From bd8a32bc199f3770b71ebde9257c9be59e13fcad Mon Sep 17 00:00:00 2001
From: "Ian H. Pittwood" <ian.pittwood@posit.co>
Date: Wed, 21 Oct 2026 08:54:38 -0600
Subject: [PATCH] feat(ci): add refresh-cache input to rebuild layers without
 reading cache

Adds a refresh-cache boolean input to bakery-build-native.yml that passes
--no-cache to bakery build while keeping --cache-registry, so BuildKit skips
cache reads but still exports fresh layers (cache-to, mode=max) to the cache
registry. Mirrored in bakery-build.yml for the --load build step.

Part of #847
---
 .github/workflows/bakery-build-native.yml | 10 ++++++++++
 .github/workflows/bakery-build.yml        | 10 ++++++++++
 2 files changed, 20 insertions(+)

diff --git a/.github/workflows/bakery-build-native.yml b/.github/workflows/bakery-build-native.yml
index da553c9c..14ee9ac3 100644
--- a/.github/workflows/bakery-build-native.yml
+++ b/.github/workflows/bakery-build-native.yml
@@ -82,6 +82,11 @@ on:
         default: true
         required: false
         type: boolean
+      refresh-cache:
+        description: "Rebuild all layers without reading the build cache, but still write fresh layers to the cache registry [default: false]"
+        default: false
+        required: false
+        type: boolean
       max-parallel:
         description: "Maximum number of matrix jobs (build/test and merge) to run simultaneously [default: 0, unlimited]"
         default: 0
@@ -391,6 +396,7 @@ jobs:
           NORMALIZED_PLATFORM: ${{ steps.normalize-platform.outputs.platform }}
           CONTEXT: ${{ inputs.context }}
           CACHE: ${{ inputs.cache }}
+          REFRESH_CACHE: ${{ inputs.refresh-cache }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         # Cache-to is conditional on --push (handled by bakery internally)
         run: |
@@ -398,6 +404,10 @@ jobs:
           if [ "$CACHE" = "true" ]; then
             CACHE_FLAGS=(--cache-registry "$CACHE_REGISTRY")
           fi
+          # --no-cache skips cache reads only; cache-to still writes fresh layers to the registry
+          if [ "$REFRESH_CACHE" = "true" ]; then
+            CACHE_FLAGS+=(--no-cache)
+          fi
           DEV_SPEC_FLAGS=()
           [[ -n "$DEV_SPEC_RESOLVED" ]] && DEV_SPEC_FLAGS=(--dev-spec "$DEV_SPEC_RESOLVED")
           bakery build \
diff --git a/.github/workflows/bakery-build.yml b/.github/workflows/bakery-build.yml
index b245d695..5f34cf08 100644
--- a/.github/workflows/bakery-build.yml
+++ b/.github/workflows/bakery-build.yml
@@ -84,6 +84,11 @@ on:
         default: true
         required: false
         type: boolean
+      refresh-cache:
+        description: "Rebuild all layers without reading the build cache [default: false]"
+        default: false
+        required: false
+        type: boolean
       cache-registry:
         description: "Registry to use for build layer caching [default: ghcr.io/<repository_owner>]"
         default: ""
@@ -312,12 +317,17 @@ jobs:
           CACHE_REGISTRY: ${{ inputs.cache-registry || format('ghcr.io/{0}', github.repository_owner) }}
           CONTEXT: ${{ inputs.context }}
           CACHE: ${{ inputs.cache }}
+          REFRESH_CACHE: ${{ inputs.refresh-cache }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           CACHE_FLAGS=()
           if [ "$CACHE" = "true" ]; then
             CACHE_FLAGS=(--cache-registry "$CACHE_REGISTRY")
           fi
+          # Push step below reuses these freshly built local layers, so it needs no --no-cache
+          if [ "$REFRESH_CACHE" = "true" ]; then
+            CACHE_FLAGS+=(--no-cache)
+          fi
           DEV_SPEC_FLAGS=()
           [[ -n "$DEV_SPEC_RESOLVED" ]] && DEV_SPEC_FLAGS=(--dev-spec "$DEV_SPEC_RESOLVED")
           bakery build --load --pull \