Workbench fixes

.github/workflows/nexus-cd.yaml

@@ -39,11 +39,11 @@ jobs:
         working-directory: go/nexus
     steps:
     - uses: actions/checkout@v7
+    # module cache is ~2.5GB and was evicting every other Actions cache in the repo
     - uses: actions/setup-go@v7
       with:
         go-version-file: go/nexus/go.mod
-        cache-dependency-path: go/nexus/go.sum
-        cache: true
+        cache: false
     - run: go mod download
     - run: PATH=$PATH:$GOPATH/bin make test
 
@@ -114,8 +114,8 @@ jobs:
         labels: ${{ steps.meta.outputs.labels }}
         platforms: ${{ matrix.platforms.platform }}
         outputs: type=image,push-by-digest=true,name-canonical=true,push=true
-        cache-from: type=gha,scope=nexus-${{ env.PLATFORM_PAIR }}
-        cache-to: type=gha,mode=max,scope=nexus-${{ env.PLATFORM_PAIR }}
+        cache-from: type=registry,ref=ghcr.io/pluralsh/console-cache:nexus-${{ env.PLATFORM_PAIR }}
+        cache-to: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' && format('type=registry,ref=ghcr.io/pluralsh/console-cache:nexus-{0},mode=max', env.PLATFORM_PAIR) || '' }}
         build-args: |
           GIT_COMMIT=${{ github.sha }}
           VERSION=${{ steps.meta.outputs.version }}

.github/workflows/nexus-ci.yaml

@@ -38,7 +38,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: go/nexus/go.mod
-          cache-dependency-path: go/nexus/go.sum
+          cache: false
 
       - name: Build binary
         run: make build
@@ -97,8 +97,8 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           platforms: ${{ matrix.platforms.platform }}
           outputs: type=image,push-by-digest=true,name-canonical=true,push=true
-          cache-from: type=gha,scope=nexus-${{ env.PLATFORM_PAIR }}
-          cache-to: type=gha,mode=max,scope=nexus-${{ env.PLATFORM_PAIR }}
+          # read-only: written by master builds in nexus-cd.yaml
+          cache-from: type=registry,ref=ghcr.io/pluralsh/console-cache:nexus-${{ env.PLATFORM_PAIR }}
           build-args: |
             GIT_COMMIT=${{ github.sha }}
             VERSION=${{ steps.meta.outputs.version }}

.github/workflows/observability-proxy-cd.yaml

@@ -38,11 +38,11 @@ jobs:
         working-directory: go/observability-proxy
     steps:
       - uses: actions/checkout@v7
+      # module cache is ~2.5GB and was evicting every other Actions cache in the repo
       - uses: actions/setup-go@v7
         with:
           go-version-file: go/observability-proxy/go.mod
-          cache-dependency-path: go/observability-proxy/go.sum
-          cache: true
+          cache: false
       - run: go mod download
       - run: GOCACHE=/tmp/go-build go test ./...
 
@@ -118,8 +118,8 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           platforms: ${{ matrix.platforms.platform }}
           outputs: type=image,push-by-digest=true,name-canonical=true,push=true
-          cache-from: type=gha,scope=observability-proxy-${{ env.PLATFORM_PAIR }}
-          cache-to: type=gha,mode=max,scope=observability-proxy-${{ env.PLATFORM_PAIR }}
+          cache-from: type=registry,ref=ghcr.io/pluralsh/console-cache:observability-proxy-${{ env.PLATFORM_PAIR }}
+          cache-to: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' && format('type=registry,ref=ghcr.io/pluralsh/console-cache:observability-proxy-{0},mode=max', env.PLATFORM_PAIR) || '' }}
 
       - name: Export digest
         run: |

.github/workflows/observability-proxy-ci.yaml

@@ -37,7 +37,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: go/observability-proxy/go.mod
-          cache-dependency-path: go/observability-proxy/go.sum
+          cache: false
 
       - name: Run tests
         run: go test ./...
@@ -97,8 +97,8 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           platforms: ${{ matrix.platforms.platform }}
           outputs: type=image,push-by-digest=true,name-canonical=true,push=true
-          cache-from: type=gha,scope=observability-proxy-${{ env.PLATFORM_PAIR }}
-          cache-to: type=gha,mode=max,scope=observability-proxy-${{ env.PLATFORM_PAIR }}
+          # read-only: written by master builds in observability-proxy-cd.yaml
+          cache-from: type=registry,ref=ghcr.io/pluralsh/console-cache:observability-proxy-${{ env.PLATFORM_PAIR }}
 
       - name: Export digest
         run: |

.github/workflows/publish.yaml

@@ -23,23 +23,17 @@ jobs:
           username: mjgpluralsh
           password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
       - run: make testup
-      - name: Restore dependencies cache
-        uses: actions/cache@v6
-        with:
-          path: deps
-          key: ${{ runner.os }}-deps-v2-${{ hashFiles('.tool-versions', '**/mix.lock') }}
-          restore-keys: ${{ runner.os }}-deps-v2-
-      - name: Restore NIF cache
-        uses: actions/cache@v6
-        with:
-          path: priv/native
-          key: ${{ runner.os }}-nif-v2-${{ hashFiles('.tool-versions', '**/mix.lock', 'native/**', 'lib/console/mermaid_validator.ex') }}
-          restore-keys: ${{ runner.os }}-nif-v2-
-      - name: Restore _build cache
-        uses: actions/cache@v6
-        with:
-          path: _build
-          key: ${{ runner.os }}-build-v2-${{ hashFiles('.tool-versions', '**/mix.lock', 'mix.exs', 'lib/**/*.ex', 'config/**/*.exs', 'native/**') }}
+      # Tag runs can read master's cache but anything they save is only visible to that tag
+      - name: Restore mix cache
+        uses: actions/cache/restore@v6
+        with:
+          path: |
+            deps
+            _build
+          key: ${{ runner.os }}-mix-test-v3-${{ hashFiles('.tool-versions', 'mix.lock') }}-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-mix-test-v3-${{ hashFiles('.tool-versions', 'mix.lock') }}-
+            ${{ runner.os }}-mix-test-v3-
       # - name: download jwt verification key
       #   run: |
       #     echo $JWT_PUBLIC_KEY > config/pubkey.pem
@@ -65,8 +59,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
       - name: Docker meta
         id: meta
         uses: docker/metadata-action@v6
@@ -127,8 +119,8 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           platforms: linux/amd64
-          cache-from: type=gha,scope=console
-          cache-to: type=gha,mode=max,scope=console
+          # read-only: the shared cache is only written by master builds in test.yaml
+          cache-from: type=registry,ref=ghcr.io/pluralsh/console-cache:buildcache
           build-args: |
             GIT_COMMIT=${{ github.sha }}
             VITE_PROD_SECRET_KEY=${{ secrets.VITE_PROD_SECRET_KEY }}

.github/workflows/test.yaml

@@ -26,8 +26,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
       - name: Docker meta
         id: meta
         uses: docker/metadata-action@v6
@@ -81,7 +79,8 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           platforms: linux/amd64
           cache-from: type=registry,ref=ghcr.io/pluralsh/console-cache:buildcache
-          cache-to: type=registry,ref=ghcr.io/pluralsh/console-cache:buildcache,mode=max
+          # only master writes the shared cache so unmerged branches can't seed layers for everyone else
+          cache-to: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' && 'type=registry,ref=ghcr.io/pluralsh/console-cache:buildcache,mode=max' || '' }}
           build-args: |
             GIT_COMMIT=${{ github.sha }}
             VITE_PROD_SECRET_KEY=${{ secrets.VITE_PROD_SECRET_KEY }}
@@ -132,24 +131,30 @@ jobs:
       #     echo $JWT_PUBLIC_KEY > config/pubkey.pem
       #   env:
       #     JWT_PUBLIC_KEY: ${{ secrets.JWT_PUBLIC_KEY }}
-      - name: Restore dependencies cache
-        uses: actions/cache@v6
-        with:
-          path: deps
-          key: ${{ runner.os }}-deps-v2-${{ hashFiles('.tool-versions', '**/mix.lock') }}
-          restore-keys: ${{ runner.os }}-deps-v2-
-      - name: Restore NIF cache
-        uses: actions/cache@v6
-        with:
-          path: priv/native
-          key: ${{ runner.os }}-nif-v2-${{ hashFiles('.tool-versions', '**/mix.lock', 'native/**', 'lib/console/mermaid_validator.ex') }}
-          restore-keys: ${{ runner.os }}-nif-v2-
-      - name: Restore _build cache
-        uses: actions/cache@v6
-        with:
-          path: _build
-          key: ${{ runner.os }}-build-v2-${{ hashFiles('.tool-versions', '**/mix.lock', 'mix.exs', 'config/**/*.exs', 'native/**') }}
+      # PRs restore the newest master entry; only master saves, keyed per commit so saves never collide
+      - name: Restore mix cache
+        id: mix-cache
+        uses: actions/cache/restore@v6
+        with:
+          path: |
+            deps
+            _build
+          key: ${{ runner.os }}-mix-test-v3-${{ hashFiles('.tool-versions', 'mix.lock') }}-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-mix-test-v3-${{ hashFiles('.tool-versions', 'mix.lock') }}-
+            ${{ runner.os }}-mix-test-v3-
       - run: mix deps.get
+      - run: mix compile
+        env:
+          MIX_ENV: test
+      - name: Save mix cache
+        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+        uses: actions/cache/save@v6
+        with:
+          path: |
+            deps
+            _build
+          key: ${{ steps.mix-cache.outputs.cache-primary-key }}
       - run: mix test
         env:
           TEST_CHART_OCI_PASSWORD: ${{ secrets.GITHUB_TOKEN}}
@@ -183,23 +188,16 @@ jobs:
           go-version-file: go/client/go.mod
           cache-dependency-path: go/client/go.sum
           cache: true
-      - name: Restore dependencies cache
-        uses: actions/cache@v6
-        with:
-          path: deps
-          key: ${{ runner.os }}-deps-v2-${{ hashFiles('.tool-versions', '**/mix.lock') }}
-          restore-keys: ${{ runner.os }}-deps-v2-
-      - name: Restore NIF cache
-        uses: actions/cache@v6
-        with:
-          path: priv/native
-          key: ${{ runner.os }}-nif-v2-${{ hashFiles('.tool-versions', '**/mix.lock', 'native/**', 'lib/console/mermaid_validator.ex') }}
-          restore-keys: ${{ runner.os }}-nif-v2-
-      - name: Restore _build cache
-        uses: actions/cache@v6
-        with:
-          path: _build
-          key: ${{ runner.os }}-build-v2-${{ hashFiles('.tool-versions', '**/mix.lock', 'mix.exs', 'lib/**/*.ex', 'config/**/*.exs', 'native/**') }}
+      - name: Restore mix cache
+        uses: actions/cache/restore@v6
+        with:
+          path: |
+            deps
+            _build
+          key: ${{ runner.os }}-mix-test-v3-${{ hashFiles('.tool-versions', 'mix.lock') }}-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-mix-test-v3-${{ hashFiles('.tool-versions', 'mix.lock') }}-
+            ${{ runner.os }}-mix-test-v3-
       - name: get dependencies
         run: mix deps.get
       - name: update schema

Dockerfile

@@ -78,14 +78,23 @@ RUN if [ "$OS_VARIANT" = "alpine" ]; then \
   mix local.rebar --force && \
   mix local.hex --force
 
-# This copies our app source code into the build container
-COPY . .
-
-# needed so that we can get the app version from the git tag
-RUN git config --global --add safe.directory '/opt/app'
-
-RUN mix do deps.get, compile
-RUN ls -al
+# Deps are fetched and compiled in their own layer so they stay cached until mix.lock or build config changes
+COPY mix.exs mix.lock ./
+COPY config/config.exs config/${MIX_ENV}.exs config/
+RUN mix do deps.get --only ${MIX_ENV} + deps.compile
+
+# Only copy what the app compile reads, so changes elsewhere in the monorepo don't bust this layer
+COPY config/ config/
+COPY src/ src/
+COPY static/ static/
+COPY priv/ priv/
+COPY rel/ rel/
+COPY lib/ lib/
+COPY AGENT_VERSION KUBE_VERSION ./
+COPY charts/controller/crds/ charts/controller/crds/
+COPY go/client/generated/persisted-queries/queries.json go/client/generated/persisted-queries/
+COPY js/console/src/generated/persisted-queries/client.json js/console/src/generated/persisted-queries/
+RUN mix compile
 
 COPY --from=node /app/console/build ./priv/static
 

go/deployment-operator/dockerfiles/agent-harness/base.Dockerfile

@@ -75,6 +75,9 @@ RUN set -eux; \
     nix-store -qR "${podman_output}" | \
       while read -r path; do cp -a --parents "${path}" /closure; done
 
+FROM hashicorp/terraform:latest AS terraform
+FROM alpine/helm:latest AS helm
+
 FROM dhi.io/debian-base:trixie-dev
 
 ARG TARGETARCH
@@ -187,6 +190,9 @@ COPY --from=builder /agent-harness /agent-harness
 COPY --from=builder /agent-mcpserver /agent-mcpserver
 COPY --from=builder /agent-bootstrap /agent-bootstrap
 COPY --from=fcp /opt/fcp/bin/fcp /usr/local/bin/fcp
+COPY --from=terraform /bin/terraform /usr/local/bin/terraform
+COPY --from=helm /usr/bin/helm /usr/local/bin/helm
+RUN terraform version && helm version
 
 # Pin mise in the base agent image. The harness looks it up on PATH and does
 # not download an installer at runtime. See https://mise.jdx.dev/bootstrap.html

go/deployment-operator/pkg/agentrun-harness/controller/controller.go

@@ -104,9 +104,6 @@ func (in *agentRunController) prepare(ctx context.Context) error {
 	if err := environment.ConfigurePrebakeGitSafeDirectories(); err != nil {
 		return fmt.Errorf("configure prebake git safe directories: %w", err)
 	}
-	if err := in.checkoutFollowupBranch(ctx, repositoryDir); err != nil {
-		return err
-	}
 	if in.tool, err = tool.New(in.agentRun.Runtime.Type, toolv1.Config{
 		WorkDir:       in.dir,
 		RepositoryDir: repositoryDir,
@@ -121,36 +118,6 @@ func (in *agentRunController) prepare(ctx context.Context) error {
 	return in.tool.Configure(in.consoleUrl, *in.agentRun.PluralCreds.Token)
 }
 
-func (in *agentRunController) checkoutFollowupBranch(ctx context.Context, repositoryDir string) error {
-	if in.agentRun == nil || !in.agentRun.Followup {
-		return nil
-	}
-
-	headBranch := ""
-	if in.agentRun.HeadBranch != nil {
-		headBranch = strings.TrimSpace(*in.agentRun.HeadBranch)
-	}
-	if headBranch == "" {
-		return fmt.Errorf("follow-up agent run requires a head branch to check out")
-	}
-
-	if output, err := exec.NewExecutable("git",
-		exec.WithArgs([]string{"fetch", "origin", headBranch}),
-		exec.WithDir(repositoryDir),
-	).RunWithOutput(ctx); err != nil {
-		return fmt.Errorf("fetch follow-up head branch %q: %w: %s", headBranch, err, output)
-	}
-
-	if output, err := exec.NewExecutable("git",
-		exec.WithArgs([]string{"checkout", "-B", headBranch, "origin/" + headBranch}),
-		exec.WithDir(repositoryDir),
-	).RunWithOutput(ctx); err != nil {
-		return fmt.Errorf("check out follow-up head branch %q: %w: %s", headBranch, err, output)
-	}
-
-	return nil
-}
-
 // completeAgentRun updates the agent run status in the Console API
 func (in *agentRunController) completeAgentRun(status gqlclient.AgentRunStatus, agentRunErr error) error {
 	var errorMsg *string