feat: significantly better ci images (#1516)

.github/workflows/dev-image.yml

@@ -53,16 +53,39 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
-      - name: Build and push
+      # `tachi-ci` = the minimal `base` stage. Used as the `container:` image
+      # for every workspace CI job. Kept small so the per-job image pull is
+      # cheap.
+      - name: Build and push tachi-ci (base stage)
         uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: .
           file: Dockerfile.dev
+          target: base
+          push: ${{ github.ref == 'refs/heads/main' && github.event_name != 'pull_request' }}
+          tags: |
+            ghcr.io/zkldi/tachi-ci:main
+            ghcr.io/zkldi/tachi-ci:latest
+            ghcr.io/zkldi/tachi-ci:${{ steps.revision.outputs.image_tag }}
+            ghcr.io/zkldi/tachi-ci:${{ github.sha }}
+          cache-from: type=gha,scope=dev-image-base
+          cache-to: type=gha,mode=max,scope=dev-image-base
+
+      # `tachi-dev` = full devcontainer image (`dev` stage on top of `base`).
+      # Pulled by devs once and rebuilt rarely; CI never touches it.
+      - name: Build and push tachi-dev (dev stage)
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        with:
+          context: .
+          file: Dockerfile.dev
+          target: dev
           push: ${{ github.ref == 'refs/heads/main' && github.event_name != 'pull_request' }}
           tags: |
             ghcr.io/zkldi/tachi-dev:main
             ghcr.io/zkldi/tachi-dev:latest
             ghcr.io/zkldi/tachi-dev:${{ steps.revision.outputs.image_tag }}
             ghcr.io/zkldi/tachi-dev:${{ github.sha }}
-          cache-from: type=gha,scope=dev-image
-          cache-to: type=gha,mode=max,scope=dev-image
+          cache-from: |
+            type=gha,scope=dev-image-dev
+            type=gha,scope=dev-image-base
+          cache-to: type=gha,mode=max,scope=dev-image-dev