feat(image): pre-cache GitHub Actions and add nightly refresh

Preload frequently used GitHub Actions from manifest-defined refs into the runner image so jobs start faster and rely less on network fetches. Add a nightly workflow that forces a release-path rebuild when no unreleased commits exist, keeping major-tagged action refs fresh.

Made-with: Cursor

Author: miragecentury

.github/workflows/nightly.yaml

@@ -0,0 +1,32 @@
+name: Nightly rebuild
+
+on:
+  schedule:
+    - cron: "17 3 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  ensure-release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: true
+
+      - name: Force minor bump if no unreleased commits
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+
+          last_tag="$(git describe --tags --abbrev=0 2>/dev/null || echo '')"
+          if [ -n "${last_tag}" ] && [ "$(git rev-list "${last_tag}..HEAD" --count)" -eq 0 ]; then
+            git commit --allow-empty -m 'feat: nightly rebuild to refresh base image and cached actions'
+            git push origin HEAD:main
+          fi

CHANGELOG.md

@@ -2,9 +2,12 @@
 
 ### Added
 
+* **ci:** add nightly rebuild workflow to force daily semantic-release/image refreshes when no unreleased commits exist
+
 ### Changed
 
 - **release:** configure semantic-release to treat `chore` commits as minor releases and include them in generated release notes
+- **image:** pre-cache commonly used GitHub Actions from `manifest.yaml` into the runner `_work/_actions` directory during image build
 
 ### Fixed
 

Containerfile

@@ -136,5 +136,12 @@ RUN curl -sSL https://install.python-poetry.org | python3 -
 # hadolint ignore=DL4006
 RUN curl -LsSf https://astral.sh/uv/install.sh | sh
 
+# Pre-cache selected GitHub Actions used by project workflows.
+COPY --chown=runner:runner manifest.yaml /tmp/manifest.yaml
+COPY --chown=runner:runner scripts/cache_actions.sh /tmp/cache_actions.sh
+RUN chmod +x /tmp/cache_actions.sh \
+    && /tmp/cache_actions.sh /tmp/manifest.yaml \
+    && rm -f /tmp/manifest.yaml /tmp/cache_actions.sh
+
 # Add user tool paths to interactive shell PATH
 RUN echo "export PATH=\"/usr/local/bin:${APP_HOME}/.uv/bin:${APP_HOME}/.poetry/bin:${APP_HOME}/.local/bin:\$PATH\"" >> ~/.bashrc

manifest.yaml

@@ -20,3 +20,12 @@ build:
     - org.opencontainers.image.licenses="MIT"
     - org.opencontainers.image.authors="Deerhide"
     - org.opencontainers.image.vendor="Deerhide"
+cache:
+  actions:
+    - actions/checkout@v6
+    - wagoid/commitlint-github-action@v6
+    - cycjimmy/semantic-release-action@v6
+    - actions/cache@v5
+    - actions/upload-artifact@v7
+    - actions/download-artifact@v8
+    - actions/cache/restore@v5

scripts/cache_actions.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+manifest_path="${1:-manifest.yaml}"
+actions_root="${ACTIONS_CACHE_ROOT:-/home/runner/_work/_actions}"
+
+if ! command -v yq >/dev/null 2>&1; then
+  echo "Error: yq is required but not installed." >&2
+  exit 1
+fi
+
+if [[ ! -f "${manifest_path}" ]]; then
+  echo "Error: manifest file not found at ${manifest_path}" >&2
+  exit 1
+fi
+
+mkdir -p "${actions_root}"
+
+declare -A seen_actions=()
+
+while IFS= read -r action_ref; do
+  [[ -z "${action_ref}" ]] && continue
+
+  if [[ "${action_ref}" != *@* ]]; then
+    echo "Error: invalid action entry '${action_ref}', expected owner/repo[/path]@ref" >&2
+    exit 1
+  fi
+
+  repo_with_optional_path="${action_ref%@*}"
+  ref="${action_ref##*@}"
+
+  if [[ "${repo_with_optional_path}" != */* ]]; then
+    echo "Error: invalid action repo '${repo_with_optional_path}' in '${action_ref}'" >&2
+    exit 1
+  fi
+
+  owner="${repo_with_optional_path%%/*}"
+  remainder="${repo_with_optional_path#*/}"
+  repo="${remainder%%/*}"
+
+  if [[ -z "${owner}" || -z "${repo}" || -z "${ref}" ]]; then
+    echo "Error: invalid action entry '${action_ref}'" >&2
+    exit 1
+  fi
+
+  cache_key="${owner}/${repo}@${ref}"
+  if [[ -n "${seen_actions[${cache_key}]:-}" ]]; then
+    continue
+  fi
+  seen_actions["${cache_key}"]=1
+
+  dest_dir="${actions_root}/${owner}/${repo}/${ref}"
+  archive_url="https://codeload.github.com/${owner}/${repo}/tar.gz/${ref}"
+
+  rm -rf "${dest_dir}"
+  mkdir -p "${dest_dir}"
+
+  echo "Caching ${cache_key}"
+  curl -fsSL "${archive_url}" \
+    | tar -xz --strip-components=1 -C "${dest_dir}"
+
+  touch "${dest_dir}/.completed"
+done < <(yq e -r '.cache.actions[]' "${manifest_path}")