use registry cache for reading and writing

Author: artyom-morozov

.github/workflows/ci.yaml

@@ -169,16 +169,14 @@ jobs:
       - name: Setup Docker Buildx
         uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
-      - name: Configure AWS credentials
-        if: fromJSON(needs.prepare-metadata.outputs.docker_push)
+      - name: Configure AWS credentials (for ECR access)
         uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
         with:
           aws-access-key-id: ${{ secrets.SAM_AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.SAM_AWS_SECRET_ACCESS_KEY }}
           aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
 
-      - name: Login to Amazon ECR
-        if: fromJSON(needs.prepare-metadata.outputs.docker_push)
+      - name: Login to Amazon ECR (for cache access)
         uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1
 
       - name: Determine Image Name and Cache Configuration
@@ -193,21 +191,25 @@ jobs:
           fi
           echo "image_name=${image_name}" >> $GITHUB_OUTPUT
 
-          # Configure cache settings
-          cache_ref="${image_name}:buildcache-${{ matrix.platform.tag_suffix }}"
-          echo "cache_ref=${cache_ref}" >> $GITHUB_OUTPUT
+          # Always use ECR for cache reference (main branch writes here, PRs read from here)
+          ecr_cache_ref="${{ secrets.SAM_AWS_ECR_REGISTRY }}/solace-agent-mesh:buildcache-${{ matrix.platform.tag_suffix }}"
+          echo "ecr_cache_ref=${ecr_cache_ref}" >> $GITHUB_OUTPUT
 
-          # For PR builds, use gha cache as fallback since we can't push to registry
-          # For push builds, use registry cache for better persistence and sharing
+          # Configure cache settings based on build type
           if [[ "${{ fromJSON(needs.prepare-metadata.outputs.docker_push) }}" == "true" ]]; then
-            echo "cache_from=type=registry,ref=${cache_ref}" >> $GITHUB_OUTPUT
-            echo "cache_to=type=registry,ref=${cache_ref},mode=max" >> $GITHUB_OUTPUT
-            echo "Using registry cache (can read and write)"
+            # Main branch push: read from and write to ECR registry cache
+            echo "cache_from=type=registry,ref=${ecr_cache_ref}" >> $GITHUB_OUTPUT
+            echo "cache_to=type=registry,ref=${ecr_cache_ref},mode=max,ignore-error=true" >> $GITHUB_OUTPUT
+            echo "Main branch: Using ECR registry cache (read/write)"
           else
-            # PR builds: try to read from registry cache, write to gha cache
-            echo "cache_from=type=registry,ref=${cache_ref}" >> $GITHUB_OUTPUT
+            # PR builds: read from ECR cache (best effort) + GHA cache, write to GHA cache only
+            # Multiple cache sources are newline-separated in docker/build-push-action
+            cat >> $GITHUB_OUTPUT << EOF
+          cache_from=type=registry,ref=${ecr_cache_ref}
+          type=gha,scope=${{ matrix.platform.tag_suffix }}
+          EOF
             echo "cache_to=type=gha,scope=${{ matrix.platform.tag_suffix }},mode=max" >> $GITHUB_OUTPUT
-            echo "Using registry cache for reading, gha cache for writing (PR build)"
+            echo "PR build: Reading from ECR registry cache + GHA cache, writing to GHA cache"
           fi
 
       - name: Build and Push Platform-Specific Image
@@ -233,15 +235,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Configure AWS credentials
-        if: fromJSON(needs.prepare-metadata.outputs.docker_push)
         uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
         with:
           aws-access-key-id: ${{ secrets.SAM_AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.SAM_AWS_SECRET_ACCESS_KEY }}
           aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
 
       - name: Login to Amazon ECR
-        if: fromJSON(needs.prepare-metadata.outputs.docker_push)
         uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1
 
       - name: Setup Docker Buildx