Publish authoritative caches before optional CI snapshot execution

The snapshot script runs checkout code and prunes Docker state. Existing cache publications must finish before that optional execution.

Author: zozo123

.github/workflows/ci-image-build.yml

@@ -321,6 +321,60 @@ jobs:
           docker rmi "${CACHE_FROM_IMAGE}"
         shell: bash
         if: always() && env.CACHE_FROM_IMAGE != ''
+      # zstd stands in for the stash's zlib (compression-level 0 below), which every consumer inflates.
+      # The .tar name, which every Breeze expects, stays: docker image load detects zstd by content.
+      - name: "Export CI docker image ${{ env.PYTHON_MAJOR_MINOR_VERSION }}"
+        env:
+          PLATFORM: ${{ inputs.platform }}
+          COMMIT_FILE: "/mnt/ci-image-commit-${{ env.PYTHON_MAJOR_MINOR_VERSION }}.txt"
+        run: |
+          breeze ci-image save --platform "${PLATFORM}" --image-file-dir "/mnt"
+          for image_file in /mnt/ci-image-save-*-"${PYTHON_MAJOR_MINOR_VERSION}".tar; do
+            zstd -6 -T0 --rm -o "${image_file}.zst" "${image_file}"
+            mv "${image_file}.zst" "${image_file}"
+          done
+          git rev-parse HEAD > "${COMMIT_FILE}"
+        shell: bash
+        if: inputs.upload-image-artifact == 'true' && steps.stashed-image.outputs.reusable != 'true'
+      - name: "Stash CI docker image ${{ env.PYTHON_MAJOR_MINOR_VERSION }}"
+        uses: apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0  # save/v1.0.0
+        with:
+          key: ci-image-save-v3-${{ inputs.platform }}-${{ env.PYTHON_MAJOR_MINOR_VERSION }}
+          path: "/mnt/ci-image-save-*-${{ env.PYTHON_MAJOR_MINOR_VERSION }}.tar"
+          if-no-files-found: 'error'
+          compression-level: '0'
+          retention-days: '2'
+        if: inputs.upload-image-artifact == 'true' && inputs.image-stash-ref == ''
+      # The per-branch stash above is written by every build on this branch, so an image built
+      # from a ref other than the branch tip cannot live there: whoever restores it next would
+      # get sources they never asked for. The ref keeps its own stash instead, which is also
+      # what a later publish of that same ref reads - hence a retention that outlives the shared
+      # one, the same ref being rebuilt three days apart at the very least.
+      - name: "Stash CI docker image built for ref ${{ inputs.image-stash-ref }}"
+        uses: apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0  # save/v1.0.0
+        with:
+          key: "ci-image-save-v3-${{ inputs.platform }}-${{ env.PYTHON_MAJOR_MINOR_VERSION }}\
+            -${{ inputs.image-stash-ref }}"
+          path: "/mnt/ci-image-save-*-${{ env.PYTHON_MAJOR_MINOR_VERSION }}.tar"
+          if-no-files-found: 'error'
+          compression-level: '0'
+          retention-days: '6'
+        if: >
+          inputs.upload-image-artifact == 'true' && inputs.image-stash-ref != '' &&
+          steps.stashed-image.outputs.reusable != 'true'
+      # Saved last and with the image's retention, so that finding this commit is enough to
+      # know the image it describes is there to be restored.
+      - name: "Stash the commit the CI image for ref ${{ inputs.image-stash-ref }} was built from"
+        uses: apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0  # save/v1.0.0
+        with:
+          key: "ci-image-commit-v3-${{ inputs.platform }}-${{ env.PYTHON_MAJOR_MINOR_VERSION }}\
+            -${{ inputs.image-stash-ref }}"
+          path: "/mnt/ci-image-commit-${{ env.PYTHON_MAJOR_MINOR_VERSION }}.txt"
+          if-no-files-found: 'error'
+          retention-days: '6'
+        if: >
+          inputs.upload-image-artifact == 'true' && inputs.image-stash-ref != '' &&
+          steps.stashed-image.outputs.reusable != 'true'
       - name: "Export mount cache ${{ inputs.platform }}:${{ env.PYTHON_MAJOR_MINOR_VERSION }}"
         env:
           PYTHON_MAJOR_MINOR_VERSION: ${{ env.PYTHON_MAJOR_MINOR_VERSION }}
@@ -345,10 +399,10 @@ jobs:
         if: >
           inputs.upload-mount-cache-artifact == 'true' &&
           steps.stashed-image.outputs.reusable != 'true'
-      # Every job that prepares the CI image would otherwise `docker image load` the stash below,
+      # Every job that prepares the CI image would otherwise `docker image load` the image stash,
       # unpacking and checksumming each layer again; a copy of the image store restores with one
-      # extraction. Taken while the freshly built layers are still in the page cache, and after the
-      # mount cache export, as it drops the build cache that the export reads.
+      # extraction. Run after the authoritative image and mount-cache publications: snapshot
+      # creation prunes the build cache and must not affect the artifacts those steps publish.
       # Snapshots are handoffs within this run, not branch caches. An arbitrary checkout ref
       # must not publish raw daemon state for a later run on the default branch.
       - name: "Snapshot CI image ${{ inputs.platform }}:${{ env.PYTHON_MAJOR_MINOR_VERSION }}"
@@ -379,59 +433,5 @@ jobs:
           github.event_name == 'pull_request' && steps.snapshot-export.outcome == 'success' &&
           inputs.upload-image-artifact == 'true' && inputs.image-stash-ref == '' &&
           steps.stashed-image.outputs.reusable != 'true'
-      # zstd stands in for the stash's zlib (compression-level 0 below), which every consumer inflates.
-      # The .tar name, which every Breeze expects, stays: docker image load detects zstd by content.
-      - name: "Export CI docker image ${{ env.PYTHON_MAJOR_MINOR_VERSION }}"
-        env:
-          PLATFORM: ${{ inputs.platform }}
-          COMMIT_FILE: "/mnt/ci-image-commit-${{ env.PYTHON_MAJOR_MINOR_VERSION }}.txt"
-        run: |
-          breeze ci-image save --platform "${PLATFORM}" --image-file-dir "/mnt"
-          for image_file in /mnt/ci-image-save-*-"${PYTHON_MAJOR_MINOR_VERSION}".tar; do
-            zstd -6 -T0 --rm -o "${image_file}.zst" "${image_file}"
-            mv "${image_file}.zst" "${image_file}"
-          done
-          git rev-parse HEAD > "${COMMIT_FILE}"
-        shell: bash
-        if: inputs.upload-image-artifact == 'true' && steps.stashed-image.outputs.reusable != 'true'
-      - name: "Stash CI docker image ${{ env.PYTHON_MAJOR_MINOR_VERSION }}"
-        uses: apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0  # save/v1.0.0
-        with:
-          key: ci-image-save-v3-${{ inputs.platform }}-${{ env.PYTHON_MAJOR_MINOR_VERSION }}
-          path: "/mnt/ci-image-save-*-${{ env.PYTHON_MAJOR_MINOR_VERSION }}.tar"
-          if-no-files-found: 'error'
-          compression-level: '0'
-          retention-days: '2'
-        if: inputs.upload-image-artifact == 'true' && inputs.image-stash-ref == ''
-      # The per-branch stash above is written by every build on this branch, so an image built
-      # from a ref other than the branch tip cannot live there: whoever restores it next would
-      # get sources they never asked for. The ref keeps its own stash instead, which is also
-      # what a later publish of that same ref reads - hence a retention that outlives the shared
-      # one, the same ref being rebuilt three days apart at the very least.
-      - name: "Stash CI docker image built for ref ${{ inputs.image-stash-ref }}"
-        uses: apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0  # save/v1.0.0
-        with:
-          key: "ci-image-save-v3-${{ inputs.platform }}-${{ env.PYTHON_MAJOR_MINOR_VERSION }}\
-            -${{ inputs.image-stash-ref }}"
-          path: "/mnt/ci-image-save-*-${{ env.PYTHON_MAJOR_MINOR_VERSION }}.tar"
-          if-no-files-found: 'error'
-          compression-level: '0'
-          retention-days: '6'
-        if: >
-          inputs.upload-image-artifact == 'true' && inputs.image-stash-ref != '' &&
-          steps.stashed-image.outputs.reusable != 'true'
-      # Saved last and with the image's retention, so that finding this commit is enough to
-      # know the image it describes is there to be restored.
-      - name: "Stash the commit the CI image for ref ${{ inputs.image-stash-ref }} was built from"
-        uses: apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0  # save/v1.0.0
-        with:
-          key: "ci-image-commit-v3-${{ inputs.platform }}-${{ env.PYTHON_MAJOR_MINOR_VERSION }}\
-            -${{ inputs.image-stash-ref }}"
-          path: "/mnt/ci-image-commit-${{ env.PYTHON_MAJOR_MINOR_VERSION }}.txt"
-          if-no-files-found: 'error'
-          retention-days: '6'
-        if: >
-          inputs.upload-image-artifact == 'true' && inputs.image-stash-ref != '' &&
-          steps.stashed-image.outputs.reusable != 'true'
       - name: "Check disk space after build"
         run: df -H