From 291b3398fd42d9540a04c361f2c1a8226d151ee3 Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Sun, 8 Mar 2026 17:10:37 -0700
Subject: [PATCH] CI: cache Docker builds in workflows

---
 .github/workflows/docker-release.yml       |  8 +++++++
 .github/workflows/sandbox-common-smoke.yml | 28 +++++++++++++++-------
 2 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index 2cc29748c91..f991b7f8653 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -109,6 +109,8 @@ jobs:
           labels: ${{ steps.labels.outputs.value }}
           provenance: false
           push: true
+          cache-from: type=gha,scope=docker-release-amd64
+          cache-to: type=gha,mode=max,scope=docker-release-amd64
 
       - name: Build and push amd64 slim image
         id: build-slim
@@ -122,6 +124,8 @@ jobs:
           labels: ${{ steps.labels.outputs.value }}
           provenance: false
           push: true
+          cache-from: type=gha,scope=docker-release-amd64
+          cache-to: type=gha,mode=max,scope=docker-release-amd64
 
   # Build arm64 images (default + slim share the build stage cache)
   build-arm64:
@@ -210,6 +214,8 @@ jobs:
           labels: ${{ steps.labels.outputs.value }}
           provenance: false
           push: true
+          cache-from: type=gha,scope=docker-release-arm64
+          cache-to: type=gha,mode=max,scope=docker-release-arm64
 
       - name: Build and push arm64 slim image
         id: build-slim
@@ -223,6 +229,8 @@ jobs:
           labels: ${{ steps.labels.outputs.value }}
           provenance: false
           push: true
+          cache-from: type=gha,scope=docker-release-arm64
+          cache-to: type=gha,mode=max,scope=docker-release-arm64
 
   # Create multi-platform manifests
   create-manifest:
diff --git a/.github/workflows/sandbox-common-smoke.yml b/.github/workflows/sandbox-common-smoke.yml
index 13688bd0f25..0102479cb7d 100644
--- a/.github/workflows/sandbox-common-smoke.yml
+++ b/.github/workflows/sandbox-common-smoke.yml
@@ -34,7 +34,12 @@ jobs:
         run: |
           set -euo pipefail
 
-          docker build -t openclaw-sandbox-smoke-base:bookworm-slim - <<'EOF'
+          docker buildx build \
+            --load \
+            --tag openclaw-sandbox-smoke-base:bookworm-slim \
+            --cache-from type=gha,scope=sandbox-common-smoke-base \
+            --cache-to type=gha,mode=max,scope=sandbox-common-smoke-base \
+            - <<'EOF'
           FROM debian:bookworm-slim
           RUN useradd --create-home --shell /bin/bash sandbox
           USER sandbox
@@ -46,14 +51,19 @@ jobs:
         run: |
           set -euo pipefail
 
-          BASE_IMAGE="openclaw-sandbox-smoke-base:bookworm-slim" \
-            TARGET_IMAGE="openclaw-sandbox-common-smoke:bookworm-slim" \
-            PACKAGES="ca-certificates" \
-            INSTALL_PNPM=0 \
-            INSTALL_BUN=0 \
-            INSTALL_BREW=0 \
-            FINAL_USER=sandbox \
-            scripts/sandbox-common-setup.sh
+          docker buildx build \
+            --load \
+            --tag openclaw-sandbox-common-smoke:bookworm-slim \
+            --file Dockerfile.sandbox-common \
+            --build-arg BASE_IMAGE=openclaw-sandbox-smoke-base:bookworm-slim \
+            --build-arg PACKAGES=ca-certificates \
+            --build-arg INSTALL_PNPM=0 \
+            --build-arg INSTALL_BUN=0 \
+            --build-arg INSTALL_BREW=0 \
+            --build-arg FINAL_USER=sandbox \
+            --cache-from type=gha,scope=sandbox-common-smoke \
+            --cache-to type=gha,mode=max,scope=sandbox-common-smoke \
+            .
 
           u="$(docker run --rm openclaw-sandbox-common-smoke:bookworm-slim sh -lc 'id -un')"
           test "$u" = "sandbox"