From 1570788ceb967e13c798e75cc29c9a453644a51e Mon Sep 17 00:00:00 2001
From: CMGS <ilskdw@gmail.com>
Date: Sun, 8 Nov 2026 20:13:11 +0800
Subject: [PATCH] ci: flavors drop the inputs hash and secret discovery they
 never use; python flavors stop re-listing git

No flavor ships a *.sh or tag-dir file, so the secret step found nothing and the hash covered only the platforms list, which never reaches a layer. base keeps both. base already installs git.
---
 .github/workflows/build-os-images.yml | 33 +--------------------------
 os-image/browser/24.04/Dockerfile     |  3 ---
 os-image/node/24.04/Dockerfile        |  3 ---
 os-image/python-rt/3.12/Dockerfile    |  2 +-
 os-image/python/3.12/Dockerfile       |  5 +---
 5 files changed, 3 insertions(+), 43 deletions(-)

diff --git a/.github/workflows/build-os-images.yml b/.github/workflows/build-os-images.yml
index 2cd58b984..bddc30b7b 100644
--- a/.github/workflows/build-os-images.yml
+++ b/.github/workflows/build-os-images.yml
@@ -1,7 +1,7 @@
 # Reusable: the images gating workflow calls this after the boot/silkd
 # carriers build, passing which changed and their sha-pinned refs. It detects
 # changed image dirs for the matrix, builds base then flavors, and pushes to
-# ghcr with same-dir *.sh files as buildx secrets.
+# ghcr; base gets its same-dir *.sh files as buildx secrets.
 #   - a changed carrier (boot or silkd) refolds into every image; otherwise
 #     only the git-changed image dirs rebuild;
 #   - a base change rebuilds every flavor (they are FROM base);
@@ -290,35 +290,6 @@ jobs:
             type=raw,value=${{ matrix.tag }}
             type=sha,prefix=${{ matrix.tag }}-
 
-      - name: Hash image inputs
-        id: inputs
-        run: |
-          hash=$(find "os-image/${{ matrix.name }}" -type f ! -name Dockerfile ! -name '*.md' -print0 | sort -z | xargs -0 sha256sum | sha256sum | cut -d' ' -f1)
-          echo "hash=$hash" >> "$GITHUB_OUTPUT"
-
-      - name: Discover secret files
-        id: secrets
-        run: |
-          base="os-image/${{ matrix.name }}"
-          tag="${{ matrix.tag }}"
-          {
-            echo "files<<EOF"
-            for f in "$base"/*.sh; do
-              [ -f "$f" ] || continue
-              name="$(basename "$f")"
-              id="sandbox_$(echo "${name%.sh}" | tr '.-' '__')"
-              echo "${id}=${f}"
-            done
-            for f in "$base/$tag"/*; do
-              [ -f "$f" ] || continue
-              name="$(basename "$f")"
-              [ "$name" = "Dockerfile" ] && continue
-              id="$(echo "$name" | tr '.-' '__')"
-              echo "${id}=${f}"
-            done
-            echo "EOF"
-          } >> "$GITHUB_OUTPUT"
-
       - name: Commit time
         id: epoch
         run: echo "epoch=$(git log -1 --format=%ct)" >> "$GITHUB_OUTPUT"
@@ -341,10 +312,8 @@ jobs:
           build-args: |
             BASE_IMAGE=ghcr.io/${{ github.repository }}/base:24.04
             SILKD_IMAGE=${{ inputs.silkd_image != '' && inputs.silkd_image || format('ghcr.io/{0}/silkd:{1}', github.repository, steps.ver.outputs.silkd) }}
-            INPUTS_HASH=${{ steps.inputs.outputs.hash }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          secret-files: ${{ steps.secrets.outputs.files }}
           no-cache: ${{ matrix.no_cache == 'true' }}
           cache-from: type=gha,scope=${{ matrix.name }}-${{ matrix.tag }}
           cache-to: type=gha,mode=max,scope=${{ matrix.name }}-${{ matrix.tag }}
diff --git a/os-image/browser/24.04/Dockerfile b/os-image/browser/24.04/Dockerfile
index 5a19b9e9d..7e3d4cadd 100644
--- a/os-image/browser/24.04/Dockerfile
+++ b/os-image/browser/24.04/Dockerfile
@@ -6,9 +6,6 @@ ARG BASE_IMAGE=ghcr.io/cocoonstack/sandbox/base:24.04
 
 FROM ${BASE_IMAGE}
 ENV DEBIAN_FRONTEND=noninteractive
-# See base: cache-busts the layers below when non-Dockerfile inputs change.
-ARG INPUTS_HASH=
-
 ARG CHROME_VERSION=150.0.7871.115
 ARG CHROME_SHA256=1be2db033133c5e2dd1a4e8664bf67b19a61bcf6ed28d2b00f433b3f0b4f9585
 
diff --git a/os-image/node/24.04/Dockerfile b/os-image/node/24.04/Dockerfile
index f0134fd8a..cb0d4e5ec 100644
--- a/os-image/node/24.04/Dockerfile
+++ b/os-image/node/24.04/Dockerfile
@@ -7,9 +7,6 @@ ARG BASE_IMAGE=ghcr.io/cocoonstack/sandbox/base:24.04
 FROM ${BASE_IMAGE}
 ARG TARGETARCH
 ENV DEBIAN_FRONTEND=noninteractive
-# See base: cache-busts the layers below when non-Dockerfile inputs change.
-ARG INPUTS_HASH=
-
 ARG NODE_VERSION=22.23.2
 ARG NODE_SHA256_AMD64=b294a556e639d64338823920e5866c21c02741742d2e1529ee1a225c1ec9252a
 ARG NODE_SHA256_ARM64=013b59cfd2819703a6f4a14ab891fc46fc2a4e3f5bcd92de3fb4929b43e35b30
diff --git a/os-image/python-rt/3.12/Dockerfile b/os-image/python-rt/3.12/Dockerfile
index 3cd9ad865..d268e39c8 100644
--- a/os-image/python-rt/3.12/Dockerfile
+++ b/os-image/python-rt/3.12/Dockerfile
@@ -6,7 +6,7 @@ ARG BASE_IMAGE=ghcr.io/cocoonstack/sandbox/base:24.04
 FROM ${BASE_IMAGE} AS base
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    python3 python3-pip python3-venv git \
+    python3 python3-pip python3-venv \
     && rm -rf /var/lib/apt/lists/*
 
 # LSP broker manifest: pylsp is the v1 language server (pure Python on the
diff --git a/os-image/python/3.12/Dockerfile b/os-image/python/3.12/Dockerfile
index 479acd395..d0c62099a 100644
--- a/os-image/python/3.12/Dockerfile
+++ b/os-image/python/3.12/Dockerfile
@@ -3,11 +3,8 @@ ARG BASE_IMAGE=ghcr.io/cocoonstack/sandbox/base:24.04
 
 FROM ${BASE_IMAGE}
 ENV DEBIAN_FRONTEND=noninteractive
-# See base: cache-busts the layers below when non-Dockerfile inputs change.
-ARG INPUTS_HASH=
-
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    python3 python3-pip python3-venv git \
+    python3 python3-pip python3-venv \
     && rm -rf /var/lib/apt/lists/*
 
 # LSP broker manifest: pylsp is the v1 language server (pure Python on the