Merge branch 'fix-docker-build-on-tags' into 'main'

fix: broken Docker tags builds

See merge request gitlab-com/gl-infra/common-ci-tasks!808

.gitlab-ci.yml

@@ -48,7 +48,7 @@ container_image_builds:
     - .docker_buildx_base
     - .container_builds
   rules:
-    - if: '$CI_PIPELINE_SOURCE == "scheduled"'
+    - if: '$CI_PIPELINE_SOURCE == "scheduled" || $CI_COMMIT_TAG != null'
       when: "never"
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
@@ -78,3 +78,20 @@ container_image_tagged:
     - .container_builds
   rules:
     - if: "$CI_COMMIT_TAG"
+
+# Override the renovate_bot script to avoid what appears to be broken
+# master builds when renovate attempts to run before the new image
+# is build
+renovate_bot:
+  rules:
+    # Renovate only ever runs on gitlab.com
+    - if: '$CI_SERVER_HOST != "gitlab.com"'
+      when: never
+    - if: $RENOVATE_DISABLED == 'true' || $RENOVATE_DISABLED == '1'
+      when: never
+    # Avoid running Renovate when Semantic Release pushes the release commit directly to main branch
+    - if: "$CI_COMMIT_AUTHOR =~ /semantic-release-bot/ && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+      when: never
+    - if: "($RENOVATE_SCHEDULED || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH) && ($RENOVATE_IMMEDIATE == '' || $RENOVATE_IMMEDIATE == null) "
+      exists:
+        - renovate.json

docker.yml

@@ -35,10 +35,6 @@ include:
     # # Created with
     # CHAINGUARD_VIEWER_IDENTITY_ROLE: 4ff99450b6a0f33512acfbc4b797202f487bc975/59a0c8bfeacaf514
-    # In general these defaults should be good but they can be overridden to improve docker file cacheability if needed
-    GL_DOCKER_CACHE_KEY: ${CI_JOB_NAME}-${DOCKER_BUILD_FILE}-${DOCKER_BUILD_CONTEXT}-$CI_COMMIT_REF_SLUG
-    GL_DOCKER_CACHE_FALLBACK_KEY: ${CI_JOB_NAME}-${DOCKER_BUILD_FILE}-${DOCKER_BUILD_CONTEXT}-$CI_DEFAULT_BRANCH
-
     CACHE_REGISTRY: "$CI_REGISTRY_IMAGE/cache"
     BRANCH_REGISTRY_CACHE_KEY_PARTIAL: "${CI_JOB_NAME}-${DOCKER_BUILD_FILE}-${DOCKER_BUILD_CONTEXT}"
     BRANCH_REGISTRY_CACHE_KEY: "cache-${BRANCH_REGISTRY_CACHE_KEY_PARTIAL}-${CI_COMMIT_REF_SLUG}"
@@ -105,7 +101,7 @@ include:
       if [[ -n ${CI_COMMIT_TAG:-} ]]; then
         # Tags: read from main cache only
         docker_cache_args="
-          --cache-from 'type=registry,ref=${CACHE_REGISTRY}:${DEFAULT_BRANCH_REGISTRY_CACHE_KEY_SLUGIFIED}'
+          --cache-from type=registry,ref=${CACHE_REGISTRY}:${DEFAULT_BRANCH_REGISTRY_CACHE_KEY_SLUGIFIED}
         "
       elif [[ $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH ]]; then
         # main: read-write main cache only
@@ -160,10 +156,3 @@ include:
     Need help? Documentation on the docker_buildx_base CI job can be found at:
     https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/docker.md
     EOD
-  cache:
-    key: ${GL_DOCKER_CACHE_KEY}
-    fallback_keys:
-      - ${GL_DOCKER_CACHE_FALLBACK_KEY}
-    when: 'always'
-    paths:
-      - cache/