The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/33620.

Reviews

See the guideline for information on the review process.
A summary of reviews will appear here.

Conflicts

Reviewers, this pull request conflicts with the following ones:

• #33562 (DRAFT: add a freebsd job using systemlibs by willcl-ark)
• #33549 (ci: Add macOS cross task for arm64-apple-darwin by maflcko)
• #33185 (guix: update time-machine to 5cb84f2013c5b1e48a7d0e617032266f1e6059e2 by fanquake)
• #32953 ([POC] ci: Skip compilation when running static code analysis by hebasto)
• #32162 (depends: Switch from multilib to platform-specific toolchains by hebasto)

If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

(currently a draft, because this is based on some other pulls)

Also, it won't work anyway, due to --cache-to: https://github.com/maflcko/bitcoin-core-with-ci/actions/runs/18490105374/job/52681542962#step:6:149:

+ docker buildx ls --format '{{.DriverEndpoint}} {{.Name}}'
Using existing docker based buildx: default
Building ci_native_base image layer
+ docker buildx build --file=/home/runner/work/bitcoin-core-with-ci/bitcoin-core-with-ci/ci/test_imagefile_base --platform=linux --label=bitcoin-ci-test --tag=ci_native_base --cache-from type=gha,scope=ci_win64 --cache-to type=gha,mode=max,ignore-error=true,scope=ci_win64 --load /home/runner/work/bitcoin-core-with-ci/bitcoin-core-with-ci
ERROR: failed to build: Cache export is not supported for the docker driver.
Switch to a different driver, or turn on the containerd image store, and try again.
Learn more at https://docs.docker.com/go/build-cache-backends/
Command '['docker', 'buildx', 'build', '--file=/home/runner/work/bitcoin-core-with-ci/bitcoin-core-with-ci/ci/test_imagefile_base', '--platform=linux', '--label=bitcoin-ci-test', '--tag=ci_native_base', '--cache-from', 'type=gha,scope=ci_win64', '--cache-to', 'type=gha,mode=max,ignore-error=true,scope=ci_win64', '--load', '/home/runner/work/bitcoin-core-with-ci/bitcoin-core-with-ci']' returned non-zero exit status 1.
Error: Process completed with exit code 1.

I think if we want something like this to work it could be tricky without using a registry to host the base image which all other jobs pulled from (on a cache hit).

It may be possible without one, but as each job is scoped to itself, which is what keeps the caches seperate,: https://github.com/bitcoin/bitcoin/actions/runs/18489967967/job/52681101678?pr=33620#step:9:151 ... I think current approach would end up with one base_image per job, which is not quite what we are after here.

One possible approach I have in mind which could work:

• have a new (second) docker builder (with a fixed/shared scope) to build the base_image/imports it into the docker store
• use a second build (with current ci config) which builds based on this base_image (which is now in the local docker store)
• ?
• profit

cc @m3dwards in case you have any other ideas for approach here?

• have a new (second) docker builder (with a fixed/shared scope) to build the base_image/imports it into the docker store

• use a second build (with current ci config) which builds based on this base_image (which is now in the local docker store)

yeah, I think this makes sense. I just can't even figure out how to both support the gha cache backend and also the local storage. edit: Upstream bug: moby/buildkit#2343

We want to support:

• GHA "read-only" on branch pushes or pull requests, using the cache if available, and building all layers locally (optionally falling back to the local storage for the base layer)
• GHA "write-push" on main pushes, using the cache if available, and pushing to it (the base layer and the final image)
• Cirrus (both of the above)
• Fully local docker buildx (ideally, but optionally falling back to the local store for the base layer)
• Fully local podman build (I think this should work trivially)

Maybe all of this is too complicated and not worth it?

We want to support:

* GHA "read-only" on branch pushes or pull requests, using the cache if available, and building all layers locally (optionally falling back to the local storage for the base layer)

* GHA "write-push" on main pushes, using the cache if available, and pushing to it (the base layer and the final image)

* Cirrus (both of the above)

* Fully local docker buildx (ideally, but optionally falling back to the local store for the base layer)

* Fully local podman build (I think this should work trivially)

So the approach we have used currently is to have CI-only config here:

which appends flags to the docker build only in CI. We always add --cache-from with the correct scope of the job, then --cache-to if we are on master branch, along with --load to always load build images into the local store.

If we are on Cirrus we also update the required URLs.

Maybe all of this is too complicated and not worth it?

I agree this could be tricky to support all configurations you list though.

Hmm, then we should probably revert 6c4fe40 (or disable docker caching for GHA explicitly), because with the ~20 tasks here, and each task having a ccache size of 500MB, the GHA limit of 10GB should already be reached.

With the 10GB limit, it seems better to use if for ccache+depends than to cache installed packages?