feat(ci): arch gets its builder image too — the last per-run gigabyte, and sccache through makepkg

The arch job was the one still paying full freight every run: ~1 GB of
pacman across its two install steps (never cached — container layers die
with the job) and cold cargo builds (arch was skipped in the sccache
rollout). punktfunk-arch-ci bakes base-devel + both makepkg legs' deps +
bun + node + sccache; the in-job installs become --needed no-op guards for
the one push where :latest lags. Rolling-release note in the Dockerfile:
packages now build against the image's snapshot, the same staleness the
gamescope cache already embraces, re-snapshotted on any ci/ edit.

sccache reaches makepkg by crossing the sudo boundary explicitly —
env_reset strips ambient env, so the wrapper env rides the existing
`sudo -u builder env ...` list.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/arch.yml

@@ -53,27 +53,41 @@ on:
 env:
   REGISTRY: git.unom.io
   OWNER: unom
+  # Shared compile cache: sccache -> RustFS S3 (storage.unom.io). NOTE: makepkg runs
+  # behind `sudo -u builder env ...`, which strips ambient env — the makepkg step
+  # re-exports these explicitly.
+  RUSTC_WRAPPER: sccache
+  SCCACHE_BUCKET: unom-ci-sccache
+  SCCACHE_ENDPOINT: https://storage.unom.io
+  SCCACHE_REGION: home-central
+  AWS_ACCESS_KEY_ID: ${{ secrets.SCCACHE_ACCESS_KEY_ID }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.SCCACHE_SECRET_ACCESS_KEY }}
+  CARGO_INCREMENTAL: "0"
 
 jobs:
   build-publish:
     runs-on: ubuntu-24.04
     container:
-      image: docker.io/library/archlinux:base-devel
+      # Everything the two pacman steps below used to download (~1 GB/run) is baked in,
+      # plus bun, sccache and node (ci/arch-ci.Dockerfile). The steps stay as --needed
+      # no-op guards for the one push where :latest lags an image-content change.
+      image: 192.168.1.58:5010/punktfunk-arch-ci:latest
     timeout-minutes: 90
     env:
       CARGO_HOME: /usr/local/cargo
     steps:
       # git + nodejs must exist before actions/checkout — base-devel ships neither, and
       # act_runner runs the action's JS with the CONTAINER's node, it does not inject one.
-      - name: Install build + runtime-dev deps
+      - name: Build + runtime-dev deps (no-op guard — baked into arch-ci)
+        # No -Syu: the image's snapshot IS the build environment (see the Dockerfile's
+        # rolling-release note); with everything installed this resolves locally and
+        # does nothing. It only matters on the push that adds a dep before the image
+        # rebuild lands — same bootstrap note as ci.yml's GTK4 step.
         run: |
-          pacman -Syu --noconfirm --needed \
+          pacman -S --noconfirm --needed \
             git nodejs rust clang cmake ninja nasm pkgconf python vulkan-headers \
             gtk4 libadwaita sdl3 ffmpeg pipewire wayland libxkbcommon opus libei \
-            mesa libglvnd unzip libarchive
-          # bun builds the punktfunk-web console + the punktfunk-scripting runner AND is vendored as
-          # their runtime (PF_WITH_WEB=1 / PF_WITH_SCRIPTING=1); it's AUR-only on Arch, so bootstrap
-          # the official binary.
+            mesa libglvnd unzip libarchive || echo "::warning::pacman guard failed (stale image db?) — proceeding with baked packages"
           command -v bun >/dev/null || {
             curl -fsSL https://bun.sh/install | bash
             install -m0755 "$HOME/.bun/bin/bun" /usr/local/bin/bun
@@ -132,9 +146,15 @@ jobs:
           sudo -u builder git config --global --add safe.directory "$PWD"
           mkdir -p dist && chown builder: dist
           cd packaging/arch
+          # sudo env_reset strips the ambient env, so the sccache wiring must cross the
+          # boundary explicitly (same values as the workflow env block).
           sudo -u builder env PF_SRCDIR="$GITHUB_WORKSPACE" PF_WITH_WEB=1 PF_WITH_SCRIPTING=1 \
             PF_PKGVER="$PF_PKGVER" PF_PKGREL="$PF_PKGREL" \
             CARGO_HOME="$CARGO_HOME" PKGDEST="$GITHUB_WORKSPACE/dist" \
+            RUSTC_WRAPPER="$RUSTC_WRAPPER" CARGO_INCREMENTAL="$CARGO_INCREMENTAL" \
+            SCCACHE_BUCKET="$SCCACHE_BUCKET" SCCACHE_ENDPOINT="$SCCACHE_ENDPOINT" \
+            SCCACHE_REGION="$SCCACHE_REGION" \
+            AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID" AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY" \
             makepkg -f -d --holdver
           ls -lh "$GITHUB_WORKSPACE/dist"
 
@@ -158,6 +178,7 @@ jobs:
         # failure building gamescope must not cost the packages this workflow exists to publish.
         run: |
           set -x
+          # Baked into arch-ci — a no-op guard, like the dep step above.
           pacman -S --noconfirm --needed \
             glslang libcap libdrm libinput libx11 libxcomposite libxdamage libxext \
             libxkbcommon libxmu libxrender libxres libxtst libxxf86vm libavif libdecor \

.gitea/workflows/docker.yml

@@ -70,6 +70,10 @@ jobs:
           # image layers.
           - image: punktfunk-android-ci
             dockerfile: ci/android-ci.Dockerfile
+          # Arch builder (base-devel + both makepkg legs' deps + bun + sccache) —
+          # arch.yml runs in it; ~1 GB of per-run pacman traffic became image layers.
+          - image: punktfunk-arch-ci
+            dockerfile: ci/arch-ci.Dockerfile
     steps:
       - uses: actions/checkout@v4
 

ci/arch-ci.Dockerfile

@@ -0,0 +1,42 @@
+# Arch CI builder: base-devel + every dependency arch.yml's two makepkg legs used to
+# pacman-install per run (~1 GB of mirror traffic each time) + bun + sccache + nodejs
+# (JS actions exec node INSIDE the job container — the same lesson as android-ci).
+# Content-keyed and rebuilt only when the ci/ tree changes (docker.yml `builders`).
+#
+#   docker build -f ci/arch-ci.Dockerfile -t punktfunk-arch-ci ci
+#
+# ROLLING-RELEASE TRADEOFF, on purpose: packages now build against the Arch snapshot
+# from the last image rebuild instead of a fresh -Syu per run. That is the same staleness
+# the gamescope cache already embraces ("a stale binary against newer system libs is the
+# same risk the distro's own package carries between rebuilds"), and any ci/ edit — or
+# bumping the date in this line (refreshed: 2026-07-29) — re-keys and re-snapshots it.
+FROM docker.io/library/archlinux:base-devel
+
+# One transaction: the main build/runtime deps (first list) + the gamescope companion's
+# deps (second list) — both copied verbatim from what arch.yml installed in-job, where
+# they now no-op as `--needed` guards.
+RUN pacman -Syu --noconfirm --needed \
+        git nodejs rust clang cmake ninja nasm pkgconf python vulkan-headers \
+        gtk4 libadwaita sdl3 ffmpeg pipewire wayland libxkbcommon opus libei \
+        mesa libglvnd unzip libarchive \
+        glslang libcap libdrm libinput libx11 libxcomposite libxdamage libxext \
+        libxmu libxrender libxres libxtst libxxf86vm libavif libdecor \
+        hwdata luajit seatd sdl2-compat vulkan-icd-loader \
+        xcb-util-errors xcb-util-wm xorg-xwayland \
+        meson glm wayland-protocols benchmark libxcursor \
+    && pacman -Scc --noconfirm
+
+# bun builds the punktfunk-web console + the punktfunk-scripting runner AND is vendored
+# as their runtime (PF_WITH_WEB=1 / PF_WITH_SCRIPTING=1); it's AUR-only on Arch, so
+# bootstrap the official binary — once, here, instead of per run.
+RUN curl -fsSL https://bun.sh/install | bash \
+    && install -m0755 /root/.bun/bin/bun /usr/local/bin/bun \
+    && rm -rf /root/.bun \
+    && bun --version
+
+# Shared compile cache: jobs set RUSTC_WRAPPER=sccache (backend = RustFS S3 on the LAN,
+# see .gitea/workflows — the env lives there so dev use of this image stays uncached).
+ARG SCCACHE_VERSION=0.10.0
+RUN curl -fsSL "https://github.com/mozilla/sccache/releases/download/v${SCCACHE_VERSION}/sccache-v${SCCACHE_VERSION}-x86_64-unknown-linux-musl.tar.gz" \
+    | tar -xz --wildcards --strip-components=1 -C /usr/local/bin '*/sccache' \
+    && sccache --version