ci: faster pipelines with checks-only ci and registry build cache

Drop duplicate Next.js builds from CI, skip release commits, and cancel stale runs.

Cache pnpm on runners and use buildx registry cache for releases.

.gitea/workflows/ci.yml

@@ -3,10 +3,21 @@ name: CI
 on:
   push:
     branches: [main]
+    paths-ignore:
+      - "**/*.md"
+      - "docs/**"
   pull_request:
+    paths-ignore:
+      - "**/*.md"
+      - "docs/**"
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   checks:
+    if: "github.event_name == 'pull_request' || !startsWith(github.event.head_commit.message, 'chore: release')"
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -15,6 +26,8 @@ jobs:
         run: |
           corepack enable
           corepack prepare pnpm@10.33.3 --activate
+          mkdir -p /pnpm-store
+          pnpm config set store-dir /pnpm-store
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -27,23 +40,3 @@ jobs:
 
       - name: Format check
         run: pnpm format:check
-
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Enable pnpm
-        run: |
-          corepack enable
-          corepack prepare pnpm@10.33.3 --activate
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Build
-        run: pnpm build
-        env:
-          DATABASE_URL: postgres://ci_user:ci_password@localhost:5432/ci_database
-          AUTH_SECRET: ci-auth-secret-for-build
-          NEXT_PUBLIC_APP_URL: http://localhost:3000

.gitea/workflows/release.yml

@@ -9,6 +9,10 @@ on:
       - "v*"
   workflow_dispatch:
 
+concurrency:
+  group: release-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
@@ -27,8 +31,15 @@ jobs:
             echo "image=registry.ginnoir.com/ginnoir/famapp"
           } >> "$GITHUB_OUTPUT"
 
-      - name: Install docker
-        run: apt-get update -qq && apt-get install -y -qq docker.io
+      - name: Ensure docker CLI
+        run: |
+          if command -v docker >/dev/null 2>&1; then
+            echo "docker already available"
+            docker version
+            exit 0
+          fi
+          apt-get update -qq && apt-get install -y -qq docker.io
+          docker version
 
       - name: Login to registry
         run: |
@@ -36,16 +47,23 @@ jobs:
             --username "${{ secrets.REGISTRY_PUSH_USERNAME }}" \
             --password-stdin
 
-      - name: Build image
+      - name: Set up buildx
         run: |
-          docker build \
-            -t "${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version }}" \
-            -t "${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.major_minor }}" \
-            -t "${{ steps.meta.outputs.image }}:latest" \
-            .
+          docker buildx create --name famapp-builder --use 2>/dev/null || docker buildx use famapp-builder
+          docker buildx inspect --bootstrap
 
-      - name: Push image
+      - name: Build and push image
+        env:
+          IMAGE: ${{ steps.meta.outputs.image }}
+          VERSION: ${{ steps.meta.outputs.version }}
+          MAJOR_MINOR: ${{ steps.meta.outputs.major_minor }}
+          CACHE: registry.ginnoir.com/ginnoir/famapp:buildcache
         run: |
-          docker push "${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version }}"
-          docker push "${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.major_minor }}"
-          docker push "${{ steps.meta.outputs.image }}:latest"
+          docker buildx build \
+            --push \
+            --tag "${IMAGE}:${VERSION}" \
+            --tag "${IMAGE}:${MAJOR_MINOR}" \
+            --tag "${IMAGE}:latest" \
+            --cache-from "type=registry,ref=${CACHE}" \
+            --cache-to "type=registry,ref=${CACHE},mode=max" \
+            .

.github/workflows/ci.yml

@@ -3,10 +3,21 @@ name: CI
 on:
   push:
     branches: [main]
+    paths-ignore:
+      - "**/*.md"
+      - "docs/**"
   pull_request:
+    paths-ignore:
+      - "**/*.md"
+      - "docs/**"
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   checks:
+    if: "github.event_name == 'pull_request' || !startsWith(github.event.head_commit.message, 'chore: release')"
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -27,33 +38,3 @@ jobs:
       - run: pnpm lint
 
       - run: pnpm format:check
-
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10.33.3
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 24
-          cache: pnpm
-
-      - run: pnpm install --frozen-lockfile
-
-      - uses: actions/cache@v4
-        with:
-          path: .next/cache
-          key: ${{ runner.os }}-nextjs-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('src/**/*.ts', 'src/**/*.tsx', 'src/**/*.css') }}
-          restore-keys: |
-            ${{ runner.os }}-nextjs-${{ hashFiles('pnpm-lock.yaml') }}-
-            ${{ runner.os }}-nextjs-
-
-      - run: pnpm build
-        env:
-          DATABASE_URL: postgres://placeholder:placeholder@localhost:5432/placeholder
-          AUTH_SECRET: ci-placeholder-secret
-          NEXT_PUBLIC_APP_URL: http://localhost:3000