ci: content-addressed token-storage-detection builds (skip when unchanged)

.github/workflows/release.yaml

@@ -30,7 +30,43 @@
           gcp_registry: 'us-west1-docker.pkg.dev/artifact-registry-1191/mee-node/mee-node'
           gcp_service_account: 'sa-mee-node@workload-identity-e697.iam.gserviceaccount.com'
 
+      tsd_change_check:
+        # token-storage-detection rarely changes but its Rust build costs ~10 min
+        # on every release. Content-address the image by the git TREE hash of
+        # apps/token-storage-detection: if tsd:tree-<hash> already exists in AR,
+        # skip the build and retag the existing image with this release tag.
+        runs-on: ubuntu-latest
+        permissions:
+          id-token: write
+          contents: read
+        outputs:
+          tree: ${{ steps.tree.outputs.tree }}
+          exists: ${{ steps.probe.outputs.exists }}
+        steps:
+          - uses: actions/checkout@v4
+          - id: tree
+            run: echo "tree=$(git rev-parse HEAD:apps/token-storage-detection)" >> "$GITHUB_OUTPUT"
+          - id: auth
+            uses: google-github-actions/auth@v2
+            with:
+              workload_identity_provider: 'projects/334188102066/locations/global/workloadIdentityPools/github-pool/providers/github-actions-wif-provider'
+              service_account: 'sa-mee-node@workload-identity-e697.iam.gserviceaccount.com'
+              token_format: access_token
+          - uses: google-github-actions/setup-gcloud@v2
+          - id: probe
+            run: |
+              IMG=us-west1-docker.pkg.dev/artifact-registry-1191/mee-node/token-storage-detection
+              if gcloud artifacts docker images describe "$IMG:tree-${{ steps.tree.outputs.tree }}" >/dev/null 2>&1; then
+                echo "exists=true" >> "$GITHUB_OUTPUT"
+              else
+                echo "exists=false" >> "$GITHUB_OUTPUT"
+              fi
+
       token-storage-container_img_build_push_gar:
+        # Runs ONLY when apps/token-storage-detection actually changed since the
+        # last content-addressed build (see tsd_change_check).
+        needs: [tsd_change_check]
+        if: needs.tsd_change_check.outputs.exists != 'true'
         # Allow the job to fetch a GitHub ID token
         permissions:
           id-token: write
@@ -57,6 +93,37 @@
           gcp_registry: 'us-west1-docker.pkg.dev/artifact-registry-1191/mee-node/token-storage-detection'
           gcp_service_account: 'sa-mee-node@workload-identity-e697.iam.gserviceaccount.com'
 
+      tsd_ensure_tags:
+        # Two directions, one invariant: every release tag has a t-s-d image and
+        # every t-s-d image is content-addressed.
+        # - source unchanged (build skipped): retag tree-<hash> -> <release tag>
+        # - source changed (fresh build):     tag <release tag> -> tree-<hash>
+        needs: [tsd_change_check, token-storage-container_img_build_push_gar]
+        if: always() && needs.tsd_change_check.result == 'success' && (needs['token-storage-container_img_build_push_gar'].result == 'success' || needs['token-storage-container_img_build_push_gar'].result == 'skipped')
+        runs-on: ubuntu-latest
+        permissions:
+          id-token: write
+          contents: read
+        steps:
+          - id: auth
+            uses: google-github-actions/auth@v2
+            with:
+              workload_identity_provider: 'projects/334188102066/locations/global/workloadIdentityPools/github-pool/providers/github-actions-wif-provider'
+              service_account: 'sa-mee-node@workload-identity-e697.iam.gserviceaccount.com'
+              token_format: access_token
+          - uses: google-github-actions/setup-gcloud@v2
+          - run: |
+              IMG=us-west1-docker.pkg.dev/artifact-registry-1191/mee-node/token-storage-detection
+              TREE="tree-${{ needs.tsd_change_check.outputs.tree }}"
+              REL="${GITHUB_REF_NAME}"
+              if [ "${{ needs.tsd_change_check.outputs.exists }}" = "true" ]; then
+                echo "t-s-d unchanged: retagging $TREE -> $REL (no build)"
+                gcloud artifacts docker tags add "$IMG:$TREE" "$IMG:$REL"
+              else
+                echo "t-s-d changed: content-addressing fresh build $REL -> $TREE"
+                gcloud artifacts docker tags add "$IMG:$REL" "$IMG:$TREE"
+              fi
+
       deploy_staging:
         needs: [container_img_build_push_gar]
         # Allow the job to fetch a GitHub ID token