fix orion build issues

.github/workflows/gha-cache-smoke.yml

@@ -0,0 +1,133 @@
+# Temporary smoke test for docker buildx type=gha + actions: write.
+# Delete after: this file + tmp/gha-cache-smoke/
+#
+# Requires both:
+#   1) permissions.actions: write
+#   2) crazy-max/ghaction-github-runtime (exposes ACTIONS_RUNTIME_TOKEN /
+#      ACTIONS_RESULTS_URL to raw `docker buildx` in run: steps)
+name: GHA cache smoke
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/gha-cache-smoke.yml"
+      - "tmp/gha-cache-smoke/**"
+
+permissions:
+  contents: read
+  actions: write
+
+concurrency:
+  group: gha-cache-smoke
+  cancel-in-progress: true
+
+env:
+  CACHE_SCOPE: gha-cache-smoke
+
+jobs:
+  export-cache:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      actions: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # Raw `docker buildx --cache-to type=gha` needs these env vars; they are
+      # NOT visible to run: steps unless exposed (build-push-action does this
+      # internally). Without them, cache-to silently no-ops.
+      - name: Expose GitHub Actions runtime env
+        uses: crazy-max/ghaction-github-runtime@v3
+
+      - name: Build and export GHA cache
+        run: |
+          set -euo pipefail
+          echo "ACTIONS_RUNTIME_TOKEN set: ${ACTIONS_RUNTIME_TOKEN:+yes}"
+          echo "ACTIONS_CACHE_URL set: ${ACTIONS_CACHE_URL:+yes}"
+          echo "ACTIONS_RESULTS_URL set: ${ACTIONS_RESULTS_URL:+yes}"
+          if [ -z "${ACTIONS_RUNTIME_TOKEN:-}" ]; then
+            echo "::error::ACTIONS_RUNTIME_TOKEN still empty after ghaction-github-runtime"
+            exit 1
+          fi
+
+          docker buildx build \
+            --progress=plain \
+            --provenance=false \
+            --sbom=false \
+            --cache-from type=gha,scope=$CACHE_SCOPE \
+            --cache-to type=gha,mode=max,scope=$CACHE_SCOPE \
+            --output type=docker,dest=/tmp/gha-cache-smoke.tar \
+            -f tmp/gha-cache-smoke/Dockerfile \
+            tmp/gha-cache-smoke \
+            2>&1 | tee /tmp/export.log
+
+          if ! grep -Eiq 'exporting (to GitHub Actions Cache|cache)|writing cache' /tmp/export.log; then
+            echo "::error::Expected GHA cache export markers missing from build log"
+            echo "---- log ----"
+            cat /tmp/export.log
+            exit 1
+          fi
+          echo "OK: saw GHA cache export activity"
+          grep -Ein 'exporting (to GitHub Actions Cache|cache)|writing cache' /tmp/export.log || true
+
+      - name: Assert cache entries exist via API
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          keys=$(gh api "repos/${{ github.repository }}/actions/caches?per_page=100" \
+            --jq '[.actions_caches[].key] | map(select(test("gha-cache-smoke|buildx";"i")))')
+          echo "matching cache keys: $keys"
+          count=$(echo "$keys" | jq 'length')
+          if [ "$count" -lt 1 ]; then
+            echo "::error::No Actions cache entries after export"
+            gh api "repos/${{ github.repository }}/actions/caches?per_page=20" \
+              --jq '.actions_caches[] | {key, size_in_bytes, created_at}'
+            exit 1
+          fi
+          echo "OK: $count cache key(s) present"
+
+  import-cache:
+    needs: export-cache
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      actions: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Expose GitHub Actions runtime env
+        uses: crazy-max/ghaction-github-runtime@v3
+
+      - name: Build and require GHA cache import / layer CACHED
+        run: |
+          set -euo pipefail
+          docker buildx build \
+            --progress=plain \
+            --provenance=false \
+            --sbom=false \
+            --cache-from type=gha,scope=$CACHE_SCOPE \
+            --cache-to type=gha,mode=max,scope=$CACHE_SCOPE \
+            --output type=docker,dest=/tmp/gha-cache-smoke.tar \
+            -f tmp/gha-cache-smoke/Dockerfile \
+            tmp/gha-cache-smoke \
+            2>&1 | tee /tmp/import.log
+
+          if ! grep -Eiq 'importing cache|CACHED' /tmp/import.log; then
+            echo "::error::No importing cache / CACHED markers — type=gha import failed"
+            echo "---- log ----"
+            cat /tmp/import.log
+            exit 1
+          fi
+          echo "OK: GHA cache import/CACHED confirmed"
+          grep -Ein 'importing cache|CACHED' /tmp/import.log || true

.github/workflows/mono-engine-deploy.yml

@@ -20,11 +20,14 @@ env:
   REGISTRY_ALIAS: m8q5m4u3
   REPOSITORY: mega/mono-engine
   IMAGE_TAG_BASE: latest
+  HARBOR_REGISTRY: registry.xuanwu.openatom.cn
 
-# Using AWS access key for authentication
+# Using AWS access key for authentication.
+# actions: write is required for docker buildx --cache-{from,to} type=gha.
 permissions:
   id-token: write
   contents: read
+  actions: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -41,6 +44,11 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for raw
+      # `docker buildx --cache-{from,to} type=gha` in the build step.
+      - name: Expose GitHub Actions runtime env
+        uses: crazy-max/ghaction-github-runtime@v3
+
       # -----------------------------
       # AWS / ECR Public
       # -----------------------------
@@ -57,10 +65,17 @@ jobs:
         with:
           registry-type: public
 
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.HARBOR_REGISTRY }}
+          username: ${{ secrets.HARBOR_USERNAME }}
+          password: ${{ secrets.HARBOR_PASSWORD }}
+
       # -----------------------------
-      # Build & push to ECR
+      # Build & push to ECR + Harbor
       # -----------------------------
-      - name: Build & push image to ECR (amd64)
+      - name: Build & push image to ECR and Harbor (amd64)
         env:
           ECR_REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
           IMAGE_TAG_BASE: ${{ env.IMAGE_TAG_BASE }}
@@ -71,11 +86,11 @@ jobs:
           IMAGE_TAG="${IMAGE_TAG_BASE}-${ARCH_SUFFIX}"
 
           ECR_IMAGE="$ECR_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}:$IMAGE_TAG"
-          ECR_CACHE_IMAGE="$ECR_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}:buildcache-${ARCH_SUFFIX}"
+          HARBOR_IMAGE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}:$IMAGE_TAG"
           CACHE_SCOPE="mono-engine-${ARCH_SUFFIX}"
 
           echo "ECR_IMAGE=$ECR_IMAGE"
-          echo "ECR_CACHE_IMAGE=$ECR_CACHE_IMAGE"
+          echo "HARBOR_IMAGE=$HARBOR_IMAGE"
           echo "CACHE_SCOPE=$CACHE_SCOPE"
 
           docker buildx build \
@@ -85,6 +100,7 @@ jobs:
             --sbom=false \
             -f ./mono/Dockerfile \
             -t "$ECR_IMAGE" \
+            -t "$HARBOR_IMAGE" \
             --push .
 
   manifest:
@@ -106,25 +122,41 @@ jobs:
         with:
           registry-type: public
 
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.HARBOR_REGISTRY }}
+          username: ${{ secrets.HARBOR_USERNAME }}
+          password: ${{ secrets.HARBOR_PASSWORD }}
+
       - name: Create & push manifest
         env:
           REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
         run: |
           set -euo pipefail
           IMAGE_BASE="$REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}"
+          HARBOR_BASE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}"
           SHORT_SHA="${GITHUB_SHA:0:7}"
-
-          # latest manifest
-          docker manifest create "$IMAGE_BASE:${{ env.IMAGE_TAG_BASE }}" \
-            "$IMAGE_BASE:${{ env.IMAGE_TAG_BASE }}-amd64" \
-            "$IMAGE_BASE:${{ env.IMAGE_TAG_BASE }}-arm64"
-          docker manifest push "$IMAGE_BASE:${{ env.IMAGE_TAG_BASE }}"
-
-          # commit-hash manifest (same digests as latest for this commit)
-          docker manifest create "$IMAGE_BASE:$SHORT_SHA" \
-            "$IMAGE_BASE:${{ env.IMAGE_TAG_BASE }}-amd64" \
-            "$IMAGE_BASE:${{ env.IMAGE_TAG_BASE }}-arm64"
-          docker manifest push "$IMAGE_BASE:$SHORT_SHA"
+          TAG_BASE="${{ env.IMAGE_TAG_BASE }}"
+
+          push_manifests() {
+            local base="$1"
+            local refs=("$base:${TAG_BASE}-amd64")
+            if docker manifest inspect "$base:${TAG_BASE}-arm64" >/dev/null 2>&1; then
+              refs+=("$base:${TAG_BASE}-arm64")
+            else
+              echo "WARN: $base:${TAG_BASE}-arm64 not found; publishing amd64-only manifests"
+            fi
+
+            docker manifest create "$base:${TAG_BASE}" "${refs[@]}"
+            docker manifest push "$base:${TAG_BASE}"
+
+            docker manifest create "$base:$SHORT_SHA" "${refs[@]}"
+            docker manifest push "$base:$SHORT_SHA"
+          }
+
+          push_manifests "$IMAGE_BASE"
+          push_manifests "$HARBOR_BASE"
 
   deploy-aws:
     needs: manifest

.github/workflows/orion-server-deploy.yml

@@ -11,10 +11,13 @@ env:
   REGISTRY_ALIAS: m8q5m4u3
   REPOSITORY: mega/orion-server
   IMAGE_TAG_BASE: latest
+  HARBOR_REGISTRY: registry.xuanwu.openatom.cn
 
+# actions: write is required for docker buildx --cache-{from,to} type=gha.
 permissions:
   id-token: write
   contents: read
+  actions: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -27,13 +30,19 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      actions: write
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for raw
+      # `docker buildx --cache-{from,to} type=gha` in the build step.
+      - name: Expose GitHub Actions runtime env
+        uses: crazy-max/ghaction-github-runtime@v3
+
       # -----------------------------
       # AWS auth
       # -----------------------------
@@ -50,10 +59,17 @@ jobs:
         with:
           registry-type: public
 
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.HARBOR_REGISTRY }}
+          username: ${{ secrets.HARBOR_USERNAME }}
+          password: ${{ secrets.HARBOR_PASSWORD }}
+
       # -----------------------------
-      # Build & push to AWS
+      # Build & push to AWS + Harbor
       # -----------------------------
-      - name: Build & push amd64 image to AWS
+      - name: Build & push amd64 image to AWS and Harbor
         env:
           AWS_REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
         run: |
@@ -63,6 +79,7 @@ jobs:
           ARCH_SUFFIX="amd64"
 
           AWS_IMAGE_BASE="$AWS_REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}"
+          HARBOR_IMAGE_BASE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}"
 
           TAG="${{ env.IMAGE_TAG_BASE }}-$ARCH_SUFFIX"
           CACHE_SCOPE="orion-server-$ARCH_SUFFIX"
@@ -75,6 +92,7 @@ jobs:
             --sbom=false \
             -f orion-server/Dockerfile \
             -t "$AWS_IMAGE_BASE:$TAG" \
+            -t "$HARBOR_IMAGE_BASE:$TAG" \
             --push .
 
   manifest:
@@ -96,25 +114,41 @@ jobs:
         with:
           registry-type: public
 
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.HARBOR_REGISTRY }}
+          username: ${{ secrets.HARBOR_USERNAME }}
+          password: ${{ secrets.HARBOR_PASSWORD }}
+
       - name: Create & push manifest
         env:
           REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
         run: |
           set -euo pipefail
           IMAGE_BASE="$REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}"
+          HARBOR_BASE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}"
           SHORT_SHA="${GITHUB_SHA:0:7}"
-
-          # latest manifest
-          docker manifest create "$IMAGE_BASE:${{ env.IMAGE_TAG_BASE }}" \
-            "$IMAGE_BASE:${{ env.IMAGE_TAG_BASE }}-amd64" \
-            "$IMAGE_BASE:${{ env.IMAGE_TAG_BASE }}-arm64"
-          docker manifest push "$IMAGE_BASE:${{ env.IMAGE_TAG_BASE }}"
-
-          # commit-hash manifest (same digests as latest for this commit)
-          docker manifest create "$IMAGE_BASE:$SHORT_SHA" \
-            "$IMAGE_BASE:${{ env.IMAGE_TAG_BASE }}-amd64" \
-            "$IMAGE_BASE:${{ env.IMAGE_TAG_BASE }}-arm64"
-          docker manifest push "$IMAGE_BASE:$SHORT_SHA"
+          TAG_BASE="${{ env.IMAGE_TAG_BASE }}"
+
+          push_manifests() {
+            local base="$1"
+            local refs=("$base:${TAG_BASE}-amd64")
+            if docker manifest inspect "$base:${TAG_BASE}-arm64" >/dev/null 2>&1; then
+              refs+=("$base:${TAG_BASE}-arm64")
+            else
+              echo "WARN: $base:${TAG_BASE}-arm64 not found; publishing amd64-only manifests"
+            fi
+
+            docker manifest create "$base:${TAG_BASE}" "${refs[@]}"
+            docker manifest push "$base:${TAG_BASE}"
+
+            docker manifest create "$base:$SHORT_SHA" "${refs[@]}"
+            docker manifest push "$base:$SHORT_SHA"
+          }
+
+          push_manifests "$IMAGE_BASE"
+          push_manifests "$HARBOR_BASE"
 
   deploy-aws:
     needs: manifest