fix: disable docker cache on base image build

[wyattwalter]

Description

Tip

Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team).

Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR.

Disable cache for the base image build. This job doesn't need to be fast and sometimes we're not picking up CVE fixes as quickly as we could because layers are cached for a while.

Fixes #Issue Number
or
Fixes Issue URL

Warning

If no issue exists, please create an issue first, and check with the maintainers if the issue is valid.

Automation

/ok-to-test tags=""

🔍 Cypress test results

Caution

If you modify the content in this section, you are likely to disrupt the CI result for your PR.

Communication

Should the DevRel and Marketing teams inform users about this change?

• Yes
• No

Summary by CodeRabbit

• Chores
  • Updated CI/CD pipeline to ensure fresh package dependencies on each build cycle.

[coderabbitai]

Walkthrough

A single configuration change adds no-cache: true to the Docker base image build step in the GitHub Actions workflow. This forces Docker to bypass layer caching and retrieve fresh OS packages on each pipeline execution.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflow Configuration .github/workflows/docker-base-image.yml	Added no-cache: true flag to the "Build and push base image" step with accompanying comment to disable Docker layer caching for fresh package retrieval

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐳 No cache, no tricks, just layers anew,
Fresh packages arrive with each Docker brew,
Old images fade in the CI's light,
Docker rebuilds with appetite.

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: disabling Docker cache for the base image build, which is the core modification in the workflow file.
Description check	✅ Passed	The description provides context for the change (CVE fixes delayed by caching) and includes the template structure, though the issue reference field is not completed.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch ww-base-image-disable-cache

---

📜 Recent review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 4583e46 and 3887ac6.

📒 Files selected for processing (1)

• .github/workflows/docker-base-image.yml (1 hunks)

🧰 Additional context used

🧠 Learnings (1)

📓 Common learnings

Learnt from: Aishwarya-U-R
Repo: appsmithorg/appsmith PR: 29405
File: app/client/cypress/e2e/Regression/ClientSide/Binding/TableV2_Widget_API_Pagination_spec.js:37-41
Timestamp: 2024-10-08T15:32:39.374Z
Learning: The pull request titled "test: Cypress | Replace static with Dynamic waits - Part 1" is part of a phased approach where only certain test specifications are targeted for static wait removal in the initial phase. Future phases will address additional specs.

Learnt from: Aishwarya-U-R
Repo: appsmithorg/appsmith PR: 29405
File: app/client/cypress/e2e/Regression/ClientSide/Binding/TableV2_Widget_API_Pagination_spec.js:37-41
Timestamp: 2024-07-26T21:12:57.228Z
Learning: The pull request titled "test: Cypress | Replace static with Dynamic waits - Part 1" is part of a phased approach where only certain test specifications are targeted for static wait removal in the initial phase. Future phases will address additional specs.

🔇 Additional comments (1)

.github/workflows/docker-base-image.yml (1)

58-59: Change verified—no-cache: true parameter is correctly formatted for depot/build-push-action.

The no-cache input is a valid Boolean parameter that disables use of the build cache (default: false). Your implementation matches the documented usage, and the trade-off between increased build time and fresh OS packages aligns with your security objectives.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}