fix(docker): split push vs PR targets, drop redundant source

Two fixes:

1. The push and PR jobs were sharing the same bake target, so the PR
   job was also exporting cache via 'cache-to = type=gha,mode=max'.
   Fork PRs lack permission to write to the GHA cache, which would fail
   the required build check. Split the bake file into two targets:
     - synapse-website: full config including cache-to (push job)
     - synapse-website-pr: same minus cache-to (PR job)

2. The workflow passed 'source: website' to bake-action plus a relative
   file path 'docker-bake.hcl', but bake-action runs docker buildx from
   the action's working directory (the repo root) and does not change
   cwd when 'source' is set — 'source' only maps to --context. So
   'docker-bake.hcl' resolved against the repo root and didn't exist.
   Drop 'source' from both jobs and use the full relative path
   'website/docker-bake.hcl' in 'files'. Each target now sets its own
   context = 'website', so --context is still correct.

Also dropped metadata-action's bake-file output from the bake inputs;
tags and labels are already passed directly via the action's
'tags' / 'labels' inputs, so the second --file was redundant.

Verified locally:
  docker buildx bake --file website/docker-bake.hcl --print synapse-website
  docker buildx bake --file website/docker-bake.hcl --print synapse-website-pr
both produce the expected plans from the repo root.

Author: IamCoder18

.github/workflows/docker.yml

@@ -23,7 +23,7 @@ jobs:
     name: Build & push image
     runs-on: ubuntu-latest
     # Publish only on direct pushes to main or on v* tags. PRs run the
-    # build-pr job (push: false) below.
+    # build-pr job (push: false, no cache-to) below.
     if: github.event_name != 'pull_request'
     permissions:
       contents: read
@@ -53,19 +53,16 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=sha,format=short
             type=raw,value=latest,enable={{is_default_branch}}
-          bake-target: synapse-website
 
       - name: Build and push
         uses: docker/bake-action@v5
         with:
-          # `source` is the build context that the bake target's
-          # context="." resolves to. Bake definition file paths are
-          # resolved relative to this directory, so `docker-bake.hcl`
-          # (not `website/docker-bake.hcl`).
-          source: website
+          # `files` paths are resolved relative to the action's working
+          # directory (the repo root after checkout). The bake target's
+          # own `context` controls where the Dockerfile and source files
+          # are read from.
           files: |
-            docker-bake.hcl
-            ${{ steps.meta.outputs.bake-file }}
+            website/docker-bake.hcl
           targets: synapse-website
           push: true
           tags: ${{ steps.meta.outputs.tags }}
@@ -87,8 +84,9 @@ jobs:
       - name: Build
         uses: docker/bake-action@v5
         with:
-          source: website
           files: |
-            docker-bake.hcl
-          targets: synapse-website
+            website/docker-bake.hcl
+          # Use the dedicated PR target, which omits `cache-to` because
+          # fork PRs lack permission to write to the GHA cache.
+          targets: synapse-website-pr
           push: false

website/docker-bake.hcl

@@ -1,15 +1,27 @@
 # Build targets consumed by docker/bake-action (see .github/workflows/docker.yml).
-# Defining the build here keeps the Dockerfile, tags, cache config, and platform
-# declarations in one file under the website/ source tree.
+# Defining the build here keeps the Dockerfile, tags, cache config, and
+# platform declarations in one file under the website/ source tree.
+#
+# The PR build target omits `cache-to` because fork pull requests don't have
+# permission to write to the GHA cache; trying to export there fails the
+# required check.
 group "default" {
     targets = ["synapse-website"]
 }
 
 target "synapse-website" {
-    context = "."
+    context = "website"
     dockerfile = "Dockerfile"
     platforms = ["linux/amd64", "linux/arm64"]
     cache-from = ["type=gha"]
     cache-to   = ["type=gha,mode=max"]
     tags       = [""]
 }
+
+target "synapse-website-pr" {
+    context = "website"
+    dockerfile = "Dockerfile"
+    platforms = ["linux/amd64", "linux/arm64"]
+    cache-from = ["type=gha"]
+    tags       = [""]
+}