[actions] cache container images, verified against digests looked up live

Each container job now looks up the image's index, manifest,
and config digests from the registry,
keys an `actions/cache` entry on the config digest,
and only uses a cached image if its ID matches one of those digests;
otherwise it is discarded and the image is pulled (with retries) instead.
A poisoned or stale cache entry can therefore never be used,
and a cache hit needs only a couple of small manifest requests,
so this scales regardless of pull rate limits.

.github/workflows/tests-alpine.yml

@@ -67,14 +67,22 @@ jobs:
           node-version: 'lts/*'
           skip-ls-check: true
       - run: npm ls urchin
+      # Pull through Google's Docker Hub mirror, which is not subject to Docker Hub's
+      # anonymous pull rate limits, and cache the image; a cached image is only used
+      # if it matches the digests the registry serves now
+      - name: 'Resolve the alpine:${{ matrix.alpine }} image digests'
+        id: image
+        run: sh .github/scripts/docker-image.sh resolve mirror.gcr.io/library/alpine:${{ matrix.alpine }} >> "$GITHUB_OUTPUT"
+      - uses: actions/cache@v6
+        with:
+          path: ${{ runner.temp }}/docker-image.tar
+          key: docker-image-${{ runner.arch }}-${{ steps.image.outputs.key }}
+      - name: 'Load or pull the alpine:${{ matrix.alpine }} image'
+        env:
+          DIGESTS: ${{ steps.image.outputs.digests }}
+        run: sh .github/scripts/docker-image.sh ensure mirror.gcr.io/library/alpine:${{ matrix.alpine }} "${RUNNER_TEMP}/docker-image.tar"
       - name: 'Run fast tests on Alpine ${{ matrix.alpine }} (${{ matrix.arch }})'
         run: |
-          # Pull through Google's Docker Hub mirror, which is not subject to Docker Hub's
-          # anonymous pull rate limits; retry to tolerate transient registry failures
-          for i in 1 2 3 4 5; do
-            docker pull mirror.gcr.io/library/alpine:${{ matrix.alpine }} && break
-            echo "docker pull failed, attempt $i/5"; sleep $((i * 5))
-          done
           docker run --rm \
             -v "${{ github.workspace }}:/workspace" \
             -w /workspace \
@@ -151,14 +159,22 @@ jobs:
       - uses: actions/checkout@v6
         with:
           submodules: false
+      # Pull through Google's Docker Hub mirror, which is not subject to Docker Hub's
+      # anonymous pull rate limits, and cache the image; a cached image is only used
+      # if it matches the digests the registry serves now
+      - name: 'Resolve the alpine:${{ matrix.alpine }} image digests'
+        id: image
+        run: sh .github/scripts/docker-image.sh resolve mirror.gcr.io/library/alpine:${{ matrix.alpine }} >> "$GITHUB_OUTPUT"
+      - uses: actions/cache@v6
+        with:
+          path: ${{ runner.temp }}/docker-image.tar
+          key: docker-image-${{ runner.arch }}-${{ steps.image.outputs.key }}
+      - name: 'Load or pull the alpine:${{ matrix.alpine }} image'
+        env:
+          DIGESTS: ${{ steps.image.outputs.digests }}
+        run: sh .github/scripts/docker-image.sh ensure mirror.gcr.io/library/alpine:${{ matrix.alpine }} "${RUNNER_TEMP}/docker-image.tar"
       - name: 'Install node ${{ matrix.node }} from a musl binary on Alpine ${{ matrix.alpine }}'
         run: |
-          # Pull through Google's Docker Hub mirror, which is not subject to Docker Hub's
-          # anonymous pull rate limits; retry to tolerate transient registry failures
-          for i in 1 2 3 4 5; do
-            docker pull mirror.gcr.io/library/alpine:${{ matrix.alpine }} && break
-            echo "docker pull failed, attempt $i/5"; sleep $((i * 5))
-          done
           docker run --rm \
             -v "${{ github.workspace }}:/workspace" \
             -w /workspace \

.github/workflows/tests-installation-node.yml

@@ -64,15 +64,22 @@ jobs:
           skip-ls-check: true
       - run: npm ls urchin
       - run: npx which urchin
+      # Pull through Google's Docker Hub mirror, which is not subject to Docker Hub's
+      # anonymous pull rate limits, and cache the image; a cached image is only used
+      # if it matches the digests the registry serves now
+      - name: Resolve the ubuntu:16.04 image digests
+        id: image
+        run: sh .github/scripts/docker-image.sh resolve mirror.gcr.io/library/ubuntu:16.04 >> "$GITHUB_OUTPUT"
+      - uses: actions/cache@v6
+        with:
+          path: ${{ runner.temp }}/docker-image.tar
+          key: docker-image-${{ runner.arch }}-${{ steps.image.outputs.key }}
+      - name: Load or pull the ubuntu:16.04 image
+        env:
+          DIGESTS: ${{ steps.image.outputs.digests }}
+        run: sh .github/scripts/docker-image.sh ensure mirror.gcr.io/library/ubuntu:16.04 "${RUNNER_TEMP}/docker-image.tar"
       - name: Run installation_node tests in container
         run: |
-          # Pull through Google's Docker Hub mirror, which is not subject to Docker Hub's
-          # anonymous pull rate limits; retry to tolerate transient registry failures
-          for i in 1 2 3 4 5; do
-            docker pull mirror.gcr.io/library/ubuntu:16.04 && break
-            echo "docker pull failed, attempt $i/5"
-            sleep $((i * 5))
-          done
           docker run --rm \
             -v "${{ github.workspace }}:/workspace" \
             -w /workspace \

.github/workflows/tests-xenial.yml

@@ -61,15 +61,22 @@ jobs:
           skip-ls-check: true
       - run: npm ls urchin
       - run: npx which urchin
+      # Pull through Google's Docker Hub mirror, which is not subject to Docker Hub's
+      # anonymous pull rate limits, and cache the image; a cached image is only used
+      # if it matches the digests the registry serves now
+      - name: Resolve the ubuntu:16.04 image digests
+        id: image
+        run: sh .github/scripts/docker-image.sh resolve mirror.gcr.io/library/ubuntu:16.04 >> "$GITHUB_OUTPUT"
+      - uses: actions/cache@v6
+        with:
+          path: ${{ runner.temp }}/docker-image.tar
+          key: docker-image-${{ runner.arch }}-${{ steps.image.outputs.key }}
+      - name: Load or pull the ubuntu:16.04 image
+        env:
+          DIGESTS: ${{ steps.image.outputs.digests }}
+        run: sh .github/scripts/docker-image.sh ensure mirror.gcr.io/library/ubuntu:16.04 "${RUNNER_TEMP}/docker-image.tar"
       - name: Run xenial tests in container
         run: |
-          # Pull through Google's Docker Hub mirror, which is not subject to Docker Hub's
-          # anonymous pull rate limits; retry to tolerate transient registry failures
-          for i in 1 2 3 4 5; do
-            docker pull mirror.gcr.io/library/ubuntu:16.04 && break
-            echo "docker pull failed, attempt $i/5"
-            sleep $((i * 5))
-          done
           docker run --rm \
             -v "${{ github.workspace }}:/workspace" \
             -w /workspace \