Cache not being hit when using TAG workflows

[Nithos]

Behaviour

When using a workflow that triggers on a TAG it fails to hit the cache when triggering the workflow with a follow on version tag.
Removing the tag and deploying again does hit the cache correctly however.

This is similar/same to the issue currently found in the build_pull_action here

Note this is a multi-platform build as well in case that adds extra complexity

Expected behaviour

Cache should be hit and used appropriately on all tags.

Actual behaviour

Cache is not hit on subsequent tags and invocation of the workflow.

Configuration

Sample Workflow

name: Docker CI Bake

on:
  push:
    tags:
      - 'v*.*.*'
      - 'v*.*.*-*'

env:
  REGISTRY: ghcr.io
  BAKE_FILE: docker-bake-gh.hcl

jobs:
  targets:
    runs-on: ubuntu-22.04
    outputs:
      matrix: ${{ steps.targets.outputs.matrix }}
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      # Generate a matrix output of all the default targets
      - name: Create matrix
        id: targets
        run: |
          echo ::set-output name=matrix::$(docker buildx bake -f ${{ env.BAKE_FILE }} --print | jq -cr '.group.default.targets')

      - name: Show matrix
        run: |
          echo ${{ steps.targets.outputs.matrix }}

  build-push:
    name: Buid and push Docker image to GitHub Container registry
    if: ${{ github.ref_type == 'tag' }}
    runs-on: ubuntu-22.04
    permissions:
      packages: write
      contents: read
    needs:
      - targets

    strategy:
      fail-fast: true
      matrix:
        target: ${{ fromJson(needs.targets.outputs.matrix) }}

    steps:
      # Checkout the repository
      - name: Checkout the repository
        uses: actions/checkout@v3

      # Login against the docker registry
      - name: Login to registry ${{ env.REGISTRY }}
        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: set env variables for bakefile
        run: |
          echo "VERSION=$( echo ${{ github.ref_name }} | sed 's/^.//' )" >>${GITHUB_ENV}
          echo "DOCKER_ORG=${{ env.REGISTRY }}" >> ${GITHUB_ENV}
          echo "DOCKER_PREFIX=${{ github.repository_owner }}" >> ${GITHUB_ENV}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      # Build and push Docker Images
      - name: Build Images using BuildX Bake
        uses: docker/bake-action@v2
        with:
          files: ./${{ env.BAKE_FILE }}
          targets: ${{ matrix.target }}
          push: true
          set: |
            *.cache-from=type=gha,scope=build-${{ matrix.target }}
            *.cache-to=type=gha,scope=build-${{ matrix.target }},mode=max

[crazy-max]

@Nithos This is the expected behavior when using gha cache exporter. Cache is scoped per Git branch. With the following events:

on:
  push:
    tags:
      - 'v*.*.*'
      - 'v*.*.*-*'

Your workflow will only push cache for tags and not the branch itself. Therefore when creating a new tag from this branch it doesn't have any cache available.

TLDR; You need to trigger the workflow for the branch that tags will point to (I guess the default one) like:

on:
  push:
    branches:
      - main
    tags:
      - 'v*.*.*'
      - 'v*.*.*-*'

As I can see in your workflow, image is built only when tags are pushed. You might need to adapt it to build but not push the image for a git push event on this branch.

There are some workflows out there with this kind of pattern like:

• https://github.com/docker/buildkit-syft-scanner/blob/master/.github/workflows/ci.yaml
• https://github.com/docker/buildx/blob/master/.github/workflows/build.yml

More info about GitHub scoped cache: https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#restrictions-for-accessing-a-cache

[Nithos]

Ah okay I appreciate the update.
So to confirm what you suggest is that a build should be made on the main (default branch) but not push. Then when a tag is made on that branch it should hit the cache properly.

We do on occasion tag on feature branches (demos etc...) and in that case I guess it should be infrequent enough that the cache hit is not as critical.

[crazy-max]

So to confirm what you suggest is that a build should be made on the main (default branch) but not push. Then when a tag is made on that branch it should hit the cache properly.

Yes that's it

[Nithos]

Thank you.

[crazy-max]

Let me know if it works on your side, thx