Pre-cache devcontainer image on GHCR for faster Coder startup

[bmorton]

Why

Coder builds this devcontainer with envbuilder, which rebuilds the whole image (Dockerfile and every feature — Go, Ruby, Rust, kubectl/helm/minikube, Azure CLI, Playwright, …) on every workspace start. This adds a GitHub Action that pre-builds and pushes a fully cached image to GHCR, so Coder reuses the cache instead of rebuilding (envbuilder's docs cite ~36m → ~40s).

What

• scripts/build-cache.sh (+ build-cache_test.sh): runs the same envbuilder Coder uses with ENVBUILDER_CACHE_REPO + ENVBUILDER_PUSH_IMAGE=1, pushing every layer and a complete prebuilt image to ghcr.io/bmorton/devcontainer-cache. Reuses scripts/verify-devcontainer.sh as the init script so a broken/scheduled regression fails loudly. Credentials are passed to docker via env inheritance (never argv or $GITHUB_ENV).
• .github/workflows/cache-devcontainer.yml: triggers on push→main, weekly (0 6 * * 1), and workflow_dispatch. permissions: contents:read + packages:write, runner namespace-profile-devcontainer.
• README.md: documents the cache, the one-time "make package public" step, and accurate Coder consumption.

Key constraint

envbuilder is pinned to ghcr.io/coder/envbuilder:1.3.0 and must match the version Coder runs, or layer-cache hashes won't match.

Out-of-band steps (can't be automated here)

1. After the first successful run, set the devcontainer-cache GHCR package visibility to Public.
2. Wire the cache into the Coder template (same pinned envbuilder version):
   • ENVBUILDER_CACHE_REPO=ghcr.io/bmorton/devcontainer-cache to reuse cached layers, or
   • the envbuilder_cached_image resource to boot directly from the prebuilt image.

Notes

Docker isn't available in the authoring devcontainer, so the script is validated via its DRY_RUN path (14/14 tests pass). The real build+push only runs on CI. Design spec and implementation plan included under docs/superpowers/.

Co-authored-by: Copilot [email protected]