Add Docker layer caching for development builds

[nevoodoo]

Summary

This PR implements Docker layer caching to significantly speed up CI builds for development branches while keeping production builds clean and reproducible.

Changes

1. GitHub Workflow - Switched to docker/build-push-action

• Replaced manual docker pull/build/push commands with docker/build-push-action
• Uses GitHub Actions cache (type=gha) for fast layer caching
• Development builds benefit from caching; production builds use no-cache: true
• Security: Fixed code injection vulnerability by using environment variables instead of direct github.ref_name interpolation

2. Dockerfile - Optimized for layer caching

• Follows uv's official Docker pattern with bind mounts
• Separates dependency installation from source code copying
• Uses --locked flag (uv's recommended option for Docker)
• Uses --no-dev to exclude development dependencies from production image
• Combines GitHub Actions cache (layer reuse) with UV cache mount (package download caching)

[cpg-software-ci-bot]

📊 SonarQube Summary

Metric	This PR	Main Branch
✅ Coverage	76.3%	76.3%
💨 Code Smells	47	13
🐞 Bugs	0	0
🔐 Vulnerabilities	0	0
🚨 Security Hotspots	1	0
📝 New Issues	0	0
🌟 Quality Gate	✅ OK	✅ OK

🔗 View Main Branch Report
🔗 View PR Report

[github-actions]

🐳 Docker Image Built

A new Docker image has been built for this PR:

Image: australia-southeast1-docker.pkg.dev/cpg-common/images-dev/cpg_flow:5a9a021727776b58f3781c6128a0d2efb95a54a5

Pull command:

docker pull australia-southeast1-docker.pkg.dev/cpg-common/images-dev/cpg_flow:5a9a021727776b58f3781c6128a0d2efb95a54a5

🔗 View in Google Cloud Console

---

This comment was automatically generated by the Docker workflow.

[jmarshall]

The aim was to add docker layer caching for development builds so as to speed up such builds. It would seem that the way to do that would be to refactor the Dockerfile so there are some separate layers to be able to cache and add to docker.yaml to enable caching across action runs.

In this PR the Dockerfile has no new layers and docker.yaml has been entirely rewritten and now uses several third-party actions (from the docker GH organisation).

It would be good for this PR to explain how the approach taken improves layer caching and provide some timing examples.

But overall IMHO it would be preferable to enable layer caching within the existing docker.yaml steps and code, and compare timing for that, than to rewrite the action steps entirely.