ci: fix cached TKE build execution

Author: daviszhen

.github/workflows/build-mo.yaml

@@ -135,9 +135,15 @@ jobs:
               legacy=$(printf "schema=1\nos=%s\narch=%s\nthirdparties_tree=%s" \
                 "$(uname -s)" "$(uname -m)" "$(git rev-parse HEAD:thirdparties)")
               printf '%s\n' "${legacy}" > /tmp/legacy-thirdparties.fingerprint
-              # Accept the old schema during rollout so the first MatrixOne
-              # commit with the new helper can still use the last builder
-              # image; new images always use the exact schema-2 contract.
+              echo "Computed CI builder fingerprint:"
+              cat /tmp/expected-thirdparties.fingerprint
+              if [ -r /mo-prebuilt/thirdparties.fingerprint ]; then
+                echo "Cached CI builder fingerprint:"
+                cat /mo-prebuilt/thirdparties.fingerprint
+              fi
+              # Accept only the pre-helper schema-1 metadata during rollout;
+              # the schema-3 contract covers the complete native input tree,
+              # while older partial fingerprints must rebuild safely.
               if cmp -s /tmp/expected-thirdparties.fingerprint /mo-prebuilt/thirdparties.fingerprint 2>/dev/null \
                 || cmp -s /tmp/legacy-thirdparties.fingerprint /mo-prebuilt/thirdparties.fingerprint 2>/dev/null; then
                 rm -rf thirdparties/install

.github/workflows/image-build.yaml

@@ -214,10 +214,10 @@ jobs:
     # arm64 SCA job is served by its own actions/cache pipeline (see
     # matrixorigin/matrixone sca-go-module-cache.yaml), so only amd64 is
     # published. Skipped for release tags so the caches always track the
-    # default branch, and skipped gracefully on branches that do not ship
-    # the Dockerfile yet.
+    # default branch. Non-main refs run only the cheap presence gate and
+    # report why publication is skipped.
     name: Build CI builder image
-    if: ${{ github.event_name != 'release' && github.ref == 'refs/heads/main' }}
+    if: ${{ github.event_name != 'release' }}
     # Best-effort: a builder-image problem must not turn the nightly product
     # image pipeline red; consumers fall back to cold builds until the next
     # successful publish.
@@ -236,7 +236,10 @@ jobs:
       - name: Check Dockerfile presence
         id: gate
         run: |
-          if [ -f optools/images/Dockerfile.ci-builder ]; then
+          if [ "${GITHUB_REF}" != "refs/heads/main" ]; then
+            echo "::notice::ci-builder publication is restricted to refs/heads/main; ref=${GITHUB_REF}; skipping"
+            echo "present=false" >> "$GITHUB_OUTPUT"
+          elif [ -f optools/images/Dockerfile.ci-builder ]; then
             echo "present=true" >> "$GITHUB_OUTPUT"
           else
             echo "::notice::optools/images/Dockerfile.ci-builder not present; skipping builder image"

.github/workflows/merge-trigger-tke.yaml

@@ -107,7 +107,7 @@ jobs:
         run: |
           set -u +e -o pipefail
           cd "$GITHUB_WORKSPACE"
-          docker run --rm \
+          docker run --rm -i \
             -v "$GITHUB_WORKSPACE/matrixone":/go/src/github.com/matrixorigin/matrixone \
             -w /go/src/github.com/matrixorigin/matrixone \
             -e HOST_UID="$(id -u)" -e HOST_GID="$(id -g)" \
@@ -129,8 +129,15 @@ jobs:
           legacy=$(printf "schema=1\nos=%s\narch=%s\nthirdparties_tree=%s" \
             "$(uname -s)" "$(uname -m)" "$(git rev-parse HEAD:thirdparties)")
           printf '%s\n' "${legacy}" > /tmp/legacy-thirdparties.fingerprint
-          # Accept the old schema during rollout so an existing builder image
-          # remains useful until the first schema-2 image is published.
+          echo "Computed CI builder fingerprint:"
+          cat /tmp/expected-thirdparties.fingerprint
+          if [ -r /mo-prebuilt/thirdparties.fingerprint ]; then
+            echo "Cached CI builder fingerprint:"
+            cat /mo-prebuilt/thirdparties.fingerprint
+          fi
+          # Accept only the pre-helper schema-1 metadata during rollout.  The
+          # schema-3 contract covers the complete native input tree, so older
+          # partial fingerprints must rebuild rather than risk stale outputs.
           if cmp -s /tmp/expected-thirdparties.fingerprint /mo-prebuilt/thirdparties.fingerprint 2>/dev/null \
             || cmp -s /tmp/legacy-thirdparties.fingerprint /mo-prebuilt/thirdparties.fingerprint 2>/dev/null; then
             echo "CI builder native fingerprint matched"
@@ -147,6 +154,10 @@ jobs:
           if [ "${status}" -ne 0 ]; then
             exit "${status}"
           fi
+          # The cached build completed successfully.  Fail closed while
+          # staging its runtime artifacts so a missing library cannot be
+          # published as a successful image.
+          set -e
 
           cd "$GITHUB_WORKSPACE/matrixone"
           env -u LD_LIBRARY_PATH GOCOVERDIR="$(mktemp -d)" ./mo-service -h >/dev/null