ci(docker): cache smoke-test image layers via GHA cache (#3197 docker half)

Build the Docker image once in a build-image job, cache layers via type=gha,
restore from cache in each smoke variant instead of rebuilding. Variant restore
uses cache-from only (build-image is the sole cache writer).

Co-authored-by: hayriodabas <hayriodabas@users.noreply.github.com>

.github/workflows/docker-smoke.yml

@@ -66,10 +66,31 @@ jobs:
             echo "::endgroup::"
           done
 
+  # Build the Docker image once and cache layers via GHA cache.
+  # The smoke matrix jobs then pull from this cache instead of rebuilding
+  # from scratch, saving ~1-3 minutes per variant.
+  build-image:
+    name: Build Docker image (cache layers)
+    runs-on: ubuntu-latest
+    needs: compose-config
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Build and cache Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          load: true
+          tags: ghcr.io/nesquena/hermes-webui:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
   smoke:
     name: Smoke ${{ matrix.variant }}
     runs-on: ubuntu-latest
-    needs: compose-config
+    needs: [compose-config, build-image]
     timeout-minutes: 15
     strategy:
       fail-fast: false
@@ -81,6 +102,19 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - uses: docker/setup-buildx-action@v3
+
+      # Restore the cached Docker image from the build-image job.
+      # Read-only: the build-image job already populated the GHA cache, so the
+      # smoke variants only need cache-from (no redundant cache-to re-export).
+      - name: Restore Docker image from cache
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          load: true
+          tags: ghcr.io/nesquena/hermes-webui:latest
+          cache-from: type=gha
+
       - name: Resolve compose file + project name
         id: vars
         run: |
@@ -119,15 +153,6 @@ jobs:
             docker network rm "$n" || true
           done
 
-      - name: Build local Dockerfile
-        # We always build the local Dockerfile so the PR's changes are tested,
-        # even on the multi-container variants whose compose files reference
-        # ghcr.io/nesquena/hermes-webui:latest. Without this retag, multi-container
-        # smoke runs would test the previous release, not the PR.
-        run: |
-          set -euo pipefail
-          docker build -t ghcr.io/nesquena/hermes-webui:latest .
-
       - name: Prepare ephemeral host paths
         id: paths
         run: |

CHANGELOG.md

@@ -3,6 +3,12 @@
 
 ## [Unreleased]
 
+## [v0.51.177] — 2026-05-30 — Release EW (stage-batch59 — Docker smoke-test layer caching)
+
+### Changed
+
+- CI: the Docker smoke-test workflow now builds the image once and caches its layers via the GitHub Actions cache (`type=gha`), then each compose variant restores from that cache instead of rebuilding from scratch — saving ~1-3 minutes per variant. The image is still built from the PR's local Dockerfile (`load: true`), so PR changes are tested, not the released image. (Partial adoption of #3197 — the Docker half; the test-sharding half is deferred pending test-suite shard-safety work.)
+
 ## [v0.51.176] — 2026-05-30 — Release EV (stage-batch58 — sidebar attention indicators)
 
 ### Added