From cefac94d5bb0165db11b135cb67d090b0abd1b9e Mon Sep 17 00:00:00 2001
From: lczyk <marcin.konow@lczyk.xyz>
Date: Sat, 12 Sep 2026 16:26:07 +0100
Subject: [PATCH 1/4] fix(ci)?: bust image cache on tar-shim change

hash_inputs.sh stamps bread on hack/tar-shim.sh, but the images cache key left it out, so a tar-shim-only change restored stale tarballs.
---
 .github/workflows/build-oci.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build-oci.yaml b/.github/workflows/build-oci.yaml
index 99c9aa5..effc88b 100644
--- a/.github/workflows/build-oci.yaml
+++ b/.github/workflows/build-oci.yaml
@@ -60,7 +60,7 @@ jobs:
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: images-out/
-          key: images-${{ matrix.arch }}-${{ hashFiles('images/Dockerfile.*', 'hack/bread-warning.sh', 'hack/banner.txt', 'hack/lazy-apt.sh', 'hack/apt-mirror.sh', 'hack/build_image.sh', format('.stamp/binaries-{0}', matrix.arch)) }}
+          key: images-${{ matrix.arch }}-${{ hashFiles('images/Dockerfile.*', 'hack/bread-warning.sh', 'hack/banner.txt', 'hack/tar-shim.sh', 'hack/lazy-apt.sh', 'hack/apt-mirror.sh', 'hack/build_image.sh', format('.stamp/binaries-{0}', matrix.arch)) }}
 
       - name: Set up qemu (emulated arches only)
         if: matrix.qemu && steps.images-cache.outputs.cache-hit != 'true'

From 759e9378297255a5566c115cd7e741c5b14356f9 Mon Sep 17 00:00:00 2001
From: lczyk <marcin.konow@lczyk.xyz>
Date: Sat, 12 Sep 2026 16:26:08 +0100
Subject: [PATCH 2/4] ci?: parallel image bakes

---
 .github/workflows/build-oci.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-oci.yaml b/.github/workflows/build-oci.yaml
index effc88b..cd73cc7 100644
--- a/.github/workflows/build-oci.yaml
+++ b/.github/workflows/build-oci.yaml
@@ -66,9 +66,11 @@ jobs:
         if: matrix.qemu && steps.images-cache.outputs.cache-hit != 'true'
         uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
 
+      # Emulated builds are ~single-core and the per-version chains are
+      # independent, so run them in parallel. -O keeps each image's log whole.
       - name: Bake bread + bread-chisel-releases images for ${{ matrix.arch }}
         if: steps.images-cache.outputs.cache-hit != 'true'
-        run: make build-bread build-bread-chisel-releases ARCH=${{ matrix.arch }}
+        run: make -j"$(nproc)" -O build-bread build-bread-chisel-releases ARCH=${{ matrix.arch }}
 
       - name: Save images as docker-archive tarballs
         if: steps.images-cache.outputs.cache-hit != 'true'

From c797c05f9fe4b20ee252bb58c57cfd5c751c799c Mon Sep 17 00:00:00 2001
From: lczyk <marcin.konow@lczyk.xyz>
Date: Sat, 12 Sep 2026 16:26:08 +0100
Subject: [PATCH 3/4] ci?: ungate qemu image builds from tests

qemu images publish untested, so waiting on build-and-test only delays them. push-ghcr and publish-release still wait on the gated native lanes.
---
 .github/workflows/release.yaml | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 3ba2964..11e2b50 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -24,12 +24,26 @@ jobs:
     needs: binaries
     uses: ./.github/workflows/build-and-test.yaml
 
-  build-oci:
+  build-oci-native:
     needs: [binaries, build-and-test]
     uses: ./.github/workflows/build-oci.yaml
+    with:
+      matrix: >-
+        [{"runner": "ubuntu-24.04",     "arch": "amd64"},
+         {"runner": "ubuntu-24.04-arm", "arch": "arm64"}]
+
+  # qemu lanes publish untested, so they skip the build-and-test gate and
+  # overlap with it. Publishing still waits on the gated native lanes.
+  build-oci-qemu:
+    needs: binaries
+    uses: ./.github/workflows/build-oci.yaml
+    with:
+      matrix: >-
+        [{"runner": "ubuntu-24.04", "arch": "s390x",   "qemu": true},
+         {"runner": "ubuntu-24.04", "arch": "ppc64le", "qemu": true}]
 
   push-ghcr:
-    needs: build-oci
+    needs: [build-oci-native, build-oci-qemu]
     uses: ./.github/workflows/push-ghcr.yaml
     permissions:
       contents: read
@@ -37,7 +51,7 @@ jobs:
       id-token: write
 
   publish-release:
-    needs: [binaries, build-oci]
+    needs: [binaries, build-oci-native, build-oci-qemu]
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions:

From cfd5adb41cca570c2518fff58a88338a452dd089 Mon Sep 17 00:00:00 2001
From: lczyk <marcin.konow@lczyk.xyz>
Date: Sat, 12 Sep 2026 17:42:11 +0100
Subject: [PATCH 4/4] ci?: cap parallel bakes at 2

---
 .github/workflows/build-oci.yaml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-oci.yaml b/.github/workflows/build-oci.yaml
index cd73cc7..5c0f7f6 100644
--- a/.github/workflows/build-oci.yaml
+++ b/.github/workflows/build-oci.yaml
@@ -67,10 +67,11 @@ jobs:
         uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
 
       # Emulated builds are ~single-core and the per-version chains are
-      # independent, so run them in parallel. -O keeps each image's log whole.
+      # independent, so run them in parallel. Past 2 they only contend for
+      # the runner's cores. -O keeps each image's log whole.
       - name: Bake bread + bread-chisel-releases images for ${{ matrix.arch }}
         if: steps.images-cache.outputs.cache-hit != 'true'
-        run: make -j"$(nproc)" -O build-bread build-bread-chisel-releases ARCH=${{ matrix.arch }}
+        run: make -j2 -O build-bread build-bread-chisel-releases ARCH=${{ matrix.arch }}
 
       - name: Save images as docker-archive tarballs
         if: steps.images-cache.outputs.cache-hit != 'true'