feat(workflows): validate latest source branches

.github/workflows/_publish_image_reusable.yml

@@ -141,6 +141,7 @@ jobs:
         IMAGE_REPO_RELEASE: ${{ matrix.image_repo_release }}
         PLATFORMS_LATEST: ${{ matrix.platforms_latest }}
         PLATFORMS_RELEASE: ${{ matrix.platforms_release }}
+        REGISTRY_CACHE_IMAGE: ${{ matrix.registry_cache_image || '' }}
       run: |
         set -euo pipefail
 
@@ -159,14 +160,38 @@ jobs:
         image_url="${image_repo}:${VERSION_TAG}"
         cache_scope="${COMPONENT}-${MODULE}"
 
+        if [ -n "$REGISTRY_CACHE_IMAGE" ]; then
+          cache_from="type=registry,ref=${REGISTRY_CACHE_IMAGE}"
+          cache_to_min="type=registry,ref=${REGISTRY_CACHE_IMAGE},mode=min"
+          cache_to_max="type=registry,ref=${REGISTRY_CACHE_IMAGE},mode=max"
+          cache_backend="registry"
+        else
+          cache_from="type=gha,scope=${cache_scope}"
+          cache_to_min="type=gha,scope=${cache_scope},mode=min"
+          cache_to_max="type=gha,scope=${cache_scope},mode=max"
+          cache_backend="gha"
+        fi
+
         {
           echo "image_url=$image_url"
           echo "platforms=$platforms"
           echo "cache_scope=$cache_scope"
+          echo "cache_from=$cache_from"
+          echo "cache_to_min=$cache_to_min"
+          echo "cache_to_max=$cache_to_max"
+          echo "cache_backend=$cache_backend"
         } >> "$GITHUB_OUTPUT"
 
+        {
+          echo "### Build parameters: ${MODULE}"
+          echo
+          echo "| Image | Platforms | Cache backend | Cache reference |"
+          echo "| --- | --- | --- | --- |"
+          echo "| \`${image_url}\` | \`${platforms}\` | \`${cache_backend}\` | \`${REGISTRY_CACHE_IMAGE:-$cache_scope}\` |"
+        } >> "$GITHUB_STEP_SUMMARY"
+
     - name: Checkout source (${{ matrix.module }})
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         repository: ${{ inputs.repository_url }}
         ref: ${{ needs.prepare.outputs.checkout_ref }}
@@ -196,8 +221,8 @@ jobs:
         platforms: linux/amd64
         load: true
         tags: ${{ steps.params.outputs.image_url }}
-        cache-from: type=gha,scope=${{ steps.params.outputs.cache_scope }}
-        cache-to: type=gha,scope=${{ steps.params.outputs.cache_scope }},mode=min
+        cache-from: ${{ steps.params.outputs.cache_from }}
+        cache-to: ${{ steps.params.outputs.cache_to_min }}
         build-args: ${{ inputs.mvn_args }}
 
     - name: Build x86 image for smoke test (${{ matrix.module }})
@@ -209,8 +234,8 @@ jobs:
         platforms: linux/amd64
         load: true
         tags: ${{ steps.params.outputs.image_url }}
-        cache-from: type=gha,scope=${{ steps.params.outputs.cache_scope }}
-        cache-to: type=gha,scope=${{ steps.params.outputs.cache_scope }},mode=min
+        cache-from: ${{ steps.params.outputs.cache_from }}
+        cache-to: ${{ steps.params.outputs.cache_to_min }}
 
     - name: Run smoke test (${{ matrix.module }})
       if: ${{ matrix.smoke_test }}
@@ -239,8 +264,8 @@ jobs:
         platforms: ${{ steps.params.outputs.platforms }}
         push: true
         tags: ${{ steps.params.outputs.image_url }}
-        cache-from: type=gha,scope=${{ steps.params.outputs.cache_scope }}
-        cache-to: type=gha,scope=${{ steps.params.outputs.cache_scope }},mode=max
+        cache-from: ${{ steps.params.outputs.cache_from }}
+        cache-to: ${{ steps.params.outputs.cache_to_max }}
         build-args: ${{ inputs.mvn_args }}
 
     - name: Build and push image (${{ matrix.module }})
@@ -252,8 +277,8 @@ jobs:
         platforms: ${{ steps.params.outputs.platforms }}
         push: true
         tags: ${{ steps.params.outputs.image_url }}
-        cache-from: type=gha,scope=${{ steps.params.outputs.cache_scope }}
-        cache-to: type=gha,scope=${{ steps.params.outputs.cache_scope }},mode=max
+        cache-from: ${{ steps.params.outputs.cache_from }}
+        cache-to: ${{ steps.params.outputs.cache_to_max }}
 
   update_latest_hash:
     needs: [prepare, publish]

.github/workflows/_publish_pd_store_server_reusable.yml

@@ -71,6 +71,8 @@ jobs:
       need_update: ${{ steps.prepare.outputs.need_update }}
       source_sha: ${{ steps.prepare.outputs.source_sha }}
       version_tag: ${{ steps.prepare.outputs.version_tag }}
+      cache_channel: ${{ steps.prepare.outputs.cache_channel }}
+      publish_images: ${{ steps.prepare.outputs.publish_images }}
       build_matrix_json: ${{ steps.prepare.outputs.build_matrix_json }}
     steps:
     - name: Resolve mode and source ref
@@ -96,7 +98,24 @@ jobs:
         fi
 
         if [ "$MODE" = "latest" ]; then
-          version_tag="latest"
+          if [ "$BRANCH" = "master" ]; then
+            version_tag="latest"
+            publish_images="true"
+          else
+            safe_branch="$(
+              printf '%s' "$BRANCH" \
+              | tr '[:upper:]' '[:lower:]' \
+              | sed -E 's/[^a-z0-9_.-]+/-/g; s/^[.-]+//; s/[.-]+$//' \
+              | cut -c1-110
+            )"
+            if [ -z "$safe_branch" ]; then
+              echo "Failed to derive an image tag from branch: $BRANCH"
+              exit 1
+            fi
+            version_tag="branch-${safe_branch}"
+            publish_images="false"
+          fi
+          cache_channel="latest"
           need_update="true"
           if [ "$ENABLE_HASH_GATE" = "true" ] && [ "$source_sha" = "$LAST_HASH_VALUE" ]; then
             need_update="false"
@@ -108,11 +127,15 @@ jobs:
             exit 1
           fi
           need_update="true"
+          cache_channel="release"
+          publish_images="true"
         fi
 
         {
           echo "source_sha=$source_sha"
           echo "version_tag=$version_tag"
+          echo "cache_channel=$cache_channel"
+          echo "publish_images=$publish_images"
           echo "need_update=$need_update"
           echo "build_matrix_json<<EOF"
           cat <<'JSON'
@@ -146,6 +169,24 @@ jobs:
           echo "EOF"
         } >> "$GITHUB_OUTPUT"
 
+    - name: Summarize build cache strategy
+      env:
+        CACHE_CHANNEL: ${{ steps.prepare.outputs.cache_channel }}
+      run: |
+        {
+          echo "## PD / Store / Server image build"
+          echo
+          echo "- Cache backend: Docker Hub registry (BuildKit, mode=max)"
+          echo "- Cache channel: \`$CACHE_CHANNEL\`"
+          echo "- Publish images: \`${{ steps.prepare.outputs.publish_images }}\`"
+          echo "- Cache writers: integration precheck and amd64 publish jobs"
+          echo "- Cache reader: arm64 publish jobs"
+          echo "- PD: \`hugegraph/pd:buildcache-$CACHE_CHANNEL\`"
+          echo "- Store: \`hugegraph/store:buildcache-$CACHE_CHANNEL\`"
+          echo "- Server (HStore): \`hugegraph/server:buildcache-$CACHE_CHANNEL\`"
+          echo "- Server (standalone): \`hugegraph/hugegraph:buildcache-$CACHE_CHANNEL\`"
+        } >> "$GITHUB_STEP_SUMMARY"
+
   integration_precheck:
     needs: prepare
     if: ${{ needs.prepare.outputs.need_update == 'true' && inputs.strict_mode }}
@@ -164,7 +205,7 @@ jobs:
         fi
 
     - name: Checkout source
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         repository: ${{ env.REPOSITORY_URL }}
         ref: ${{ env.SOURCE_SHA }}
@@ -194,8 +235,8 @@ jobs:
         platforms: linux/amd64
         load: true
         tags: hg-ci/pd:precheck
-        cache-from: type=gha,scope=pd-store-server-pd-amd64
-        cache-to: type=gha,scope=pd-store-server-pd-amd64,mode=min,ignore-error=true
+        cache-from: type=registry,ref=hugegraph/pd:buildcache-${{ needs.prepare.outputs.cache_channel }}
+        cache-to: ${{ needs.prepare.outputs.publish_images == 'true' && format('type=registry,ref=hugegraph/pd:buildcache-{0},mode=max', needs.prepare.outputs.cache_channel) || '' }}
         build-args: ${{ env.MVN_ARGS }}
 
     - name: Build x86 Store image for integration check
@@ -206,8 +247,8 @@ jobs:
         platforms: linux/amd64
         load: true
         tags: hg-ci/store:precheck
-        cache-from: type=gha,scope=pd-store-server-store-amd64
-        cache-to: type=gha,scope=pd-store-server-store-amd64,mode=min,ignore-error=true
+        cache-from: type=registry,ref=hugegraph/store:buildcache-${{ needs.prepare.outputs.cache_channel }}
+        cache-to: ${{ needs.prepare.outputs.publish_images == 'true' && format('type=registry,ref=hugegraph/store:buildcache-{0},mode=max', needs.prepare.outputs.cache_channel) || '' }}
         build-args: ${{ env.MVN_ARGS }}
 
     - name: Build x86 Server(hstore) image for integration check
@@ -218,8 +259,8 @@ jobs:
         platforms: linux/amd64
         load: true
         tags: hg-ci/server:precheck
-        cache-from: type=gha,scope=pd-store-server-server-hstore-amd64
-        cache-to: type=gha,scope=pd-store-server-server-hstore-amd64,mode=min,ignore-error=true
+        cache-from: type=registry,ref=hugegraph/server:buildcache-${{ needs.prepare.outputs.cache_channel }}
+        cache-to: ${{ needs.prepare.outputs.publish_images == 'true' && format('type=registry,ref=hugegraph/server:buildcache-{0},mode=max', needs.prepare.outputs.cache_channel) || '' }}
         build-args: ${{ env.MVN_ARGS }}
 
     - name: Start compose stack with local images
@@ -290,22 +331,23 @@ jobs:
       SOURCE_SHA: ${{ needs.prepare.outputs.source_sha }}
       VERSION_TAG: ${{ needs.prepare.outputs.version_tag }}
       MVN_ARGS: ${{ inputs.mvn_args }}
+      CACHE_CHANNEL: ${{ needs.prepare.outputs.cache_channel }}
     steps:
     - name: Resolve tags (${{ matrix.module }})
       id: tags
       env:
         IMAGE_REPO: ${{ matrix.image_repo }}
       run: |
         image_amd64="${IMAGE_REPO}:${VERSION_TAG}-amd64"
-        module_cache_scope="pd-store-server-${{ matrix.module }}-amd64"
+        module_cache_ref="${IMAGE_REPO}:buildcache-${CACHE_CHANNEL}"
 
         {
           echo "image_amd64=$image_amd64"
-          echo "module_cache_scope=$module_cache_scope"
+          echo "module_cache_ref=$module_cache_ref"
         } >> "$GITHUB_OUTPUT"
 
     - name: Checkout source (${{ matrix.module }})
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         repository: ${{ env.REPOSITORY_URL }}
         ref: ${{ env.SOURCE_SHA }}
@@ -331,8 +373,8 @@ jobs:
         platforms: linux/amd64
         load: true
         tags: ${{ steps.tags.outputs.image_amd64 }}
-        cache-from: type=gha,scope=${{ steps.tags.outputs.module_cache_scope }}
-        cache-to: type=gha,scope=${{ steps.tags.outputs.module_cache_scope }},mode=min,ignore-error=true
+        cache-from: type=registry,ref=${{ steps.tags.outputs.module_cache_ref }}
+        cache-to: ${{ needs.prepare.outputs.publish_images == 'true' && format('type=registry,ref={0},mode=max', steps.tags.outputs.module_cache_ref) || '' }}
         build-args: ${{ env.MVN_ARGS }}
 
     - name: Build and push amd64 image (${{ matrix.module }})
@@ -342,10 +384,10 @@ jobs:
         context: .
         file: ${{ matrix.dockerfile }}
         platforms: linux/amd64
-        push: true
+        push: ${{ needs.prepare.outputs.publish_images == 'true' }}
         tags: ${{ steps.tags.outputs.image_amd64 }}
-        cache-from: type=gha,scope=${{ steps.tags.outputs.module_cache_scope }}
-        cache-to: type=gha,scope=${{ steps.tags.outputs.module_cache_scope }},mode=min,ignore-error=true
+        cache-from: type=registry,ref=${{ steps.tags.outputs.module_cache_ref }}
+        cache-to: ${{ needs.prepare.outputs.publish_images == 'true' && format('type=registry,ref={0},mode=max', steps.tags.outputs.module_cache_ref) || '' }}
         build-args: ${{ env.MVN_ARGS }}
 
     - name: Smoke test standalone server amd64
@@ -362,7 +404,7 @@ jobs:
         curl -fsS http://127.0.0.1:18080 >/dev/null || exit 1
 
     - name: Push tested amd64 image (${{ matrix.module }})
-      if: ${{ matrix.smoke_test }}
+      if: ${{ matrix.smoke_test && needs.prepare.outputs.publish_images == 'true' }}
       env:
         IMAGE_URL: ${{ steps.tags.outputs.image_amd64 }}
       run: |
@@ -386,22 +428,23 @@ jobs:
       SOURCE_SHA: ${{ needs.prepare.outputs.source_sha }}
       VERSION_TAG: ${{ needs.prepare.outputs.version_tag }}
       MVN_ARGS: ${{ inputs.mvn_args }}
+      CACHE_CHANNEL: ${{ needs.prepare.outputs.cache_channel }}
     steps:
     - name: Resolve tags (${{ matrix.module }})
       id: tags
       env:
         IMAGE_REPO: ${{ matrix.image_repo }}
       run: |
         image_arm64="${IMAGE_REPO}:${VERSION_TAG}-arm64"
-        module_cache_scope="pd-store-server-${{ matrix.module }}-arm64"
+        module_cache_ref="${IMAGE_REPO}:buildcache-${CACHE_CHANNEL}"
 
         {
           echo "image_arm64=$image_arm64"
-          echo "module_cache_scope=$module_cache_scope"
+          echo "module_cache_ref=$module_cache_ref"
         } >> "$GITHUB_OUTPUT"
 
     - name: Checkout source (${{ matrix.module }})
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         repository: ${{ env.REPOSITORY_URL }}
         ref: ${{ env.SOURCE_SHA }}
@@ -427,15 +470,14 @@ jobs:
         context: .
         file: ${{ matrix.dockerfile }}
         platforms: linux/arm64
-        push: true
+        push: ${{ needs.prepare.outputs.publish_images == 'true' }}
         tags: ${{ steps.tags.outputs.image_arm64 }}
-        cache-from: type=gha,scope=${{ steps.tags.outputs.module_cache_scope }}
-        cache-to: type=gha,scope=${{ steps.tags.outputs.module_cache_scope }},mode=min,ignore-error=true
+        cache-from: type=registry,ref=${{ steps.tags.outputs.module_cache_ref }}
         build-args: ${{ env.MVN_ARGS }}
 
   publish_manifest:
     needs: [prepare, publish_amd64, publish_arm64]
-    if: ${{ needs.prepare.outputs.need_update == 'true' && needs.publish_amd64.result == 'success' && needs.publish_arm64.result == 'success' }}
+    if: ${{ needs.prepare.outputs.need_update == 'true' && needs.prepare.outputs.publish_images == 'true' && needs.publish_amd64.result == 'success' && needs.publish_arm64.result == 'success' }}
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -561,7 +603,7 @@ jobs:
 
   update_latest_hash:
     needs: [prepare, publish_manifest]
-    if: ${{ inputs.mode == 'latest' && inputs.enable_hash_gate && needs.prepare.outputs.need_update == 'true' && needs.publish_manifest.result == 'success' }}
+    if: ${{ inputs.mode == 'latest' && inputs.branch == 'master' && inputs.enable_hash_gate && needs.prepare.outputs.need_update == 'true' && needs.publish_manifest.result == 'success' }}
     runs-on: ubuntu-latest
     steps:
     - name: Validate hash update inputs

.github/workflows/publish_latest_hubble_image.yml

@@ -26,6 +26,7 @@ jobs:
             "dockerfile": "./hugegraph-hubble/Dockerfile",
             "image_repo_latest": "hugegraph/hubble",
             "image_repo_release": "hugegraph/hubble",
+            "registry_cache_image": "hugegraph/hubble:buildcache-latest",
             "platforms_latest": "linux/amd64,linux/arm64",
             "platforms_release": "linux/amd64,linux/arm64",
             "smoke_test": false

.github/workflows/publish_latest_pd_store_server_image.yml

@@ -5,6 +5,10 @@ on:
     - cron: '0 23 * * *'
   workflow_dispatch:
     inputs:
+      latest_source_branch:
+        required: false
+        default: 'master'
+        description: 'apache/hugegraph branch to publish as the latest images'
       mvn_args:
         required: false
         default: ''
@@ -29,11 +33,11 @@ jobs:
     with:
       mode: latest
       repository_url: apache/hugegraph
-      branch: master
+      branch: ${{ github.event.inputs.latest_source_branch || 'master' }}
       mvn_args: ${{ github.event.inputs.mvn_args || '' }}
-      strict_mode: ${{ github.event_name != 'workflow_dispatch' || github.event.inputs.strict_mode == true || github.event.inputs.strict_mode == 'true' }}
+      strict_mode: ${{ github.event_name != 'workflow_dispatch' || github.event.inputs.latest_source_branch != 'master' || github.event.inputs.strict_mode == true || github.event.inputs.strict_mode == 'true' }}
       wait_timeout_sec: ${{ github.event.inputs.wait_timeout_sec || '300' }}
-      enable_hash_gate: true
+      enable_hash_gate: ${{ github.event_name != 'workflow_dispatch' || github.event.inputs.latest_source_branch == 'master' }}
       last_hash_value: ${{ vars.LAST_SERVER_HASH }}
       last_hash_name: LAST_SERVER_HASH
       hash_repo_owner: hugegraph

.github/workflows/publish_release_hubble_image.yml

@@ -28,6 +28,7 @@ jobs:
             "dockerfile": "./hugegraph-hubble/Dockerfile",
             "image_repo_latest": "hugegraph/hubble",
             "image_repo_release": "hugegraph/hubble",
+            "registry_cache_image": "hugegraph/hubble:buildcache-release",
             "platforms_latest": "linux/amd64,linux/arm64",
             "platforms_release": "linux/amd64,linux/arm64",
             "smoke_test": false