GHA Cache Not Caching for Pre-Stages (multi-stage builds)

Troubleshooting

Before submitting a bug report please read the Troubleshooting doc.

Behaviour

Steps to reproduce this issue

1. Use following Dockerfile:

FROM golang:1.19-buster as build-env

ARG SECRETS_PATH="build/package/secrets"

COPY ${SECRETS_PATH} /secrets

WORKDIR /build

## Snip... set up private go repo

COPY go.* ./
RUN go mod download

COPY . .
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /tmp/insights cmd/insights/main.go

FROM scratch

COPY --from=build-env /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=build-env /tmp/insights ./insights

EXPOSE 8080
ENTRYPOINT ["/insights"]

2. Build in GHA once to write the cache
3. Build again to read the cache

Expected behaviour

All operations should be cached, since nothing in the build has changed since the previous run

Actual behaviour

The final image's operations are cached, but not the pre-stage where most of the work is

Configuration

• Repository URL (if public): not public
• Build URL (if public): not public

name: Docker
on:
  push:
    branches:
      - master
    tags:
      - v*
  pull_request:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
        name: Checkout code
      - name: Generate Docker Metadata
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: us.gcr.io/${{ secrets.GCP_PROJECT_ID }}/insights-service
      - name: Setup Secrets
        run: |
          # ... snip ...
      - id: auth
        name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v1
        with:
          project_id: ${{ secrets.GCP_PROJECT_ID }}
          credentials_json: ${{ secrets.GCP_SA_KEY }}
          export_environment_variables: true
          token_format: access_token
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
      - name: Login to Registry
        uses: docker/login-action@v2
        with:
          registry: us.gcr.io
          username: oauth2accesstoken
          password: ${{ steps.auth.outputs.access_token }}
      - name: Build And Push Docker Image
        id: build
        uses: docker/build-push-action@v4
        with:
          push: true
          file: ./build/package/Dockerfile
          context: .
          cache-from: type=gha,scope=insights-service
          cache-to: type=gha,mode=max,scope=insights-service
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

Logs

Download the log file of your build and attach it to this issue.

Reproduce the report using ./build/package/Dockerfile and the supplied GitHub Actions workflow, running two builds with the gha cache-from and cache-to settings. Start by tracing the docker/build-push-action@v4 build and cache configuration. Done means the second build reuses cached operations from the pre-stage as well as the final image stage.