.github: content-address all deps images, drop standalone image builders

Make every CI base image content-addressed and built-if-missing, and
fold the three standalone image-builder workflows into the main "Build
X servers" pipeline.

Previously the gentoo / ubuntu base images and the SDK image were built
by their own workflows (gentoo-image.yml, ubuntu-deps-image.yml,
sdk-image.yml). Those rebuilt the full image on every branch that
touched the relevant paths (and a brand-new branch matched the push
path filter spuriously), wasting ~15-22 min per run; and a WIP branch
that changed the deps still consumed master's :latest base, so its build
could be stale.

Now each deps image gets a tag derived from a hash of its build inputs
and is built only when that exact tag is missing in GHCR:

  - gentoo-deps-image  : tag = hash(gentoo Dockerfile)
  - ubuntu-deps-image  : tag = hash(ubuntu Dockerfile + install-pkg.sh +
                                    install-prereq.sh + conf.sh + util.sh)

An unchanged image is reused on ANY branch via a few-second
`docker manifest inspect` existence check (no rebuild); a branch that
edits the deps automatically gets its own image — no waste and no
staleness. :latest is moved only by master.

The per-commit SDK (build-sdk-image) now builds FROM the content-hashed
ubuntu base: the SDK Dockerfile takes `ARG BASE` and the job passes
`--build-arg BASE=…/xserver-ubuntu-build:<hash>`, so a WIP branch's SDK
is built on exactly the deps that branch defines. This also makes the
standalone sdk-image.yml redundant (build-sdk-image already produces the
per-commit xserver-sdk:<sha> that the driver jobs consume), so it is
removed too.

ubuntu-deps-image is gated like build-sdk-image (its only consumer),
i.e. it runs when the ABI changed or on a tag. prune-sdk-images.yml is
kept (it still prunes accumulated xserver-sdk:<sha> tags).

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>

.github/docker/sdk/Dockerfile

@@ -4,13 +4,18 @@
 # and installs it (into the /opt/x11 prefix that the base image already uses for
 # its prereqs), so the driver builds can later consume a ready SDK from a
 # per-commit image (ghcr.io/.../xserver-sdk:<sha>) instead of the eviction-prone
-# actions/cache. Built + pushed by .github/workflows/sdk-image.yml.
+# actions/cache. Built + pushed by the build-sdk-image job in build-xserver.yml.
 #
 # Multi-stage so the final image carries only the installed SDK (/opt/x11), not
 # the xserver source tree.
 
+# Base image is the content-addressed ubuntu deps image; the build-sdk-image job
+# passes its content-hash tag via --build-arg BASE so the SDK is built on exactly
+# the deps this commit defines (defaults to :latest for a plain `docker build`).
+ARG BASE=ghcr.io/x11libre/xserver-ubuntu-build:latest
+
 # --- build stage: compile + install the SDK into /opt/x11 -------------------
-FROM ghcr.io/x11libre/xserver-ubuntu-build:latest AS build
+FROM ${BASE} AS build
 
 COPY . /src/xserver
 WORKDIR /src/xserver
@@ -29,5 +34,5 @@ RUN MACHINE="$(gcc -dumpmachine)" && \
     ninja -C _build install
 
 # --- final stage: base + the installed SDK, no source -----------------------
-FROM ghcr.io/x11libre/xserver-ubuntu-build:latest
+FROM ${BASE}
 COPY --from=build /opt/x11 /opt/x11

.github/workflows/build-xserver.yml

@@ -185,6 +185,52 @@ jobs:
                       __BUILD/meson-logs/*
                       __BUILD/test/piglit-results/*
 
+    ubuntu-deps-image:
+        # Content-addressed base image (apt deps + from-source prereqs baked in),
+        # consumed by build-sdk-image below. The tag is a hash of the image's
+        # build inputs (Dockerfile + the install scripts + conf.sh/util.sh), and
+        # we build only if that tag is missing — an unchanged image is reused on
+        # ANY branch (a few-second existence check, no ~15min rebuild); a branch
+        # that changes the deps automatically gets its own image, so the SDK it
+        # builds is never stale. :latest is only moved by master. Replaces the
+        # standalone ubuntu-deps-image.yml. Gated like build-sdk-image since the
+        # SDK is its only consumer.
+        runs-on: ubuntu-latest
+        needs: abi-changes-check
+        if: needs.abi-changes-check.outputs.abi_changed == 'true' || startsWith(github.ref, 'refs/tags/')
+        permissions:
+            contents: read
+            packages: write
+        outputs:
+            tag: ${{ steps.tag.outputs.tag }}
+        steps:
+            - uses: actions/checkout@v6
+            - id: tag
+              run: |
+                  echo "tag=$(cat .github/docker/ubuntu/Dockerfile \
+                                   .github/scripts/ubuntu/install-pkg.sh \
+                                   .github/scripts/ubuntu/install-prereq.sh \
+                                   .github/scripts/conf.sh \
+                                   .github/scripts/util.sh \
+                               | sha256sum | cut -c1-16)" >> "$GITHUB_OUTPUT"
+            - name: Log in to GHCR
+              run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+            - name: Build ubuntu deps image if missing
+              run: |
+                  set -eux
+                  img="ghcr.io/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')/xserver-ubuntu-build"
+                  tag="${{ steps.tag.outputs.tag }}"
+                  if docker manifest inspect "$img:$tag" >/dev/null 2>&1; then
+                      echo "image $img:$tag already exists — reusing"
+                  else
+                      docker build -t "$img:$tag" -f .github/docker/ubuntu/Dockerfile .
+                      docker push "$img:$tag"
+                      if [ "${{ github.ref }}" = "refs/heads/master" ]; then
+                          docker tag "$img:$tag" "$img:latest"
+                          docker push "$img:latest"
+                      fi
+                  fi
+
     build-sdk-image:
         # Build the X-server + SDK from this commit and push it to GHCR as
         # xserver-sdk:<sha>; the driver builds below run in that image. Replaces
@@ -196,6 +242,7 @@ jobs:
         needs:
             - ubuntu-fetch-pkg
             - abi-changes-check
+            - ubuntu-deps-image
         if: needs.abi-changes-check.outputs.abi_changed == 'true' || startsWith(github.ref, 'refs/tags/')
         permissions:
             contents: read
@@ -210,8 +257,10 @@ jobs:
             - name: Build and push SDK image (xserver-sdk:<sha>)
               run: |
                   set -eux
-                  img="ghcr.io/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')/xserver-sdk"
-                  docker build -t "$img:${GITHUB_SHA}" -f .github/docker/sdk/Dockerfile .
+                  owner="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
+                  base="ghcr.io/$owner/xserver-ubuntu-build:${{ needs.ubuntu-deps-image.outputs.tag }}"
+                  img="ghcr.io/$owner/xserver-sdk"
+                  docker build --build-arg BASE="$base" -t "$img:${GITHUB_SHA}" -f .github/docker/sdk/Dockerfile .
                   docker push "$img:${GITHUB_SHA}"
 
     drivers-build-ubuntu:
@@ -680,15 +729,49 @@ jobs:
             - name: build
               run: ./.github/scripts/alpine/run-xserver-build.sh
 
-    xserver-build-gentoo:
+    gentoo-deps-image:
+        # Content-addressed deps image: tag = hash of the gentoo Dockerfile, and
+        # build only if that tag is missing. An unchanged image is reused on ANY
+        # branch (a few-second existence check, no 22min rebuild); a branch that
+        # edits the Dockerfile automatically gets a fresh image — no waste and no
+        # staleness. :latest is only moved by master.
         runs-on: ubuntu-latest
         needs: ubuntu-fetch-pkg
-        # Prebuilt image with all build deps baked in (built by gentoo-image.yml,
-        # pushed to GHCR). The job only runs meson (~5 min) instead of emerging
-        # 115 packages (~20 min). The package is public, so it pulls anonymously
-        # — no credentials or packages permission needed, and fork PRs work too.
+        permissions:
+            contents: read
+            packages: write
+        outputs:
+            tag: ${{ steps.tag.outputs.tag }}
+        steps:
+            - uses: actions/checkout@v6
+            - id: tag
+              run: echo "tag=$(sha256sum .github/docker/gentoo/Dockerfile | cut -c1-16)" >> "$GITHUB_OUTPUT"
+            - name: Log in to GHCR
+              run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+            - name: Build gentoo deps image if missing
+              run: |
+                  set -eux
+                  img="ghcr.io/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')/xserver-gentoo-deps"
+                  tag="${{ steps.tag.outputs.tag }}"
+                  if docker manifest inspect "$img:$tag" >/dev/null 2>&1; then
+                      echo "image $img:$tag already exists — reusing"
+                  else
+                      docker build -t "$img:$tag" -f .github/docker/gentoo/Dockerfile .github/docker/gentoo
+                      docker push "$img:$tag"
+                      if [ "${{ github.ref }}" = "refs/heads/master" ]; then
+                          docker tag "$img:$tag" "$img:latest"
+                          docker push "$img:latest"
+                      fi
+                  fi
+
+    xserver-build-gentoo:
+        runs-on: ubuntu-latest
+        needs: gentoo-deps-image
+        # Deps image built/reused by gentoo-deps-image above, addressed by
+        # content hash so this always runs against matching deps. Only runs
+        # meson (~5 min) instead of emerging 115 packages (~20 min).
         container:
-            image: ghcr.io/x11libre/xserver-gentoo-deps:latest
+            image: ghcr.io/x11libre/xserver-gentoo-deps:${{ needs.gentoo-deps-image.outputs.tag }}
         env:
             # werror off: Gentoo's hardened toolchain (FORTIFY_SOURCE) trips
             # -Werror=format-truncation in the bundled Xtrans (a bounded snprintf

.github/workflows/gentoo-image.yml

@@ -1,47 +0,0 @@
-name: Build Gentoo deps image
-
-# Builds the prebuilt Gentoo image (.github/docker/gentoo/Dockerfile) with all
-# X-server build dependencies baked in, and pushes it to GHCR. The
-# xserver-build-gentoo job pulls this image so it only has to run meson (~5 min)
-# instead of emerging the whole dependency set (~20 min) on every run.
-#
-# This is the one intentionally-slow job (it compiles the X-USE variants the
-# official binhost lacks: mesa, llvm, ...), but it runs off the PR critical path
-# — only on demand, on a weekly schedule, or when the Dockerfile changes.
-
-on:
-    workflow_dispatch:
-    schedule:
-        # weekly, Monday 04:00 UTC — keep the image fresh with the binhost
-        - cron: '0 4 * * 1'
-    push:
-        paths:
-            - '.github/docker/gentoo/**'
-            - '.github/workflows/gentoo-image.yml'
-
-permissions:
-    contents: read
-    packages: write
-
-jobs:
-    build-gentoo-image:
-        runs-on: ubuntu-latest
-        timeout-minutes: 300
-        steps:
-            - uses: actions/checkout@v6
-
-            - name: Log in to GHCR
-              run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
-
-            - name: Build and push image
-              run: |
-                  set -eux
-                  owner=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
-                  img="ghcr.io/$owner/xserver-gentoo-deps"
-                  docker build \
-                      -t "$img:latest" \
-                      -t "$img:${GITHUB_SHA::12}" \
-                      -f .github/docker/gentoo/Dockerfile \
-                      .github/docker/gentoo
-                  docker push "$img:latest"
-                  docker push "$img:${GITHUB_SHA::12}"

.github/workflows/sdk-image.yml

@@ -1,45 +0,0 @@
-name: Build xserver SDK image
-
-# Step 2 of the driver-pipeline rework: build the X-server + SDK from the
-# current commit on top of the deps base image and push it to GHCR as a
-# per-commit tag (xserver-sdk:<sha>, plus :latest). The driver builds will
-# later pull this image instead of restoring the xserver+SDK from the
-# eviction-prone actions/cache — see .github/docker/sdk/Dockerfile.
-#
-# For now this only produces the image (no existing job consumes it yet); a
-# later step makes the driver jobs run in `container: xserver-sdk:<sha>` and
-# drops the old drivers-prepare cache dance.
-
-on:
-    workflow_dispatch:
-    push:
-        paths:
-            - '.github/docker/sdk/**'
-            - '.github/workflows/sdk-image.yml'
-
-permissions:
-    contents: read
-    packages: write
-
-jobs:
-    build-sdk-image:
-        runs-on: ubuntu-latest
-        timeout-minutes: 60
-        steps:
-            - uses: actions/checkout@v6
-
-            - name: Log in to GHCR
-              run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
-
-            - name: Build and push SDK image
-              run: |
-                  set -eux
-                  owner=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
-                  img="ghcr.io/$owner/xserver-sdk"
-                  docker build \
-                      -t "$img:${GITHUB_SHA}" \
-                      -t "$img:latest" \
-                      -f .github/docker/sdk/Dockerfile \
-                      .
-                  docker push "$img:${GITHUB_SHA}"
-                  docker push "$img:latest"

.github/workflows/ubuntu-deps-image.yml

@@ -1,47 +0,0 @@
-name: Build ubuntu deps image
-
-# Builds the base image (.github/docker/ubuntu/Dockerfile) with the apt build
-# dependencies and the from-source prereqs baked in, and pushes it to GHCR. The
-# xserver/SDK/driver builds use it so they skip apt + the prereq build on every
-# run. Off the PR critical path: on demand, weekly, or when the inputs change.
-
-on:
-    workflow_dispatch:
-    schedule:
-        # weekly, Monday 04:30 UTC — keep prereqs fresh with the distro
-        - cron: '30 4 * * 1'
-    push:
-        paths:
-            - '.github/docker/ubuntu/**'
-            - '.github/scripts/ubuntu/install-pkg.sh'
-            - '.github/scripts/ubuntu/install-prereq.sh'
-            - '.github/scripts/conf.sh'
-            - '.github/scripts/util.sh'
-            - '.github/workflows/ubuntu-deps-image.yml'
-
-permissions:
-    contents: read
-    packages: write
-
-jobs:
-    build-ubuntu-deps-image:
-        runs-on: ubuntu-latest
-        timeout-minutes: 120
-        steps:
-            - uses: actions/checkout@v6
-
-            - name: Log in to GHCR
-              run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
-
-            - name: Build and push image
-              run: |
-                  set -eux
-                  owner=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
-                  img="ghcr.io/$owner/xserver-ubuntu-build"
-                  docker build \
-                      -t "$img:latest" \
-                      -t "$img:${GITHUB_SHA::12}" \
-                      -f .github/docker/ubuntu/Dockerfile \
-                      .
-                  docker push "$img:latest"
-                  docker push "$img:${GITHUB_SHA::12}"