From 64a2eacad10669710fde61fa38e88786ae01c290 Mon Sep 17 00:00:00 2001
From: germondai <germondai@gmail.com>
Date: Fri, 26 Jun 2026 19:12:10 +0200
Subject: [PATCH] chore(ci): optimize multi-platform Docker publish workflow

---
 .github/workflows/publish.yml |  8 ++++++--
 apps/api/Dockerfile           | 11 ++++++++---
 2 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index f5c9d08..2a50420 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -3,13 +3,17 @@ name: Publish
 on:
   push:
     branches: [main]
-    tags: ['v*']
+    tags: ["v*"]
 
 env:
   IMAGE: ghcr.io/${{ github.repository_owner }}/trawl
 
 jobs:
   publish:
+    strategy:
+      matrix:
+        platform: [linux/amd64, linux/arm64]
+
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -39,7 +43,7 @@ jobs:
         with:
           context: .
           file: apps/api/Dockerfile
-          platforms: linux/amd64,linux/arm64
+          platforms: ${{ matrix.platform }}
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
diff --git a/apps/api/Dockerfile b/apps/api/Dockerfile
index 861ab33..52f9f05 100644
--- a/apps/api/Dockerfile
+++ b/apps/api/Dockerfile
@@ -18,13 +18,18 @@ COPY apps/docs/package.json        ./apps/docs/
 # --production skips devDependencies (vitepress + algolia from docs, typescript, @types)
 RUN bun install --frozen-lockfile --production
 
-# ── Stage 2: fetch the Camoufox Firefox binary for the target platform ─────────
+# ── Stage 2: fetch the Camoufox Firefox binary ─────────
 FROM oven/bun:1.3.14 AS camoufox
 ENV CAMOUFOX_INSTALL_DIR=/opt/camoufox
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    nodejs npm python3 make g++ \
-    && rm -rf /var/lib/apt/lists/*
+    nodejs npm python3 make g++ && rm -rf /var/lib/apt/lists/*
+
+# Use BuildKit cache for the download
+RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
+    --mount=type=cache,target=/root/.cache/camoufox,sharing=locked \
+    bun x camoufox-js fetch \
+    && rm -rf /opt/camoufox/fonts/macos /opt/camoufox/fonts/windows
 
 # Secret mount keeps GITHUB_TOKEN out of image layers.
 # Token prevents GitHub API rate-limits that cause the binary download to stall.