Docker Cache Not Working for Release Builds

[mohammed-rahib]

I am using a GitHub workflow to build and push Docker images for amd64 and arm64 using buildx action. The workflow is triggered in two ways: one by pushing to a branch and the other by creating a release version.The issue is that when the workflow is triggered by a push event, the cache is used effectively, but when triggered by a release, it is not. How can I resolve this?
My assumption is that for push events, caching works because the same branch is used, whereas for releases, it falls outside the expected scope. Is this correct? What would be the best alternative to address this?

name: Deploy
on:
  push:
    branches:
      - develop
  release:
    types:
      - created     
jobs:
  build:
    if: ${{ github.event_name == 'push' || (github.event_name == 'release' && github.event.release.target_commitish == 'main') }} 
    
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4 
      
    - name: Set TAG variable
      run: |
        if [ "$GITHUB_EVENT_NAME" == "push" ]; then
          echo "TAG=${GITHUB_SHA:0:7}" >> $GITHUB_ENV
        elif [ "$GITHUB_EVENT_NAME" == "release" ]; then
          echo "TAG=${{ github.event.release.tag_name }}" >> $GITHUB_ENV
        fi  

    - name: Set up QEMU
      uses: docker/setup-qemu-action@master

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@master  
      id: buildx
      with:
        install: true
        use: true

    - name: Cache Docker layers
      uses: actions/cache@master
      with:
        path: /tmp/.buildx-cache
        key: ${{ runner.os }}-buildx-${{ github.sha }}
        restore-keys: |
          ${{ runner.os }}-buildx-  

    - name: ECR login
      run: aws ecr get-login-password --region ap-south-1 | docker login --username AWS --password-stdin ${{vars.AWS_ACCOUNT_ID}}.dkr.ecr.ap-south-1.amazonaws.com  

    - name: Build and push
      uses: docker/build-push-action@master
      id: build-push-to-ecr
      with:
        context: .
        file: Dockerfile
        push: true
        tags: ${{ vars.IMAGE_REPO }}:${{ env.TAG }}
        platforms: linux/amd64,linux/arm64
        provenance: false
        builder: ${{ steps.buildx.outputs.name }}
        cache-from: type=local,src=/tmp/.buildx-cache
        cache-to: type=local,dest=/tmp/.buildx-cache
      continue-on-error: false 
      ```

[DeveloperVaibhav1]

This usually happens because the cache key is based on ${{ github.sha }}. For push events, the workflow often runs on the same branch and can reuse the cache through the restore-keys, but for release events the commit context may differ, so the cache key changes and the previous cache is not restored.

One improvement would be to use a more stable cache key, for example based on the branch name or a Dockerfile hash instead of the commit SHA. That way both push and release workflows can reuse the same cache layers.

For example:

key: ${{ runner.os }}-buildx-${{ hashFiles('Dockerfile') }}
restore-keys: |
  ${{ runner.os }}-buildx-

You may also want to consider using Docker Buildx native caching (like type=gha) which integrates better with GitHub Actions and often works more reliably across different workflow triggers.