From fdb61a707aaa332837e12c4d648679fca8f8beb0 Mon Sep 17 00:00:00 2001
From: John Myers <9696606+johntmyers@users.noreply.github.com>
Date: Mon, 16 Mar 2026 12:29:01 -0700
Subject: [PATCH] perf(cluster): narrow docker invalidation for faster warm
 rebuilds

Stop touching gateway and supervisor main sources in Docker builds so unrelated edits keep incremental cache hits while retaining proto/build.rs invalidation safety.

Made-with: Cursor
---
 architecture/build-containers.md |  5 +++++
 crates/openshell-core/build.rs   | 14 ++++++++++++--
 deploy/docker/Dockerfile.cluster |  8 +++++---
 deploy/docker/Dockerfile.gateway |  6 +++---
 4 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/architecture/build-containers.md b/architecture/build-containers.md
index 5b4d0c54b..f6eb28ec1 100644
--- a/architecture/build-containers.md
+++ b/architecture/build-containers.md
@@ -41,6 +41,11 @@ For local (non-CI) Docker builds, OpenShell defaults to the Cargo profile
 `local-fast` to reduce rebuild latency. CI keeps `release` builds by default.
 Set `OPENSHELL_CARGO_PROFILE=release` locally when you need release-equivalent binaries.
 
+The Dockerfiles keep the proto/build-script invalidation touch, but they no
+longer touch gateway/supervisor main sources. That preserves incremental reuse
+for unrelated rebuilds while still forcing protobuf regeneration safety when
+needed.
+
 The incremental deploy (`cluster-deploy-fast.sh`) fingerprints local Git changes and only rebuilds components whose files have changed:
 
 | Changed files | Rebuild triggered |
diff --git a/crates/openshell-core/build.rs b/crates/openshell-core/build.rs
index c06702c5c..b1c4c43b6 100644
--- a/crates/openshell-core/build.rs
+++ b/crates/openshell-core/build.rs
@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use std::env;
+use std::path::Path;
 
 fn main() -> Result<(), Box<dyn std::error::Error>> {
     // --- Git-derived version ---
@@ -9,8 +10,17 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     // builds where .git is absent, this silently does nothing and the binary
     // falls back to CARGO_PKG_VERSION (which is already sed-patched by the
     // build pipeline).
-    println!("cargo:rerun-if-changed=../../.git/HEAD");
-    println!("cargo:rerun-if-changed=../../.git/refs/tags");
+    // In Docker builds we do not copy .git into the context, so registering
+    // missing rerun paths can force unnecessary build script churn.
+    if Path::new("../../.git/HEAD").exists() {
+        println!("cargo:rerun-if-changed=../../.git/HEAD");
+    }
+    if Path::new("../../.git/refs/tags").exists() {
+        println!("cargo:rerun-if-changed=../../.git/refs/tags");
+    }
+    if Path::new("../../.git/packed-refs").exists() {
+        println!("cargo:rerun-if-changed=../../.git/packed-refs");
+    }
 
     if let Some(version) = git_version() {
         println!("cargo:rustc-env=OPENSHELL_GIT_VERSION={version}");
diff --git a/deploy/docker/Dockerfile.cluster b/deploy/docker/Dockerfile.cluster
index 2692c6cd6..7b2a37552 100644
--- a/deploy/docker/Dockerfile.cluster
+++ b/deploy/docker/Dockerfile.cluster
@@ -134,9 +134,11 @@ RUN --mount=type=cache,id=cargo-registry-supervisor-${TARGETARCH},sharing=locked
 # Copy actual source code
 COPY crates/ crates/
 
-# Touch source files to ensure they're rebuilt (not the cached dummy)
-RUN touch crates/openshell-sandbox/src/main.rs \
-    crates/openshell-core/build.rs \
+# Touch build.rs and proto files to force proto code regeneration when the
+# cargo target cache mount retains stale OUT_DIR artifacts from prior builds.
+# Do not touch supervisor sources here; that defeats incremental reuse for
+# unrelated changes and makes inner-loop builds slower.
+RUN touch crates/openshell-core/build.rs \
     proto/*.proto
 
 # Build the supervisor binary
diff --git a/deploy/docker/Dockerfile.gateway b/deploy/docker/Dockerfile.gateway
index 1ffec15e5..e13716661 100644
--- a/deploy/docker/Dockerfile.gateway
+++ b/deploy/docker/Dockerfile.gateway
@@ -68,11 +68,11 @@ RUN --mount=type=cache,id=cargo-registry-gateway-${TARGETARCH},sharing=locked,ta
 # Copy actual source code
 COPY crates/ crates/
 
-# Touch source files to ensure they're rebuilt (not the cached dummy).
 # Touch build.rs and proto files to force proto code regeneration when the
 # cargo target cache mount retains stale OUT_DIR artifacts from prior builds.
-RUN touch crates/openshell-server/src/main.rs \
-    crates/openshell-core/build.rs \
+# Do not touch service sources here; that defeats incremental reuse for
+# unrelated changes and makes inner-loop builds slower.
+RUN touch crates/openshell-core/build.rs \
     proto/*.proto
 
 # Build the actual application