Cache pre-pulled container images in CI workflows

Use skopeo to query remote digests and key the GHA cache
on actual image content. On cache hit, podman load replaces
network pulls.

Assisted-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: alicefr

.github/workflows/integration-tests.yml

@@ -10,6 +10,16 @@ concurrency:
   group: integration-${{ github.head_ref || github.ref }}
   cancel-in-progress: true
 
+env:
+  BINK_IMAGES: >-
+    ghcr.io/alicefr/bink/cluster:latest
+    ghcr.io/alicefr/bink/node:v1.35-fedora-44-disk
+    ghcr.io/alicefr/bink/dns:latest
+  EXTERNAL_IMAGES: >-
+    docker.io/library/registry:2
+    docker.io/library/haproxy:lts-alpine
+    quay.io/libpod/busybox:latest
+
 jobs:
   integration-tests:
     runs-on: ubuntu-latest
@@ -80,14 +90,42 @@ jobs:
           df -h /
           free -h
 
+      - name: Get image digests
+        id: digests
+        run: |
+          ALL_DIGESTS=""
+          for img in $BINK_IMAGES $EXTERNAL_IMAGES; do
+            digest=$(skopeo inspect --no-creds "docker://${img}" --format '{{.Digest}}')
+            echo "${img}: ${digest}"
+            ALL_DIGESTS="${ALL_DIGESTS}${digest}"
+          done
+          echo "hash=$(echo -n "${ALL_DIGESTS}" | sha256sum | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache container images
+        id: image-cache
+        uses: actions/cache@v4
+        with:
+          path: /tmp/podman-image-cache
+          key: podman-images-integration-${{ steps.digests.outputs.hash }}
+
+      - name: Load cached images
+        if: steps.image-cache.outputs.cache-hit == 'true'
+        run: |
+          for f in /tmp/podman-image-cache/*.tar; do
+            sudo podman load -i "$f"
+          done
+          sudo podman images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}"
+
       - name: Pre-pull container images
+        if: steps.image-cache.outputs.cache-hit != 'true'
         run: |
-          sudo podman pull ghcr.io/alicefr/bink/cluster:latest
-          sudo podman pull ghcr.io/alicefr/bink/node:v1.35-fedora-44-disk
-          sudo podman pull ghcr.io/alicefr/bink/dns:latest
-          sudo podman pull docker.io/library/registry:2
-          sudo podman pull docker.io/library/haproxy:lts-alpine
-          sudo podman pull quay.io/libpod/busybox:latest
+          for img in $BINK_IMAGES $EXTERNAL_IMAGES; do
+            sudo podman pull "$img"
+          done
+          mkdir -p /tmp/podman-image-cache
+          sudo podman save -o /tmp/podman-image-cache/bink-images.tar $BINK_IMAGES
+          sudo podman save -o /tmp/podman-image-cache/external-images.tar $EXTERNAL_IMAGES
+          sudo chown -R $(id -u):$(id -g) /tmp/podman-image-cache
 
       - name: Run integration tests
         run: sudo make test-integration TEST_PROCS=3

.github/workflows/test-container-image.yml

@@ -15,6 +15,12 @@ concurrency:
   group: container-image-test-${{ github.head_ref || github.ref }}
   cancel-in-progress: true
 
+env:
+  BINK_RUNTIME_IMAGES: >-
+    ghcr.io/alicefr/bink/cluster:latest
+    ghcr.io/alicefr/bink/node:v1.35-fedora-44-disk
+    ghcr.io/alicefr/bink/dns:latest
+
 jobs:
   test-container-image:
     runs-on: ubuntu-latest
@@ -52,6 +58,42 @@ jobs:
           sudo systemctl start podman.socket
           sudo podman info --format '{{.Store.GraphRoot}}'
 
+      - name: Get runtime image digests
+        id: digests
+        run: |
+          ALL_DIGESTS=""
+          for img in $BINK_RUNTIME_IMAGES; do
+            digest=$(skopeo inspect --no-creds "docker://${img}" --format '{{.Digest}}')
+            echo "${img}: ${digest}"
+            ALL_DIGESTS="${ALL_DIGESTS}${digest}"
+          done
+          echo "hash=$(echo -n "${ALL_DIGESTS}" | sha256sum | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache runtime images
+        id: image-cache
+        uses: actions/cache@v4
+        with:
+          path: /tmp/podman-image-cache
+          key: podman-images-container-test-${{ steps.digests.outputs.hash }}
+
+      - name: Load cached images
+        if: steps.image-cache.outputs.cache-hit == 'true'
+        run: |
+          for f in /tmp/podman-image-cache/*.tar; do
+            sudo podman load -i "$f"
+          done
+          sudo podman images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}"
+
+      - name: Pre-pull runtime images
+        if: steps.image-cache.outputs.cache-hit != 'true'
+        run: |
+          for img in $BINK_RUNTIME_IMAGES; do
+            sudo podman pull "$img"
+          done
+          mkdir -p /tmp/podman-image-cache
+          sudo podman save -o /tmp/podman-image-cache/runtime-images.tar $BINK_RUNTIME_IMAGES
+          sudo chown -R $(id -u):$(id -g) /tmp/podman-image-cache
+
       - name: Build bink image
         run: sudo make build-bink-image