From e5791b9a91adfb57ce660238b492979e127366d8 Mon Sep 17 00:00:00 2001
From: OG T <ogt@WOOOMacMiniM4.local>
Date: Sun, 12 Apr 2026 19:23:50 +0800
Subject: [PATCH] =?UTF-8?q?perf(cd):=20=E6=81=A2=E5=BE=A9=20CACHE=5FBUST?=
 =?UTF-8?q?=20=E6=96=B9=E6=A1=88=EF=BC=8C=E9=82=84=E5=8E=9F=205m50s=20Web?=
 =?UTF-8?q?=20build?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

實測結果：
- --no-cache: 10m50s（最慢）
- buildx registry cache: 不相容（docker driver 限制）
- CACHE_BUST=git_sha + inline cache: 5m50s（最快且安全）

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitea/workflows/cd.yaml | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index 42349331..87b26386 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -193,15 +193,21 @@ jobs:
 
       # 2026-03-31 ogt: 移除中間通知，減少訊息雜訊
 
-      # ── Web 鏡像建置（強制重建，禁止快取）──────────────────────────────
+      # ── Web 鏡像建置（精準快取失效）──────────────────────────────
       # 2026-03-30 ogt: NEXT_PUBLIC_* 必須用公網域名 (build-time 寫死)
-      # 2026-04-12 ogt: 還原 --no-cache（ADR-045 / feedback_docker_buildkit_cache_poisoning）
-      #   buildx registry cache-to + --output type=docker 不相容（docker driver 限制）
-      #   Web bundle 禁用快取：快取毒化會讓舊 bundle 進生產，風險遠高於速度損失
+      # 2026-04-01 Claude Code: CACHE_BUST=git_sha 取代 --no-cache
+      # - deps 層 (pnpm install) 仍可 cache → 節省 ~2-3 min
+      # - COPY . . 以下由 CACHE_BUST 強制失效 → 業務邏輯/CSRF 等變更正確進入 bundle
+      # 2026-04-12 ogt: 實測 --no-cache=10m50s；CACHE_BUST=5m50s，恢復此方案
       - name: Build and Push Web
+        env:
+          DOCKER_BUILDKIT: "1"
         run: |
-          docker build --no-cache -f apps/web/Dockerfile \
+          docker build -f apps/web/Dockerfile \
             --build-arg NEXT_PUBLIC_API_URL=https://awoooi.wooo.work \
+            --build-arg CACHE_BUST=${{ github.sha }} \
+            --build-arg BUILDKIT_INLINE_CACHE=1 \
+            --cache-from ${{ env.HARBOR }}/awoooi/web:latest \
             -t ${{ env.HARBOR }}/awoooi/web:${{ github.sha }} \
             -t ${{ env.HARBOR }}/awoooi/web:latest \
             .