[ianpittwood]

Part of #847 (epic #849, eMudhra intermediate CA compromise).

Summary

Adds a refresh-cache boolean input (default false) to bakery-build-native.yml. When it is true, the build-test job runs bakery build --no-cache --cache-registry <reg> --push. BuildKit then ignores cached layers but still exports fresh layers to the registry cache (cache-to, mode=max), so later scheduled and push builds reuse the patched layers instead of the stale apt-get upgrade / ca-certificates layer.

The existing cache input is unchanged. cache: false still drops --cache-registry entirely, which turns off both reads and writes.

bakery-build.yml mirrors the input on its --load build step only. Its push step reuses the local layers and never writes the registry cache.

Why --no-cache still writes the cache

• buildx maps --no-cache to the frontend attr no-cache="" (build/opt.go).
• The Dockerfile frontend turns that into a per-op llb.IgnoreCache, which skips cache lookup (dockerui/config.go, dockerfile2llb/convert.go).
• The solver runs runCacheExporters regardless of IgnoreCache (solver/llbsolver/solver.go).

Testing

• actionlint 1.7.12 and the pre-commit hooks (actionlint, zizmor, check-yaml) pass.
• Manual dispatch on one image with refresh-cache: true: the logs should show no CACHED steps, the GHCR cache tag should get a new digest, and a follow-up normal build should show the apt-upgrade step CACHED from the new entry.
• Update the v0 tag after merge.

Downstream follow-up

This needs separate PRs once this one merges and v0 is updated. Add a refresh-cache boolean workflow_dispatch input (default false) and pass it to every shared-workflow call:

on:
  workflow_dispatch:
    inputs:
      refresh-cache:
        description: "Rebuild all layers without reading the build cache, but still write fresh layers to the cache registry"
        type: boolean
        default: false
# ...
    with:
      refresh-cache: ${{ inputs.refresh-cache || false }}

|| false matters: inputs.* is null on schedule and push events.

• images-connect: production.yml, content.yml
• images-package-manager: production.yml
• images-workbench: production.yml, session.yml (both uses: calls)
• images-specialized wgcw.yml: add the dispatch input and append --no-cache to the --load step only (env var plus bash array, like CACHE_FLAGS). Leave the --push step alone so it reuses the tested local layers. That workflow reads the registry cache but never writes it, so a separate question is what refreshes its cache.

[github-actions]

Test Results

2 460 tests  ±0   2 460 ✅ ±0   9m 27s ⏱️ -39s
    1 suites ±0       0 💤 ±0 
    1 files   ±0       0 ❌ ±0 

Results for commit bd8a32b. ± Comparison against base commit 5d27865.