feat(ci): support internal offline build cache

.gitea/workflows/container-cd.yml

@@ -15,6 +15,11 @@ on:
         required: false
         default: .
         type: string
+      cache_image:
+        description: Optional internal image carrying BuildKit inline cache
+        required: false
+        default: ""
+        type: string
       test_command:
         description: Optional source-level test command
         required: false
@@ -48,11 +53,6 @@ jobs:
       - name: Source tests
         if: ${{ inputs.test_command != '' }}
         run: ${{ inputs.test_command }}
-      - name: Build immutable candidate image
-        run: |
-          set -eu
-          docker build --pull=false -f "${{ inputs.dockerfile }}" \
-            -t "${{ inputs.image_name }}:sha-${{ gitea.sha }}" "${{ inputs.build_context }}"
       - name: Login and publish candidate image
         env:
           REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
@@ -61,6 +61,18 @@ jobs:
           set -eu
           registry="$(printf '%s' '${{ inputs.image_name }}' | cut -d/ -f1)"
           printf '%s' "$REGISTRY_PASSWORD" | docker login "$registry" -u "$REGISTRY_USERNAME" --password-stdin
+          if [ -n "${{ inputs.cache_image }}" ]; then
+            docker pull "${{ inputs.cache_image }}"
+          fi
+      - name: Build immutable candidate image
+        run: |
+          set -eu
+          cache_args=()
+          if [ -n "${{ inputs.cache_image }}" ]; then
+            cache_args+=(--cache-from "${{ inputs.cache_image }}")
+          fi
+          docker build --pull=false "${cache_args[@]}" -f "${{ inputs.dockerfile }}" \
+            -t "${{ inputs.image_name }}:sha-${{ gitea.sha }}" "${{ inputs.build_context }}"
           docker push "${{ inputs.image_name }}:sha-${{ gitea.sha }}"
       - name: Candidate pull on Dev
         if: ${{ inputs.deploy_service != '' && inputs.deploy_host != '' }}