Fix Docker cache layer compatibility (#178)

* Fix Docker cache architecture mismatch in PR workflow

Add explicit single-arch platform declaration and update cache scopes
to use -amd64 suffix. This ensures PR builds can reuse cache from
release workflow's single-arch build step.

Changes:
- Add platforms: linux/amd64 to build-push-action
- Update cache-from scopes: pr-{number}-amd64, release-amd64
- Update cache-to scope: pr-{number}-amd64

This resolves the 0 CACHED steps issue where single-arch PR builds
could not reuse multi-arch release cache layers.

* Add single-arch cache build to release workflow

Add dedicated single-arch (amd64) cache build step before multi-arch
builds to enable PR workflows to reuse release cache. Both beta and
stable release jobs now use two-step pattern:
1. Build single-arch for cache (push: false)
2. Build multi-arch for publishing (push: true)

Changes:
- Add single-arch cache step to publish-prerelease job
- Add single-arch cache step to publish-release job
- Update both multi-arch steps to import from release-amd64 cache

This enables cache cross-pollination: release builds populate
release-amd64 cache, which PR builds can then reuse.

* Update pkg-pr-new workflow to use single-arch caches

Add single-arch cache fallbacks to preview builds to enable reuse
of PR and release single-arch caches. Multi-arch preview builds can
now import layers from:
1. Own preview cache (warm subsequent builds)
2. PR single-arch cache (reuse from pullrequest.yml)
3. Release single-arch cache (reuse from release.yml)
4. Release multi-arch cache (fallback)

This reduces cold cache build times for preview packages from 10+ min
to 2-3 min after first PR build completes.

Author: ghostwriternr

.github/workflows/pkg-pr-new.yml

@@ -82,7 +82,8 @@ jobs:
           tags: cloudflare/sandbox:${{ steps.package-version.outputs.version }}
           cache-from: |
             type=gha,scope=preview-pr-${{ github.event.pull_request.number }}
-            type=gha,scope=pr-${{ github.event.pull_request.number }}
+            type=gha,scope=pr-${{ github.event.pull_request.number }}-amd64
+            type=gha,scope=release-amd64
             type=gha,scope=release
           cache-to: type=gha,mode=max,scope=preview-pr-${{ github.event.pull_request.number }}
           build-args: |

.github/workflows/pullrequest.yml

@@ -120,12 +120,13 @@ jobs:
         with:
           context: .
           file: packages/sandbox/Dockerfile
+          platforms: linux/amd64  # Explicit single-arch for compatibility with release-amd64 cache
           load: true  # Load into Docker daemon for local testing
           tags: cloudflare/sandbox-test:${{ needs.unit-tests.outputs.version || '0.0.0' }}
           cache-from: |
-            type=gha,scope=pr-${{ github.event.pull_request.number }}
-            type=gha,scope=release
-          cache-to: type=gha,mode=max,scope=pr-${{ github.event.pull_request.number }}
+            type=gha,scope=pr-${{ github.event.pull_request.number }}-amd64
+            type=gha,scope=release-amd64
+          cache-to: type=gha,mode=max,scope=pr-${{ github.event.pull_request.number }}-amd64
           build-args: |
             SANDBOX_VERSION=${{ needs.unit-tests.outputs.version || '0.0.0' }}
 

.github/workflows/release.yml

@@ -113,6 +113,18 @@ jobs:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
 
+      - name: Build and cache single-arch image (for PR cache reuse)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: packages/sandbox/Dockerfile
+          platforms: linux/amd64
+          push: false  # Don't push, just cache
+          cache-from: type=gha,scope=release-amd64
+          cache-to: type=gha,mode=max,scope=release-amd64
+          build-args: |
+            SANDBOX_VERSION=${{ needs.unit-tests.outputs.version }}
+
       - name: Build and push Docker image (beta)
         uses: docker/build-push-action@v6
         with:
@@ -121,7 +133,9 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           tags: cloudflare/sandbox:${{ needs.unit-tests.outputs.version }}-beta
-          cache-from: type=gha,scope=release
+          cache-from: |
+            type=gha,scope=release-amd64
+            type=gha,scope=release
           cache-to: type=gha,mode=max,scope=release
           build-args: |
             SANDBOX_VERSION=${{ needs.unit-tests.outputs.version }}
@@ -170,6 +184,18 @@ jobs:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
 
+      - name: Build and cache single-arch image (for PR cache reuse)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: packages/sandbox/Dockerfile
+          platforms: linux/amd64
+          push: false  # Don't push, just cache
+          cache-from: type=gha,scope=release-amd64
+          cache-to: type=gha,mode=max,scope=release-amd64
+          build-args: |
+            SANDBOX_VERSION=${{ needs.unit-tests.outputs.version }}
+
       - name: Build and push Docker image
         uses: docker/build-push-action@v6
         with:
@@ -178,7 +204,9 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           tags: cloudflare/sandbox:${{ needs.unit-tests.outputs.version }}
-          cache-from: type=gha,scope=release
+          cache-from: |
+            type=gha,scope=release-amd64
+            type=gha,scope=release
           cache-to: type=gha,mode=max,scope=release
           build-args: |
             SANDBOX_VERSION=${{ needs.unit-tests.outputs.version }}