perf(cluster): narrow docker invalidation for faster warm rebuilds

Stop touching gateway and supervisor main sources in Docker builds so unrelated edits keep incremental cache hits while retaining proto/build.rs invalidation safety.

Made-with: Cursor

architecture/build-containers.md

@@ -41,6 +41,11 @@ For local (non-CI) Docker builds, OpenShell defaults to the Cargo profile
 `local-fast` to reduce rebuild latency. CI keeps `release` builds by default.
 Set `OPENSHELL_CARGO_PROFILE=release` locally when you need release-equivalent binaries.
 
+The Dockerfiles keep the proto/build-script invalidation touch, but they no
+longer touch gateway/supervisor main sources. That preserves incremental reuse
+for unrelated rebuilds while still forcing protobuf regeneration safety when
+needed.
+
 The incremental deploy (`cluster-deploy-fast.sh`) fingerprints local Git changes and only rebuilds components whose files have changed:
 
 | Changed files | Rebuild triggered |

crates/openshell-core/build.rs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use std::env;
+use std::path::Path;
 
 fn main() -> Result<(), Box<dyn std::error::Error>> {
     // --- Git-derived version ---
@@ -9,8 +10,17 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     // builds where .git is absent, this silently does nothing and the binary
     // falls back to CARGO_PKG_VERSION (which is already sed-patched by the
     // build pipeline).
-    println!("cargo:rerun-if-changed=../../.git/HEAD");
-    println!("cargo:rerun-if-changed=../../.git/refs/tags");
+    // In Docker builds we do not copy .git into the context, so registering
+    // missing rerun paths can force unnecessary build script churn.
+    if Path::new("../../.git/HEAD").exists() {
+        println!("cargo:rerun-if-changed=../../.git/HEAD");
+    }
+    if Path::new("../../.git/refs/tags").exists() {
+        println!("cargo:rerun-if-changed=../../.git/refs/tags");
+    }
+    if Path::new("../../.git/packed-refs").exists() {
+        println!("cargo:rerun-if-changed=../../.git/packed-refs");
+    }
 
     if let Some(version) = git_version() {
         println!("cargo:rustc-env=OPENSHELL_GIT_VERSION={version}");

deploy/docker/Dockerfile.cluster

@@ -134,9 +134,11 @@ RUN --mount=type=cache,id=cargo-registry-supervisor-${TARGETARCH},sharing=locked
 # Copy actual source code
 COPY crates/ crates/
 
-# Touch source files to ensure they're rebuilt (not the cached dummy)
-RUN touch crates/openshell-sandbox/src/main.rs \
-    crates/openshell-core/build.rs \
+# Touch build.rs and proto files to force proto code regeneration when the
+# cargo target cache mount retains stale OUT_DIR artifacts from prior builds.
+# Do not touch supervisor sources here; that defeats incremental reuse for
+# unrelated changes and makes inner-loop builds slower.
+RUN touch crates/openshell-core/build.rs \
     proto/*.proto
 
 # Build the supervisor binary

deploy/docker/Dockerfile.gateway

@@ -68,11 +68,11 @@ RUN --mount=type=cache,id=cargo-registry-gateway-${TARGETARCH},sharing=locked,ta
 # Copy actual source code
 COPY crates/ crates/
 
-# Touch source files to ensure they're rebuilt (not the cached dummy).
 # Touch build.rs and proto files to force proto code regeneration when the
 # cargo target cache mount retains stale OUT_DIR artifacts from prior builds.
-RUN touch crates/openshell-server/src/main.rs \
-    crates/openshell-core/build.rs \
+# Do not touch service sources here; that defeats incremental reuse for
+# unrelated changes and makes inner-loop builds slower.
+RUN touch crates/openshell-core/build.rs \
     proto/*.proto
 
 # Build the actual application