perf(build): reduce local cache invalidation

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

deploy/docker/Dockerfile.cli-macos

@@ -18,6 +18,7 @@ FROM ${OSXCROSS_IMAGE} AS osxcross
 
 FROM python:3.12-slim AS builder
 
+ARG OPENSHELL_IMAGE_TAG
 ARG CARGO_TARGET_CACHE_SCOPE=default
 
 ENV PATH="/root/.cargo/bin:/usr/local/bin:/osxcross/bin:${PATH}"
@@ -103,8 +104,6 @@ RUN touch crates/openshell-cli/src/main.rs \
     crates/openshell-core/build.rs \
     proto/*.proto
 
-# Declare version ARG here (not earlier) so the git-hash-bearing value does not
-# invalidate the expensive dependency-build layers above on every commit.
 ARG OPENSHELL_CARGO_VERSION
 RUN --mount=type=cache,id=cargo-registry-cli-macos,sharing=locked,target=/root/.cargo/registry \
     --mount=type=cache,id=cargo-git-cli-macos,sharing=locked,target=/root/.cargo/git \

deploy/docker/Dockerfile.images

@@ -22,7 +22,6 @@ ARG NVIDIA_CONTAINER_TOOLKIT_VERSION=1.18.2-1
 FROM --platform=$BUILDPLATFORM rust:1.88-slim AS rust-builder-base
 ARG TARGETARCH
 ARG BUILDARCH
-ARG OPENSHELL_CARGO_VERSION
 ARG CARGO_TARGET_CACHE_SCOPE=default
 ARG SCCACHE_MEMCACHED_ENDPOINT
 
@@ -80,6 +79,7 @@ RUN --mount=type=cache,id=cargo-registry-${TARGETARCH},sharing=locked,target=/us
     . cross-build.sh && cargo_cross_build --release -p openshell-server -p openshell-sandbox
 
 FROM rust-deps AS rust-workspace
+ARG OPENSHELL_CARGO_VERSION
 
 COPY crates/ crates/
 

deploy/docker/Dockerfile.python-wheels

@@ -28,6 +28,7 @@ FROM base AS builder
 
 ARG TARGETARCH
 ARG BUILDARCH
+ARG OPENSHELL_IMAGE_TAG
 ARG CARGO_TARGET_CACHE_SCOPE=default
 
 ARG SCCACHE_MEMCACHED_ENDPOINT
@@ -84,8 +85,6 @@ RUN touch crates/openshell-cli/src/main.rs \
     crates/openshell-core/build.rs \
     proto/*.proto
 
-# Declare version ARG here (not earlier) so the git-hash-bearing value does not
-# invalidate the expensive dependency-build layers above on every commit.
 ARG OPENSHELL_CARGO_VERSION
 RUN --mount=type=cache,id=cargo-registry-python-wheels-${TARGETARCH},sharing=locked,target=/root/.cargo/registry \
     --mount=type=cache,id=cargo-git-python-wheels-${TARGETARCH},sharing=locked,target=/root/.cargo/git \

deploy/docker/Dockerfile.python-wheels-macos

@@ -12,6 +12,7 @@ FROM ${OSXCROSS_IMAGE} AS osxcross
 FROM python:${PYTHON_VERSION}-slim AS builder
 
 ARG TARGETARCH
+ARG OPENSHELL_IMAGE_TAG
 ARG CARGO_TARGET_CACHE_SCOPE=default
 
 ENV PATH="/root/.cargo/bin:/usr/local/bin:/osxcross/bin:${PATH}"
@@ -91,8 +92,6 @@ RUN touch crates/openshell-cli/src/main.rs \
     crates/openshell-core/build.rs \
     proto/*.proto
 
-# Declare version ARG here (not earlier) so the git-hash-bearing value does not
-# invalidate the expensive dependency-build layers above on every commit.
 ARG OPENSHELL_CARGO_VERSION
 RUN --mount=type=cache,id=cargo-registry-python-wheels-macos-${TARGETARCH},sharing=locked,target=/root/.cargo/registry \
     --mount=type=cache,id=cargo-git-python-wheels-macos-${TARGETARCH},sharing=locked,target=/root/.cargo/git \

tasks/python.toml

@@ -45,7 +45,7 @@ sha256_16_stdin() {
 
 PLATFORMS=${DOCKER_PLATFORMS:-linux/amd64,linux/arm64}
 CARGO_VERSION=${OPENSHELL_CARGO_VERSION:-}
-if [ -z "$CARGO_VERSION" ]; then
+if [ -z "$CARGO_VERSION" ] && [ -n "${CI:-}" ]; then
   CARGO_VERSION=$(uv run python tasks/scripts/release.py get-version --cargo)
 fi
 
@@ -55,11 +55,14 @@ CACHE_SCOPE_INPUT="v1|python-wheels|base|${LOCK_HASH}|${RUST_SCOPE}"
 CARGO_TARGET_CACHE_SCOPE=$(printf '%s' "$CACHE_SCOPE_INPUT" | sha256_16_stdin)
 
 VERSION_ARGS=(
-  --build-arg "OPENSHELL_CARGO_VERSION=${CARGO_VERSION}"
   --build-arg "CARGO_TARGET_CACHE_SCOPE=${CARGO_TARGET_CACHE_SCOPE}"
   ${OPENSHELL_IMAGE_TAG:+--build-arg "OPENSHELL_IMAGE_TAG=${OPENSHELL_IMAGE_TAG}"}
 )
 
+if [ -n "$CARGO_VERSION" ]; then
+  VERSION_ARGS+=(--build-arg "OPENSHELL_CARGO_VERSION=${CARGO_VERSION}")
+fi
+
 if ! docker buildx inspect multiarch >/dev/null 2>&1; then
   echo "Creating multi-platform buildx builder..."
   docker buildx create --name multiarch --use --bootstrap
@@ -171,7 +174,7 @@ sha256_16_stdin() {
 
 CARGO_VERSION=${OPENSHELL_CARGO_VERSION:-}
 OSXCROSS_IMAGE_REF=${OSXCROSS_IMAGE:-crazymax/osxcross:latest}
-if [ -z "$CARGO_VERSION" ]; then
+if [ -z "$CARGO_VERSION" ] && [ -n "${CI:-}" ]; then
   CARGO_VERSION=$(uv run python tasks/scripts/release.py get-version --cargo)
 fi
 
@@ -186,8 +189,8 @@ docker build \
   -f deploy/docker/Dockerfile.python-wheels-macos \
   --target wheels \
   --build-arg "OSXCROSS_IMAGE=${OSXCROSS_IMAGE_REF}" \
-  --build-arg "OPENSHELL_CARGO_VERSION=${CARGO_VERSION}" \
   --build-arg "CARGO_TARGET_CACHE_SCOPE=${CARGO_TARGET_CACHE_SCOPE}" \
+  ${CARGO_VERSION:+--build-arg "OPENSHELL_CARGO_VERSION=${CARGO_VERSION}"} \
   ${OPENSHELL_IMAGE_TAG:+--build-arg "OPENSHELL_IMAGE_TAG=${OPENSHELL_IMAGE_TAG}"} \
   --output type=local,dest=target/wheels \
   .

tasks/scripts/docker-build-image.sh

@@ -105,7 +105,7 @@ fi
 VERSION_ARGS=()
 if [[ -n "${OPENSHELL_CARGO_VERSION:-}" ]]; then
   VERSION_ARGS=(--build-arg "OPENSHELL_CARGO_VERSION=${OPENSHELL_CARGO_VERSION}")
-else
+elif [[ -n "${CI:-}" ]]; then
   CARGO_VERSION=$(uv run python tasks/scripts/release.py get-version --cargo 2>/dev/null || true)
   if [[ -n "${CARGO_VERSION}" ]]; then
     VERSION_ARGS=(--build-arg "OPENSHELL_CARGO_VERSION=${CARGO_VERSION}")