Merge pull request #1006 from akunzai/ci/e2e-faster

ci(e2e): pin tags, GHA cache warm, deepen Docker layers

Author: akunzai

.devcontainer/Dockerfile

@@ -1,15 +1,25 @@
+# -----------------------------------------------------------------------------
+# Base stage: ASP.NET LTS runtime assets
+# -----------------------------------------------------------------------------
 FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS dotnet-lts-runtime
 
+# -----------------------------------------------------------------------------
+# Runtime stage: .NET 10.0 SDK + Playwright system dependencies
+# -----------------------------------------------------------------------------
 # https://hub.docker.com/_/microsoft-dotnet-sdk/
 # Using Debian-based image for better Playwright browser support
-FROM mcr.microsoft.com/dotnet/sdk:10.0
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS dotnet-sdk
 
 # install ASP.NET Core 8.0 Runtime
 COPY --from=dotnet-lts-runtime /usr/share/dotnet /usr/share/dotnet
 
 # Install Playwright dependencies
 # https://playwright.dev/dotnet/docs/intro#system-requirements
-RUN apt-get update && apt-get install -y --no-install-recommends \
+# hadolint ignore=DL3008
+RUN --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
+    --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    set -eux; \
+    apt-get update && apt-get install -y --no-install-recommends \
     libnss3 \
     libnspr4 \
     libatk1.0-0 \
@@ -25,5 +35,5 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libasound2t64 \
     libpango-1.0-0 \
     libcairo2 \
-    libatspi2.0-0 \
-    && rm -rf /var/lib/apt/lists/*
+    libatspi2.0-0; \
+    rm -rf /tmp/*;

.devcontainer/compose.yaml

@@ -47,8 +47,8 @@ services:
           - auth.dev.local
 
   redis:
-    # https://hub.docker.com/_/redis
-    image: redis
+    # https://hub.docker.com/_/redis — pin major tag for reproducible CI pulls / cache hits
+    image: redis:8-alpine
     volumes:
       - type: volume
         source: redis_data
@@ -64,4 +64,4 @@ secrets:
 
 volumes:
     keycloak_data:
-    redis_data:
+    redis_data:

.devcontainer/docker-bake.hcl

@@ -0,0 +1,32 @@
+// Local parallel multi-target builds:
+//   docker buildx bake -f docker-bake.hcl --load
+//
+// CI uses docker/build-push-action with type=gha (see .github/workflows/e2e-tests.yml).
+
+variable "KEYCLOAK_VERSION" {
+  default = "26.6.4"
+}
+
+variable "KEYCLOAK_CAS_VERSION" {
+  default = "26.6.4"
+}
+
+group "default" {
+  targets = ["keycloak", "dotnet"]
+}
+
+target "keycloak" {
+  context    = "./keycloak"
+  dockerfile = "Dockerfile"
+  tags       = ["keycloak:cas"]
+  args = {
+    KEYCLOAK_VERSION     = KEYCLOAK_VERSION
+    KEYCLOAK_CAS_VERSION = KEYCLOAK_CAS_VERSION
+  }
+}
+
+target "dotnet" {
+  context    = "."
+  dockerfile = "Dockerfile"
+  tags       = ["dotnet-sdk:latest"]
+}

.devcontainer/keycloak/Dockerfile

@@ -10,4 +10,6 @@ ARG KEYCLOAK_CAS_VERSION
 # https://github.com/jacekkow/keycloak-protocol-cas
 ADD --chown=keycloak:keycloak https://github.com/jacekkow/keycloak-protocol-cas/releases/download/${KEYCLOAK_CAS_VERSION}/keycloak-protocol-cas-${KEYCLOAK_CAS_VERSION}.jar /opt/keycloak/providers/keycloak-protocol-cas.jar
 
-WORKDIR /opt/keycloak
+WORKDIR /opt/keycloak
+
+RUN /opt/keycloak/bin/kc.sh build --health-enabled=true

.github/workflows/e2e-image-cache.yml

@@ -0,0 +1,43 @@
+# Warm GHA BuildKit caches for e2e custom images on main so new PRs can
+# cache-from on their first run (PR jobs may restore caches from the default branch).
+# Scopes must match .github/workflows/e2e-tests.yml (keycloak).
+name: E2E Image Cache
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '.devcontainer/keycloak/**'
+      - '.devcontainer/Dockerfile'
+      - '.github/workflows/e2e-image-cache.yml'
+      - '.github/workflows/e2e-tests.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  actions: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  warm-keycloak:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    name: Warm Keycloak cache
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      # No load/push — only export type=gha layers for PR e2e cache-from.
+      - name: Build Keycloak image (cache export)
+        uses: docker/build-push-action@v7
+        with:
+          context: .devcontainer/keycloak
+          cache-from: type=gha,scope=keycloak
+          cache-to: type=gha,mode=max,scope=keycloak

.github/workflows/e2e-tests.yml

@@ -37,7 +37,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions: read-all
+permissions:
+  contents: read
+  # buildx type=gha cache-to needs write on private repos; harmless on public
+  actions: write
 
 jobs:
   build:
@@ -117,6 +120,15 @@ jobs:
         if: steps.check.outputs.run == 'true'
         uses: docker/setup-buildx-action@v4
 
+      # type=gha only persists reliably via docker/build-push-action (or bake-action).
+      # Scopes match .github/workflows/e2e-image-cache.yml (main warms caches for
+      # first-run PRs; PR jobs can restore from the default branch).
+      - name: Pull service images
+        if: steps.check.outputs.run == 'true'
+        working-directory: .devcontainer
+        # Tags come from compose.yaml (SSOT); only Hub services — not keycloak.
+        run: docker compose pull redis
+
       - name: Build Keycloak image with CAS protocol
         if: steps.check.outputs.run == 'true'
         uses: docker/build-push-action@v7
@@ -125,8 +137,8 @@ jobs:
           tags: keycloak:cas
           push: false
           load: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=keycloak
+          cache-to: type=gha,scope=keycloak,mode=max
 
       - name: Start Keycloak
         if: steps.check.outputs.run == 'true'

.markdownlint-cli2.jsonc

@@ -5,6 +5,9 @@
   },
   "ignores": [
     "**/AGENTS.md",
-    "**/CLAUDE.md"
+    "**/CLAUDE.md",
+    "**/node_modules/**",
+    "**/bin/**",
+    "**/obj/**"
   ]
 }