Mirror Metabase's release pipeline for Docker publishing

Build the uberjar outside Docker using GHA-level dep caching
(M2 and node_modules), then package with the thin bin/docker/Dockerfile
runner image. Caches are keyed on deps.edn and bun.lock hashes so they
invalidate exactly when deps change rather than on every source file
change, reducing warm-cache build time from ~90 to ~20-30 minutes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: trevorgowing

.github/workflows/teal-docker-publish.yml

@@ -67,7 +67,11 @@ jobs:
             fi
           fi
 
-  # ── Build the Docker image and push to GHCR ──
+  # ── Build uberjar then package into the thin runner image ──
+  # Mirrors Metabase's own release pipeline: build outside Docker with cached
+  # deps, then copy the jar into bin/docker/Dockerfile (the thin runner image).
+  # This gives reliable GHA-level dep caching rather than fragile Docker layer
+  # caching that invalidates on any source file change.
 
   build-and-push:
     name: Build and push to GHCR
@@ -90,8 +94,65 @@ jobs:
           echo "name=ghcr.io/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" \
             >> "$GITHUB_OUTPUT"
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+      # ── Build environment ────────────────────────────────────────────────
+
+      - name: Set up Java 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: '21'
+          distribution: 'temurin'
+
+      - name: Install Clojure CLI
+        run: |
+          curl --retry 3 --retry-delay 5 --fail \
+            -O https://download.clojure.org/install/linux-install-1.12.0.1488.sh
+          sudo bash ./linux-install-1.12.0.1488.sh
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: '1.3.7'
+
+      # ── Dependency caching ───────────────────────────────────────────────
+      # Keyed on lockfile hashes so the cache is invalidated exactly when deps
+      # change — more precise than Metabase's weekly-rotation strategy.
+
+      - name: Cache Maven/Clojure dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.m2
+            ~/.gitlibs
+          key: m2-${{ runner.os }}-${{ hashFiles('deps.edn') }}
+          restore-keys: m2-${{ runner.os }}-
+
+      - name: Cache node_modules
+        uses: actions/cache@v4
+        with:
+          path: node_modules
+          key: node-modules-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: node-modules-${{ runner.os }}-
+
+      - name: Install frontend dependencies
+        run: bun install --frozen-lockfile
+
+      # ── Build ────────────────────────────────────────────────────────────
+
+      - name: Build uberjar
+        env:
+          MB_EDITION: oss
+          INTERACTIVE: false
+        run: ./bin/build.sh :version ${{ needs.resolve.outputs.version }}
+
+      # ── Package and publish ──────────────────────────────────────────────
+
+      - name: Move uberjar into Docker context
+        run: mv target/uberjar/metabase.jar bin/docker/metabase.jar
 
       - name: Log in to GHCR
         uses: docker/login-action@v4
@@ -103,16 +164,11 @@ jobs:
       - name: Build and push
         uses: docker/build-push-action@v7
         with:
-          context: .
+          context: bin/docker
           push: true
-          build-args: |
-            MB_EDITION=oss
-            VERSION=${{ needs.resolve.outputs.version }}
           tags: |
             ${{ steps.image.outputs.name }}:${{ needs.resolve.outputs.version }}
             ${{ steps.image.outputs.name }}:latest
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
 
       - name: Summary
         run: |

README-TEAL.md

@@ -74,7 +74,7 @@ Merges the latest upstream release tag into this fork's `master` daily, keeping
 
 ### Docker Publishing — `teal-docker-publish.yml`
 
-Builds the Metabase OSS image from the root `Dockerfile` and publishes it to the GitHub Container Registry (GHCR).
+Builds the Metabase OSS uberjar outside of Docker (mirroring Metabase's own release pipeline), then packages it into the thin `bin/docker/Dockerfile` runner image and publishes to the GitHub Container Registry (GHCR).
 
 ```bash
 docker pull ghcr.io/decode-development/metabase-teal:latest
@@ -86,4 +86,4 @@ docker pull ghcr.io/decode-development/metabase-teal:v0.61.2  # specific version
 - Merge of a `sync/upstream-*` PR into master (conflict-resolution path)
 - Manual dispatch — accepts an optional version tag, defaults to the current latest upstream release
 
-> **Note:** The build compiles the full frontend and backend from source and takes approximately 60–90 minutes on a standard GitHub-hosted runner. Layer caching (`type=gha`) reduces this significantly on subsequent builds.
+**Caching:** Maven/Clojure (`~/.m2`) and Node (`node_modules`) dependencies are cached at the GitHub Actions level, keyed on `deps.edn` and `bun.lock` hashes. A warm cache reduces build time from ~90 minutes to ~20–30 minutes.