# master builds (tag runs can only restore default-branch caches).
+COPY --from=manifest /normalized/Cargo.toml ./Cargo.toml
 RUN mkdir src \
     && echo 'fn main() {}' > src/main.rs \
     && touch src/lib.rs \
     && cargo build --release --bin rustfs-operator \
     && rm -rf src
 
+COPY Cargo.toml ./
 COPY src ./src
 # touch so cargo rebuilds the crate itself against the real sources
 RUN touch src/main.rs src/lib.rs \
     && cargo build --release --bin rustfs-operator
 
-FROM debian:trixie-slim
+FROM ghcr.io/openprojectx/dockerhub/library/debian:trixie-slim
 RUN apt-get update \
     && apt-get install -y --no-install-recommends ca-certificates \
     && rm -rf /var/lib/apt/lists/* \