Perf improvement

README.md

@@ -29,12 +29,13 @@ This GitHub Action, named `Docker Push`, is designed to build and push a Docker
 1. Set up Docker Buildx: Configures Docker Buildx for multi-platform builds.
 2. Generate Docker Tags: Generates Docker tags based on the inputs.
 3. Configuration: Determines the target registry and sets the output image version.
-4. Build image (local load for scanning): Builds the Docker image locally for CVE scanning.
+4. Build image (local load for scanning): Builds the Docker image locally for CVE scanning, importing a scoped cache without exporting another cache copy.
 5. Docker Scout - CVE scan: Scans the image for critical and high severity vulnerabilities.
-6. Login to registry: Logs into the target container registry if `username` and `password` are provided.
-7. ACR Login: Logs into Azure Container Registry if the target registry is an ACR endpoint.
-8. Push image with attestations: Pushes the Docker image with SBOM and provenance attestations.
-9. Send Slack notification: Sends a notification to Slack if a previous step fails and a Slack webhook URL is provided.
+6. Clean up scan data: Removes the local scan image and Scout temporary files after the scan; BuildKit cache is reclaimed before the scan.
+7. Login to registry: Logs into the target container registry if `username` and `password` are provided.
+8. ACR Login: Logs into Azure Container Registry if the target registry is an ACR endpoint.
+9. Push image with attestations: Pushes the Docker image with SBOM and provenance attestations and exports a scoped minimal cache without failing the build if cache export is unavailable.
+10. Send Slack notification: Sends a notification to Slack if a previous step fails and a Slack webhook URL is provided.
 
 ## Usage
 

action.yml

@@ -105,6 +105,8 @@ runs:
         echo "version: $version"
         echo "image: $image_ref"
         echo "registry: $registry"
+        cache_scope="image-$(printf '%s' "$INPUTS_IMAGE" | sha256sum | cut -c1-16)"
+        echo "cache_scope=$cache_scope" >> "$GITHUB_OUTPUT"
 
 
     - name: Build image (local load for scanning)
@@ -117,15 +119,21 @@ runs:
         file: ${{ inputs.dockerfile }}
         tags: ${{ steps.meta.outputs.tags }}
         labels: ${{ steps.meta.outputs.labels }}
-        cache-from: type=gha
-        cache-to: type=gha,mode=max
+        cache-from: type=gha,scope=${{ steps.image.outputs.cache_scope }}
+
+    - name: Report disk usage before scanning
+      shell: bash
+      run: |
+        df -h / "$HOME"
+        docker system df || true
+
+    - name: Reclaim BuildKit cache before scanning
+      shell: bash
+      run: docker buildx prune --all --force
 
     - name: Docker Scout - CVE scan
-      continue-on-error: ${{ inputs.allow_vulnerabilities == 'true' }}
       uses: docker/scout-action@2688993af7bafd6ba8c6a74ec652442be91dd82b # v1.23.1
       with:
-        debug: true
-        verbose-debug: true
         command: cves
         image: local://${{ steps.image.outputs.image_ref }}
         dockerhub-user: ${{ inputs.dockerhub_username }}
@@ -136,6 +144,19 @@ runs:
         github-token: ${{ inputs.github_token }}
         exit-code: ${{ inputs.allow_vulnerabilities != 'true' }}
 
+    - name: Remove local scan image
+      if: always()
+      shell: bash
+      env:
+        IMAGE_TAGS: ${{ steps.meta.outputs.tags }}
+      run: |
+        while IFS= read -r tag; do
+          if [[ -n "$tag" ]]; then
+            docker image rm --force "$tag" || true
+          fi
+        done <<< "$IMAGE_TAGS"
+        rm -rf /tmp/docker-scout "$HOME/.cache/java-db" "$HOME/.docker/scout"
+
     - name: Login to ${{ steps.image.outputs.registry }}
       uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
       if: ${{ inputs.username != '' && inputs.password != '' }}
@@ -161,7 +182,8 @@ runs:
         file: ${{ inputs.dockerfile }}
         tags: ${{ steps.meta.outputs.tags }}
         labels: ${{ steps.meta.outputs.labels }}
-        cache-from: type=gha
+        cache-from: type=gha,scope=${{ steps.image.outputs.cache_scope }}
+        cache-to: type=gha,scope=${{ steps.image.outputs.cache_scope }},mode=min,ignore-error=true
         sbom: true
         provenance: mode=max
         outputs: type=registry
@@ -173,12 +195,12 @@ runs:
         webhook: ${{ inputs.slack_webhook_url }}
         webhook-type: incoming-webhook
         payload: |
-          text: "${{ github.repository }} ${{ github.ref_name }} failed the CVE check"
+          text: "${{ github.repository }} ${{ github.ref_name }} failed during the Docker build, scan, or push"
           blocks:
             - type: header
               text:
                 type: plain_text
-                text: "CVE check failed"
+                text: "Docker build, scan, or push failed"
                 emoji: true
             - type: section
               text:
@@ -187,7 +209,7 @@ runs:
             - type: section
               text:
                 type: mrkdwn
-                text: ":warning: Vulnerabilities were found. Please review the workflow run for more details."
+                text: ":warning: Please review the workflow run for the failing step and details."
             - type: actions
               elements:
                 - type: button