[kp2pml30]

Adds a nix cache for genvm source builds + a config with retries / fallbacks for it

Summary by CodeRabbit

• Build Improvements
  • Improved container build reliability with configured download retries, timeouts, and local-build fallback behavior.
  • Enabled use of the GenLayer binary cache to speed up supported builds.
  • Centralized source-build configuration for more consistent build settings.
  • Ensured required build configuration is included in Docker build contexts.

[github-actions]

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.123-dev, the active development branch. Pushes to v0.123-dev automatically fast-forward main.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 83e95d1d-3330-4e9d-a8ed-0cd41e0d17aa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.dockerignore:
- Line 12: Update the root .dockerignore rules to allow traversal of the docker/
directory before the existing negation rule for
docker/genvm-source-build.nix.conf, ensuring that Docker root-context builds can
include this file for the COPY in Dockerfile.backend.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9024c4cd-fb9c-4f5d-a551-42a5ab7a5c61

📥 Commits

Reviewing files that changed from the base of the PR and between c427b1d and 0a8c1db.

📒 Files selected for processing (4)

• .dockerignore
• .github/actions/genvm-runners-closure/action.yml
• docker/Dockerfile.backend
• docker/genvm-source-build.nix.conf

[kp2pml30]

our own repo + required approval for merge = no need for SHA in my opinion

[MuncleUscles]

The BuildKit secret approach and Compose/Bake mapping are sound, and unauthenticated cache fallback behaves as intended. I’m requesting changes for three remaining issues: the credential-handling action is mutable, the source-mode path is not exercised by CI at this commit, and the local closure prebuild does not consume the new cache configuration.

[MuncleUscles]

Re-reviewed the latest head. The shared action is now pinned to an immutable SHA, and the source-mode binding exercises the closure prebuild and credential-forwarded Docker build successfully in CI. The Nix daemon trust-boundary explanation also resolves the local-host configuration concern. No blocking findings.