feat: enable Turbo remote cache in Docker builds

.dockerignore

@@ -20,3 +20,16 @@ typescript/**/tsconfig.tsbuildinfo
 pnpm-debug.log*
 
 .idea
+
+# === Additional exclusions for smaller Docker context ===
+# Note: .git/ is NOT excluded because rust/Dockerfile needs it for vergen build-time info
+.github/
+.changeset/
+.vscode/
+.turbo/
+.nyc_output/
+coverage/
+docs/
+*.log
+junit.xml
+.eslintcache

.github/workflows/ccip-server-docker.yml

@@ -111,6 +111,9 @@ jobs:
           build-args: |
             FOUNDRY_VERSION=${{ steps.foundry-version.outputs.FOUNDRY_VERSION }}
             SERVICE_VERSION=${{ steps.taggen.outputs.TAG_SHA }}-${{ steps.taggen.outputs.TAG_DATE }}
+            TURBO_TEAM=${{ secrets.DEPOT_ORG_ID }}
+          secrets: |
+            TURBO_TOKEN=${{ secrets.DEPOT_TURBO_TOKEN }}
 
       - name: Comment image tags on PR
         if: github.event_name == 'pull_request'

.github/workflows/monorepo-docker.yml

@@ -128,6 +128,9 @@ jobs:
           build-args: |
             FOUNDRY_VERSION=${{ env.FOUNDRY_VERSION }}
             REGISTRY_COMMIT=${{ env.REGISTRY_VERSION }}
+            TURBO_TEAM=${{ secrets.DEPOT_ORG_ID }}
+          secrets: |
+            TURBO_TOKEN=${{ secrets.DEPOT_TURBO_TOKEN }}
           platforms: ${{ steps.determine-platforms.outputs.platforms }}
 
       - name: Comment image tags on PR

.github/workflows/rebalancer-docker.yml

@@ -111,6 +111,9 @@ jobs:
           build-args: |
             FOUNDRY_VERSION=${{ steps.foundry-version.outputs.FOUNDRY_VERSION }}
             SERVICE_VERSION=${{ steps.taggen.outputs.TAG_SHA }}-${{ steps.taggen.outputs.TAG_DATE }}
+            TURBO_TEAM=${{ secrets.DEPOT_ORG_ID }}
+          secrets: |
+            TURBO_TOKEN=${{ secrets.DEPOT_TURBO_TOKEN }}
 
       - name: Comment image tags on PR
         if: github.event_name == 'pull_request'

.github/workflows/warp-monitor-docker.yml

@@ -111,6 +111,9 @@ jobs:
           build-args: |
             FOUNDRY_VERSION=${{ steps.foundry-version.outputs.FOUNDRY_VERSION }}
             SERVICE_VERSION=${{ steps.taggen.outputs.TAG_SHA }}-${{ steps.taggen.outputs.TAG_DATE }}
+            TURBO_TEAM=${{ secrets.DEPOT_ORG_ID }}
+          secrets: |
+            TURBO_TOKEN=${{ secrets.DEPOT_TURBO_TOKEN }}
 
       - name: Comment image tags on PR
         if: github.event_name == 'pull_request'

Dockerfile

@@ -55,7 +55,14 @@ COPY solidity ./solidity
 COPY solhint-plugin ./solhint-plugin
 COPY starknet ./starknet
 
-RUN pnpm build
+# Build with Turbo remote cache (secret mounted for security)
+ARG TURBO_TEAM
+RUN --mount=type=secret,id=TURBO_TOKEN \
+    TURBO_TOKEN=$(cat /run/secrets/TURBO_TOKEN 2>/dev/null || echo "") \
+    TURBO_API=https://cache.depot.dev \
+    TURBO_TEAM=${TURBO_TEAM} \
+    TURBO_TELEMETRY_DISABLED=1 \
+    pnpm build
 
 # Baked-in registry version
 # keep for back-compat until we update all usage of the monorepo image (e.g. key-funder)

rust/.dockerignore

@@ -1 +1,6 @@
-**/target
+**/target
+.github/
+*.md
+docs/
+.vscode/
+.idea/

typescript/ccip-server/Dockerfile

@@ -71,7 +71,13 @@ COPY solhint-plugin ./solhint-plugin
 COPY starknet ./starknet
 
 # Build the ccip-server
-RUN pnpm turbo run build --filter=@hyperlane-xyz/ccip-server
+ARG TURBO_TEAM
+RUN --mount=type=secret,id=TURBO_TOKEN \
+    TURBO_TOKEN=$(cat /run/secrets/TURBO_TOKEN 2>/dev/null || echo "") \
+    TURBO_API=https://cache.depot.dev \
+    TURBO_TEAM=${TURBO_TEAM} \
+    TURBO_TELEMETRY_DISABLED=1 \
+    pnpm turbo run build --filter=@hyperlane-xyz/ccip-server
 
 # Create standalone deployment with resolved dependencies (no symlinks)
 # --legacy flag required for pnpm v10+ without inject-workspace-packages

typescript/rebalancer/Dockerfile

@@ -62,7 +62,13 @@ COPY solhint-plugin ./solhint-plugin
 COPY starknet ./starknet
 
 # Build and bundle the rebalancer (ncc creates a single-file bundle with all deps)
-RUN pnpm turbo run bundle --filter=@hyperlane-xyz/rebalancer
+ARG TURBO_TEAM
+RUN --mount=type=secret,id=TURBO_TOKEN \
+    TURBO_TOKEN=$(cat /run/secrets/TURBO_TOKEN 2>/dev/null || echo "") \
+    TURBO_API=https://cache.depot.dev \
+    TURBO_TEAM=${TURBO_TEAM} \
+    TURBO_TELEMETRY_DISABLED=1 \
+    pnpm turbo run bundle --filter=@hyperlane-xyz/rebalancer
 
 # Production stage - minimal Alpine image with just the bundled code
 FROM node:20-alpine AS runner

typescript/warp-monitor/Dockerfile

@@ -62,7 +62,13 @@ COPY solhint-plugin ./solhint-plugin
 COPY starknet ./starknet
 
 # Build and bundle the warp-monitor (ncc creates a single-file bundle with all deps)
-RUN pnpm turbo run bundle --filter=@hyperlane-xyz/warp-monitor
+ARG TURBO_TEAM
+RUN --mount=type=secret,id=TURBO_TOKEN \
+    TURBO_TOKEN=$(cat /run/secrets/TURBO_TOKEN 2>/dev/null || echo "") \
+    TURBO_API=https://cache.depot.dev \
+    TURBO_TEAM=${TURBO_TEAM} \
+    TURBO_TELEMETRY_DISABLED=1 \
+    pnpm turbo run bundle --filter=@hyperlane-xyz/warp-monitor
 
 # Production stage - minimal Alpine image with just the bundled code
 FROM node:20-alpine AS runner