perf: cache base image pull only, rebuild all our layers

ARG CACHE_BUST placed immediately after FROM so only the base image
layer is served from GHA cache. All RUN/ENV/COPY layers are rebuilt
every build via CACHE_BUST=$GITHUB_SHA.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/build-and-push.yaml

@@ -56,5 +56,7 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          no-cache: true
+          build-args: CACHE_BUST=${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
           platforms: linux/amd64

.github/workflows/release-unified.yaml

@@ -96,7 +96,9 @@ jobs:
         with:
           context: .
           push: true
-          no-cache: true
+          build-args: CACHE_BUST=${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}

Dockerfile

@@ -1,5 +1,8 @@
 FROM jlesage/baseimage-gui:ubuntu-22.04-v4
 
+# Bust cache for all layers below (base image pull is still cached)
+ARG CACHE_BUST
+
 # Set environment variables
 ENV APP_NAME="Dev Container" \
     KEEP_APP_RUNNING=1 \