From c6ec7692e55d01fde26f3b0c446ac956e0fd141d Mon Sep 17 00:00:00 2001
From: Tim Donohue <tim.donohue@lyrasis.org>
Date: Tue, 3 Dec 2024 12:07:18 -0600
Subject: [PATCH 1/9] Ensure login occurs *before* setup-buildx, as some buildx
 commands appear to be unauthenticated.

---
 .github/workflows/reusable-docker-build.yml | 36 ++++++++++-----------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/reusable-docker-build.yml b/.github/workflows/reusable-docker-build.yml
index 91aa93c54a..615a06bdf3 100644
--- a/.github/workflows/reusable-docker-build.yml
+++ b/.github/workflows/reusable-docker-build.yml
@@ -105,29 +105,29 @@ jobs:
       - name: Checkout codebase
         uses: actions/checkout@v4
 
-      # https://github.com/docker/setup-buildx-action
-      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@v3
+      # https://github.com/docker/login-action
+      - name: Login to DockerHub
+      # Only login if not a PR, as PRs only trigger a Docker build and not a push
+        if: ${{ ! matrix.isPr }}
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
 
       # https://github.com/docker/setup-qemu-action
       - name: Set up QEMU emulation to build for multiple architectures
         uses: docker/setup-qemu-action@v3
 
+      # https://github.com/docker/setup-buildx-action
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       #------------------------------------------------------------
       # Build & deploy steps for new commits to a branch (non-PRs)
       #
       # These steps build the images, push to DockerHub, and
       # (if necessary) redeploy demo/sandbox sites.
       #------------------------------------------------------------
-      # https://github.com/docker/login-action
-      - name: Login to DockerHub
-        # Only login if not a PR, as PRs only trigger a Docker build and not a push
-        if: ${{ ! matrix.isPr }}
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
-
       # https://github.com/docker/metadata-action
       # Get Metadata for docker_build_deps step below
       - name: Sync metadata (tags, labels) from GitHub to Docker for image
@@ -257,6 +257,12 @@ jobs:
           pattern: digests-${{ inputs.build_id }}-*
           merge-multiple: true
 
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -268,12 +274,6 @@ jobs:
           tags: ${{ env.IMAGE_TAGS }}
           flavor: ${{ env.TAGS_FLAVOR }}
 
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
-
       - name: Create manifest list from digests and push
         working-directory: /tmp/digests
         run: |

From fe2e9d506e17a83405bfba313c436050832b1dad Mon Sep 17 00:00:00 2001
From: Tim Donohue <tim.donohue@lyrasis.org>
Date: Thu, 5 Dec 2024 10:39:34 -0600
Subject: [PATCH 2/9] Update Actions to always deploy the locally created
 image. non-PRs do not need to redownload images from DockerHub.

---
 .github/workflows/docker.yml                | 24 ++++++++++-----------
 .github/workflows/reusable-docker-build.yml | 21 ++++++++++++++----
 2 files changed, 28 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 7e7cbc1b07..131cf956d5 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -149,9 +149,9 @@ jobs:
       DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
       DOCKER_ACCESS_TOKEN: ${{ secrets.DOCKER_ACCESS_TOKEN }}
 
-  ########################################################################
-  # Test Deployment via Docker to ensure images are working properly
-  ########################################################################
+  #################################################################################
+  # Test Deployment via Docker to ensure newly built images are working properly
+  #################################################################################
   docker-deploy:
     # Ensure this job never runs on forked repos. It's only executed for 'dspace/dspace'
     if: github.repository == 'dspace/dspace'
@@ -172,25 +172,23 @@ jobs:
       swordv2__D__server__P__enabled: true
       # If this is a PR, force using "pr-testing" version of all Docker images. Otherwise, if on main branch, use the
       # "latest" tag. Otherwise, use the branch name. NOTE: the "pr-testing" tag is a temporary tag that we assign to
-      # all PR-built docker images in reusabe-docker-build.yml
+      # all PR-built docker images in reusable-docker-build.yml
       DSPACE_VER: ${{ (github.event_name == 'pull_request' && 'pr-testing') || (github.ref_name == github.event.repository.default_branch && 'latest') || github.ref_name }}
     steps:
       # Checkout our codebase (to get access to Docker Compose scripts)
       - name: Checkout codebase
         uses: actions/checkout@v4
-      # For PRs, download Docker image artifacts (built by reusable-docker-build.yml for all PRs)
-      - name: Download Docker image artifacts (for PRs)
-        if: github.event_name == 'pull_request'
+      # Download Docker image artifacts (which were just built by reusable-docker-build.yml)
+      - name: Download Docker image artifacts
         uses: actions/download-artifact@v4
         with:
-          # Download all Docker images (TAR files) into the /tmp/docker directory
-          pattern: docker-image-*
+          # Download all amd64 Docker images (TAR files) into the /tmp/docker directory
+          pattern: docker-image-*-linux-amd64
           path: /tmp/docker
           merge-multiple: true
-      # For PRs, load each of the images into Docker by calling "docker image load" for each.
-      # This ensures we are using the images built from this PR & not the prior versions on DockerHub
-      - name: Load all downloaded Docker images (for PRs)
-        if: github.event_name == 'pull_request'
+      # Load each of the images into Docker by calling "docker image load" for each.
+      # This ensures we are using the images just built & not any prior versions on DockerHub
+      - name: Load all downloaded Docker images
         run: |
           find /tmp/docker -type f -name "*.tar" -exec docker image load --input "{}" \;
           docker image ls -a
diff --git a/.github/workflows/reusable-docker-build.yml b/.github/workflows/reusable-docker-build.yml
index 615a06bdf3..782a65a8b1 100644
--- a/.github/workflows/reusable-docker-build.yml
+++ b/.github/workflows/reusable-docker-build.yml
@@ -130,7 +130,7 @@ jobs:
       #------------------------------------------------------------
       # https://github.com/docker/metadata-action
       # Get Metadata for docker_build_deps step below
-      - name: Sync metadata (tags, labels) from GitHub to Docker for image
+      - name: Extract metadata (tags, labels) from GitHub for Docker image
         if: ${{ ! matrix.isPr }}
         id: meta_build
         uses: docker/metadata-action@v5
@@ -151,10 +151,23 @@ jobs:
           context: ${{ inputs.dockerfile_context }}
           file: ${{ inputs.dockerfile_path }}
           platforms: ${{ matrix.arch }}
-          push: true
           # Use tags / labels provided by 'docker/metadata-action' above
           tags: ${{ steps.meta_build.outputs.tags }}
           labels: ${{ steps.meta_build.outputs.labels }}
+          # Export image to both Docker registry & to a local TAR file
+          outputs: |
+            registry
+            type=docker,dest=/tmp/${{ inputs.build_id }}.tar
+
+      # Upload the local docker image (in TAR file) to a build Artifact
+      - name: Upload local image to artifact
+        if: ${{ ! matrix.isPr }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: docker-image-${{ inputs.build_id }}-${{ env.ARCH_NAME }}
+          path: /tmp/${{ inputs.build_id }}.tar
+          if-no-files-found: error
+          retention-days: 1
 
       # Export the digest of Docker build locally (for non PRs only)
       - name: Export Docker build digest
@@ -204,7 +217,7 @@ jobs:
       # brand-new images for automated testing.
       #--------------------------------------------------------------
       # Get Metadata for docker_build_deps step below
-      - name: Create metadata (tags, labels) for local Docker image
+      - name: Extract metadata (tags, labels) for local Docker image
         if: matrix.isPr
         id: meta_build_pr
         uses: docker/metadata-action@v5
@@ -233,7 +246,7 @@ jobs:
         if: matrix.isPr
         uses: actions/upload-artifact@v4
         with:
-          name: docker-image-${{ inputs.build_id }}
+          name: docker-image-${{ inputs.build_id }}-${{ env.ARCH_NAME }}
           path: /tmp/${{ inputs.build_id }}.tar
           if-no-files-found: error
           retention-days: 1

From c39cd1dd9a387ecd7f5c02336c6b71d2943c204d Mon Sep 17 00:00:00 2001
From: Tim Donohue <tim.donohue@lyrasis.org>
Date: Thu, 5 Dec 2024 11:24:31 -0600
Subject: [PATCH 3/9] Ensure non-PRs run image build twice. First for a
 DockerHub image, then to export a local tarball. Since these are different
 image types they cannot be combined

---
 .github/workflows/reusable-docker-build.yml | 41 ++++++++++++++-------
 1 file changed, 27 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/reusable-docker-build.yml b/.github/workflows/reusable-docker-build.yml
index 782a65a8b1..365d1e89e1 100644
--- a/.github/workflows/reusable-docker-build.yml
+++ b/.github/workflows/reusable-docker-build.yml
@@ -151,23 +151,10 @@ jobs:
           context: ${{ inputs.dockerfile_context }}
           file: ${{ inputs.dockerfile_path }}
           platforms: ${{ matrix.arch }}
+          push: true
           # Use tags / labels provided by 'docker/metadata-action' above
           tags: ${{ steps.meta_build.outputs.tags }}
           labels: ${{ steps.meta_build.outputs.labels }}
-          # Export image to both Docker registry & to a local TAR file
-          outputs: |
-            registry
-            type=docker,dest=/tmp/${{ inputs.build_id }}.tar
-
-      # Upload the local docker image (in TAR file) to a build Artifact
-      - name: Upload local image to artifact
-        if: ${{ ! matrix.isPr }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: docker-image-${{ inputs.build_id }}-${{ env.ARCH_NAME }}
-          path: /tmp/${{ inputs.build_id }}.tar
-          if-no-files-found: error
-          retention-days: 1
 
       # Export the digest of Docker build locally (for non PRs only)
       - name: Export Docker build digest
@@ -187,6 +174,32 @@ jobs:
           if-no-files-found: error
           retention-days: 1
 
+      # Build local image (again) and store in a TAR file in /tmp directory
+      # NOTE: This cannot be combined with push to DockerHub registry above as it's a different type of output.
+      - name: Build and push image to local image
+        if: ${{ ! matrix.isPr }}
+        uses: docker/build-push-action@v5
+        with:
+          build-contexts: |
+            ${{ inputs.dockerfile_additional_contexts }}
+          context: ${{ inputs.dockerfile_context }}
+          file: ${{ inputs.dockerfile_path }}
+          platforms: ${{ matrix.arch }}
+          tags: ${{ steps.meta_build.outputs.tags }}
+          labels: ${{ steps.meta_build.outputs.labels }}
+          # Export image to a local TAR file
+          outputs: type=docker,dest=/tmp/${{ inputs.build_id }}.tar
+
+      # Upload the local docker image (in TAR file) to a build Artifact
+      - name: Upload local image to artifact
+        if: ${{ ! matrix.isPr }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: docker-image-${{ inputs.build_id }}-${{ env.ARCH_NAME }}
+          path: /tmp/${{ inputs.build_id }}.tar
+          if-no-files-found: error
+          retention-days: 1
+
       # If this build is NOT a PR and passed in a REDEPLOY_SANDBOX_URL secret,
       # Then redeploy https://sandbox.dspace.org if this build is for our deployment architecture and 'main' branch.
       - name: Redeploy sandbox.dspace.org (based on main branch)

From e122ff0b4005608ac765b02df9a1e9add1407de7 Mon Sep 17 00:00:00 2001
From: Tim Donohue <tim.donohue@lyrasis.org>
Date: Fri, 6 Dec 2024 11:26:59 -0600
Subject: [PATCH 4/9] Enable caching of Docker builds using GitHub Actions
 cache

---
 .github/workflows/reusable-docker-build.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/reusable-docker-build.yml b/.github/workflows/reusable-docker-build.yml
index 365d1e89e1..5377d3c275 100644
--- a/.github/workflows/reusable-docker-build.yml
+++ b/.github/workflows/reusable-docker-build.yml
@@ -155,6 +155,10 @@ jobs:
           # Use tags / labels provided by 'docker/metadata-action' above
           tags: ${{ steps.meta_build.outputs.tags }}
           labels: ${{ steps.meta_build.outputs.labels }}
+          # Use GitHub cache to load cached Docker images and cache the results of this build
+          # This decreases the number of images we need to fetch from DockerHub
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
 
       # Export the digest of Docker build locally (for non PRs only)
       - name: Export Docker build digest
@@ -240,6 +244,7 @@ jobs:
           # for testing in docker.yml
           tags: pr-testing
           flavor: ${{ env.TAGS_FLAVOR }}
+
       # Build local image and stores in a TAR file in /tmp directory
       - name: Build and push image to local image
         if: matrix.isPr
@@ -252,8 +257,13 @@ jobs:
           platforms: ${{ matrix.arch }}
           tags: ${{ steps.meta_build_pr.outputs.tags }}
           labels: ${{ steps.meta_build_pr.outputs.labels }}
+          # Use GitHub cache to load cached Docker images and cache the results of this build
+          # This decreases the number of images we need to fetch from DockerHub
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
           # Export image to a local TAR file
           outputs: type=docker,dest=/tmp/${{ inputs.build_id }}.tar
+
       # Upload the local docker image (in TAR file) to a build Artifact
       - name: Upload local image to artifact
         if: matrix.isPr

From 7bd3b47202545e997d6422c01d3248d1bbfd2438 Mon Sep 17 00:00:00 2001
From: Tim Donohue <tim.donohue@lyrasis.org>
Date: Fri, 6 Dec 2024 12:51:07 -0600
Subject: [PATCH 5/9] Refactor to use the same local TAR image build for PRs
 and non-PRs. These TAR images act as a cache for our current build.

---
 .github/workflows/docker.yml                |  4 --
 .github/workflows/reusable-docker-build.yml | 76 ++++++---------------
 2 files changed, 20 insertions(+), 60 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 131cf956d5..241a7acce9 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -170,10 +170,6 @@ jobs:
       signposting__P__enabled: true
       sword__D__server__P__enabled: true
       swordv2__D__server__P__enabled: true
-      # If this is a PR, force using "pr-testing" version of all Docker images. Otherwise, if on main branch, use the
-      # "latest" tag. Otherwise, use the branch name. NOTE: the "pr-testing" tag is a temporary tag that we assign to
-      # all PR-built docker images in reusable-docker-build.yml
-      DSPACE_VER: ${{ (github.event_name == 'pull_request' && 'pr-testing') || (github.ref_name == github.event.repository.default_branch && 'latest') || github.ref_name }}
     steps:
       # Checkout our codebase (to get access to Docker Compose scripts)
       - name: Checkout codebase
diff --git a/.github/workflows/reusable-docker-build.yml b/.github/workflows/reusable-docker-build.yml
index 5377d3c275..6a45fef2c1 100644
--- a/.github/workflows/reusable-docker-build.yml
+++ b/.github/workflows/reusable-docker-build.yml
@@ -122,16 +122,9 @@ jobs:
       - name: Setup Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      #------------------------------------------------------------
-      # Build & deploy steps for new commits to a branch (non-PRs)
-      #
-      # These steps build the images, push to DockerHub, and
-      # (if necessary) redeploy demo/sandbox sites.
-      #------------------------------------------------------------
       # https://github.com/docker/metadata-action
-      # Get Metadata for docker_build_deps step below
+      # Extract metadata used for Docker images in all build steps below
       - name: Extract metadata (tags, labels) from GitHub for Docker image
-        if: ${{ ! matrix.isPr }}
         id: meta_build
         uses: docker/metadata-action@v5
         with:
@@ -139,6 +132,12 @@ jobs:
           tags: ${{ env.IMAGE_TAGS }}
           flavor: ${{ env.TAGS_FLAVOR }}
 
+      #------------------------------------------------------------
+      # Build & deploy steps for new commits to a branch (non-PRs)
+      #
+      # These steps build the images, push to DockerHub, and
+      # (if necessary) redeploy demo/sandbox sites.
+      #------------------------------------------------------------
       # https://github.com/docker/build-push-action
       - name: Build and push image to DockerHub
         # Only build & push if not a PR
@@ -178,32 +177,6 @@ jobs:
           if-no-files-found: error
           retention-days: 1
 
-      # Build local image (again) and store in a TAR file in /tmp directory
-      # NOTE: This cannot be combined with push to DockerHub registry above as it's a different type of output.
-      - name: Build and push image to local image
-        if: ${{ ! matrix.isPr }}
-        uses: docker/build-push-action@v5
-        with:
-          build-contexts: |
-            ${{ inputs.dockerfile_additional_contexts }}
-          context: ${{ inputs.dockerfile_context }}
-          file: ${{ inputs.dockerfile_path }}
-          platforms: ${{ matrix.arch }}
-          tags: ${{ steps.meta_build.outputs.tags }}
-          labels: ${{ steps.meta_build.outputs.labels }}
-          # Export image to a local TAR file
-          outputs: type=docker,dest=/tmp/${{ inputs.build_id }}.tar
-
-      # Upload the local docker image (in TAR file) to a build Artifact
-      - name: Upload local image to artifact
-        if: ${{ ! matrix.isPr }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: docker-image-${{ inputs.build_id }}-${{ env.ARCH_NAME }}
-          path: /tmp/${{ inputs.build_id }}.tar
-          if-no-files-found: error
-          retention-days: 1
-
       # If this build is NOT a PR and passed in a REDEPLOY_SANDBOX_URL secret,
       # Then redeploy https://sandbox.dspace.org if this build is for our deployment architecture and 'main' branch.
       - name: Redeploy sandbox.dspace.org (based on main branch)
@@ -227,27 +200,19 @@ jobs:
           curl -X POST $REDEPLOY_DEMO_URL
 
       #-------------------------------------------------------------
-      # Build steps for PRs only
+      # Shared Build steps.
+      # These are used for PRs as well as new commits to a branch (non-PRs)
       #
-      # These steps build the images and store as a build artifact.
-      # These artifacts can then be used by later jobs to run the
-      # brand-new images for automated testing.
+      # These steps build the images and cache/store as a build artifact.
+      # These artifacts can then be used by later jobs to install the
+      # brand-new images for automated testing. For non-PRs, this cache is
+      # also used to avoid pulling the images we just built from DockerHub.
       #--------------------------------------------------------------
-      # Get Metadata for docker_build_deps step below
-      - name: Extract metadata (tags, labels) for local Docker image
-        if: matrix.isPr
-        id: meta_build_pr
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.IMAGE_NAME }}
-          # Hardcode to use custom "pr-testing" tag because that will allow us to spin up this PR
-          # for testing in docker.yml
-          tags: pr-testing
-          flavor: ${{ env.TAGS_FLAVOR }}
 
-      # Build local image and stores in a TAR file in /tmp directory
-      - name: Build and push image to local image
-        if: matrix.isPr
+      # Build local image (again) and store in a TAR file in /tmp directory
+      # NOTE: This build is run for both PRs and non-PRs as it's used to "cache" our built images as artifacts.
+      # NOTE #2: This cannot be combined with push to DockerHub registry above as it's a different type of output.
+      - name: Build and push image to local TAR file
         uses: docker/build-push-action@v5
         with:
           build-contexts: |
@@ -255,8 +220,8 @@ jobs:
           context: ${{ inputs.dockerfile_context }}
           file: ${{ inputs.dockerfile_path }}
           platforms: ${{ matrix.arch }}
-          tags: ${{ steps.meta_build_pr.outputs.tags }}
-          labels: ${{ steps.meta_build_pr.outputs.labels }}
+          tags: ${{ steps.meta_build.outputs.tags }}
+          labels: ${{ steps.meta_build.outputs.labels }}
           # Use GitHub cache to load cached Docker images and cache the results of this build
           # This decreases the number of images we need to fetch from DockerHub
           cache-from: type=gha
@@ -265,8 +230,7 @@ jobs:
           outputs: type=docker,dest=/tmp/${{ inputs.build_id }}.tar
 
       # Upload the local docker image (in TAR file) to a build Artifact
-      - name: Upload local image to artifact
-        if: matrix.isPr
+      - name: Upload local image TAR to artifact
         uses: actions/upload-artifact@v4
         with:
           name: docker-image-${{ inputs.build_id }}-${{ env.ARCH_NAME }}

From 24851eb1039f2d6cd62a816d1476599a8068de7f Mon Sep 17 00:00:00 2001
From: Tim Donohue <tim.donohue@lyrasis.org>
Date: Fri, 6 Dec 2024 14:12:28 -0600
Subject: [PATCH 6/9] Ensure PRs are tagging their images with same tag as the
 base branch the PR was created against

---
 .github/workflows/reusable-docker-build.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/reusable-docker-build.yml b/.github/workflows/reusable-docker-build.yml
index 6a45fef2c1..6329808434 100644
--- a/.github/workflows/reusable-docker-build.yml
+++ b/.github/workflows/reusable-docker-build.yml
@@ -54,10 +54,13 @@ env:
   # For a new commit on default branch (main), use the literal tag 'latest' on Docker image.
   # For a new commit on other branches, use the branch name as the tag for Docker image.
   # For a new tag, copy that tag name as the tag for Docker image.
+  # For a pull request, use the name of the base branch that the PR was created against or "latest" (for main).
+  #   e.g. PR against 'main' will use "latest". a PR against 'dspace-7_x' will use 'dspace-7_x'.
   IMAGE_TAGS: |
     type=raw,value=latest,enable=${{ github.ref_name == github.event.repository.default_branch }}
     type=ref,event=branch,enable=${{ github.ref_name != github.event.repository.default_branch }}
     type=ref,event=tag
+    type=raw,value=${{ (github.event.pull_request.base.ref == github.event.repository.default_branch && 'latest') || github.event.pull_request.base.ref }},enable=${{ github.event_name == 'pull_request' }}
   # Define default tag "flavor" for docker/metadata-action per
   # https://github.com/docker/metadata-action#flavor-input
   # We manage the 'latest' tag ourselves to the 'main' branch (see settings above)

From faf92a293d61c815c1be4c98a89d002e1e650bb4 Mon Sep 17 00:00:00 2001
From: Tim Donohue <tim.donohue@lyrasis.org>
Date: Fri, 6 Dec 2024 15:01:08 -0600
Subject: [PATCH 7/9] Ensure each image has a separate cache. This allows later
 builds of that same image to inherit that cache.

---
 .github/workflows/reusable-docker-build.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/reusable-docker-build.yml b/.github/workflows/reusable-docker-build.yml
index 6329808434..a6e3268460 100644
--- a/.github/workflows/reusable-docker-build.yml
+++ b/.github/workflows/reusable-docker-build.yml
@@ -159,8 +159,8 @@ jobs:
           labels: ${{ steps.meta_build.outputs.labels }}
           # Use GitHub cache to load cached Docker images and cache the results of this build
           # This decreases the number of images we need to fetch from DockerHub
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=${{ inputs.build_id }}
+          cache-to: type=gha,scope=${{ inputs.build_id }},mode=max
 
       # Export the digest of Docker build locally (for non PRs only)
       - name: Export Docker build digest
@@ -227,8 +227,8 @@ jobs:
           labels: ${{ steps.meta_build.outputs.labels }}
           # Use GitHub cache to load cached Docker images and cache the results of this build
           # This decreases the number of images we need to fetch from DockerHub
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=${{ inputs.build_id }}
+          cache-to: type=gha,scope=${{ inputs.build_id }},mode=max
           # Export image to a local TAR file
           outputs: type=docker,dest=/tmp/${{ inputs.build_id }}.tar
 

From c34cc056edf837153e187a20bb2ad59adec3fb96 Mon Sep 17 00:00:00 2001
From: Tim Donohue <tim.donohue@lyrasis.org>
Date: Fri, 6 Dec 2024 17:13:59 -0600
Subject: [PATCH 8/9] Fix incorrect default version in Docker Compose scripts.
 8.x should default to dspace-8_x

---
 docker-compose.yml                                        | 4 ++--
 dspace/src/main/docker-compose/db.entities.yml            | 2 +-
 dspace/src/main/docker-compose/db.restore.yml             | 2 +-
 dspace/src/main/docker-compose/docker-compose-angular.yml | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 4322c71734..8886443824 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -64,7 +64,7 @@ services:
   dspacedb:
     container_name: dspacedb
     # Uses a custom Postgres image with pgcrypto installed
-    image: "${DOCKER_OWNER:-dspace}/dspace-postgres-pgcrypto:${DSPACE_VER:-latest}"
+    image: "${DOCKER_OWNER:-dspace}/dspace-postgres-pgcrypto:${DSPACE_VER:-dspace-8_x}"
     build:
       # Must build out of subdirectory to have access to install script for pgcrypto
       context: ./dspace/src/main/docker/dspace-postgres-pgcrypto/
@@ -84,7 +84,7 @@ services:
   # DSpace Solr container
   dspacesolr:
     container_name: dspacesolr
-    image: "${DOCKER_OWNER:-dspace}/dspace-solr:${DSPACE_VER:-latest}"
+    image: "${DOCKER_OWNER:-dspace}/dspace-solr:${DSPACE_VER:-dspace-8_x}"
     build:
       context: ./dspace/src/main/docker/dspace-solr/
       # Provide path to Solr configs necessary to build Docker image
diff --git a/dspace/src/main/docker-compose/db.entities.yml b/dspace/src/main/docker-compose/db.entities.yml
index 931d04942d..243511ddae 100644
--- a/dspace/src/main/docker-compose/db.entities.yml
+++ b/dspace/src/main/docker-compose/db.entities.yml
@@ -8,7 +8,7 @@
 
 services:
   dspacedb:
-    image: dspace/dspace-postgres-pgcrypto:${DSPACE_VER:-latest}-loadsql
+    image: dspace/dspace-postgres-pgcrypto:${DSPACE_VER:-dspace-8_x}-loadsql
     environment:
       # This SQL is available from https://github.com/DSpace-Labs/AIP-Files/releases/tag/demo-entities-data
       - LOADSQL=https://github.com/DSpace-Labs/AIP-Files/releases/download/demo-entities-data/dspace7-entities-data.sql
diff --git a/dspace/src/main/docker-compose/db.restore.yml b/dspace/src/main/docker-compose/db.restore.yml
index ffeca1e598..dc3993a78c 100644
--- a/dspace/src/main/docker-compose/db.restore.yml
+++ b/dspace/src/main/docker-compose/db.restore.yml
@@ -12,7 +12,7 @@
 # This can be used to restore a "dspacedb" container from a pg_dump, or during upgrade to a new version of PostgreSQL.
 services:
   dspacedb:
-    image: dspace/dspace-postgres-pgcrypto:${DSPACE_VER:-latest}-loadsql
+    image: dspace/dspace-postgres-pgcrypto:${DSPACE_VER:-dspace-8_x}-loadsql
     environment:
       # Location where the dump SQL file will be available on the running container
       - LOCALSQL=/tmp/pgdump.sql
diff --git a/dspace/src/main/docker-compose/docker-compose-angular.yml b/dspace/src/main/docker-compose/docker-compose-angular.yml
index dc837c5c99..3610d23286 100644
--- a/dspace/src/main/docker-compose/docker-compose-angular.yml
+++ b/dspace/src/main/docker-compose/docker-compose-angular.yml
@@ -26,7 +26,7 @@ services:
       DSPACE_REST_HOST: localhost
       DSPACE_REST_PORT: 8080
       DSPACE_REST_NAMESPACE: /server
-    image: dspace/dspace-angular:${DSPACE_VER:-latest}
+    image: dspace/dspace-angular:${DSPACE_VER:-dspace-8_x}
     ports:
     - published: 4000
       target: 4000

From 203fb7a912d87b8ec0d27459bb00fe9ab8c86040 Mon Sep 17 00:00:00 2001
From: Tim Donohue <tim.donohue@lyrasis.org>
Date: Mon, 9 Dec 2024 10:18:32 -0600
Subject: [PATCH 9/9] Ensure we use the main Docker image, and not the "-test"
 image.

---
 .github/workflows/docker.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 241a7acce9..64597ff568 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -170,6 +170,9 @@ jobs:
       signposting__P__enabled: true
       sword__D__server__P__enabled: true
       swordv2__D__server__P__enabled: true
+      # If this is a PR, used the base branch name. If on main branch, use the "latest" tag. Otherwise, use branch name.
+      # NOTE: DSPACE_VER is used because our docker compose scripts default to using the "-test" image.
+      DSPACE_VER: ${{ (github.event_name == 'pull_request' && github.event.pull_request.base.ref) || (github.ref_name == github.event.repository.default_branch && 'latest') || github.ref_name }}
     steps:
       # Checkout our codebase (to get access to Docker Compose scripts)
       - name: Checkout codebase