perf(ci): optimize caching for Rust builds and Docker images

CI improvements:
- Only build job saves Rust cache on main branch (avoids race conditions)
- Clippy and test jobs read cache only (save-if: false)
- Release job already had save-if: false

Docker improvements:
- Use cargo-chef pattern for dependency caching
- Dependencies layer is cached when only source code changes
- Reduces rebuild time from ~10min to ~2min for source-only changes

Author: echobt

.github/workflows/ci.yml

@@ -22,7 +22,7 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # Build job - creates shared cache for other jobs
+  # Build job - creates shared cache for other jobs (only this job saves cache)
   build:
     name: Build
     runs-on: ubuntu-latest
@@ -41,11 +41,12 @@ jobs:
         with:
           cache-on-failure: true
           shared-key: "platform-ci"
+          save-if: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
 
       - name: Build
         run: cargo build --release
 
-  # Clippy runs in parallel with build (shares cache)
+  # Clippy runs in parallel with build (reads cache only)
   clippy:
     name: Clippy
     runs-on: ubuntu-latest
@@ -66,11 +67,12 @@ jobs:
         with:
           cache-on-failure: true
           shared-key: "platform-ci"
+          save-if: false
 
       - name: Run clippy
         run: cargo clippy --all-targets --workspace -- -W clippy::all
 
-  # Test job - runs faster with nextest
+  # Test job - runs faster with nextest (reads cache only)
   test:
     name: Test
     runs-on: ubuntu-latest
@@ -98,6 +100,7 @@ jobs:
         with:
           cache-on-failure: true
           shared-key: "platform-ci"
+          save-if: false
 
       # Run tests with nextest (faster) - coverage only on main
       - name: Run tests

Dockerfile

@@ -1,12 +1,23 @@
 # ============================================================================
-# Platform Chain - Optimized Multi-stage Docker Build
+# Platform Chain - Optimized Multi-stage Docker Build with Dependency Caching
 # ============================================================================
 
-# Stage 1: Builder
-FROM rust:slim-trixie AS builder
-
+# Stage 1: Chef - prepare recipe for dependency caching
+FROM rust:slim-trixie AS chef
+RUN cargo install cargo-chef --locked
 WORKDIR /app
 
+# Stage 2: Planner - analyze dependencies
+FROM chef AS planner
+COPY Cargo.toml Cargo.lock ./
+COPY crates ./crates
+COPY bins ./bins
+COPY tests ./tests
+RUN cargo chef prepare --recipe-path recipe.json
+
+# Stage 3: Builder - build with cached dependencies
+FROM chef AS builder
+
 # Install build dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \
     pkg-config \
@@ -16,19 +27,23 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libclang-dev \
     && rm -rf /var/lib/apt/lists/*
 
-# Copy source code
+# Build dependencies first (this layer is cached if dependencies don't change)
+COPY --from=planner /app/recipe.json recipe.json
+RUN cargo chef cook --release --recipe-path recipe.json
+
+# Copy source code and build
 COPY Cargo.toml Cargo.lock ./
 COPY crates ./crates
 COPY bins ./bins
 COPY tests ./tests
 
-# Build release binaries
+# Build release binaries (only source changes trigger this)
 RUN cargo build --release --bin validator-node --bin csudo
 
 # Strip binaries for smaller size
 RUN strip /app/target/release/validator-node /app/target/release/csudo
 
-# Stage 2: Runtime - Minimal production image
+# Stage 4: Runtime - Minimal production image
 FROM debian:trixie-slim AS runtime
 
 # Install runtime dependencies