ci: always ship buildkitd as an artifact and test the PR's own image

[gilescope]

Extracted from #442 (the buildkit upgrade). Independent of the bump — this is about which buildkitd image CI tests against.

The problem

Relying on build artifacts should mean a more stable CI and less chance of being throttled (as well as 'just working' for forked PRs).

Every test job needs a buildkitd image, and today there are two different paths:

	image source	tag
fork PR	GHA artifact, docker loaded	buildkitd-staging-<sha>-<suffix>
everything else	pulled from ghcr per job	buildkitd-v0.8.17-fix.1 (static pin)

The artifact path exists because forks can't push to ghcr. Non-forks kept the static pin — which means a non-fork PR runs its entire outer test layer against the old buildkit daemon. The PR's own buildkit is only exercised inside the nested earthly-in-earthly tests, so an outer-daemon regression can pass CI unnoticed.

The change

Delete the split. Everyone uses the artifact path, and the image variable always points at the buildkitd this PR built.

• build-earthly.yml: "Save artifacts for fork CI" becomes "Save buildkitd image tarball (all runs)" (unconditional) plus "Build earthly binary artifact (fork only)". Upload is unconditional. Non-fork jobs still fetch the earthly binary from ghcr — rebuilding it here would be minutes of redundant work.
• stage2-setup: download and load the artifact unconditionally; EARTHLY_BUILDKIT_IMAGE becomes buildkitd-staging-${{ github.sha }}-<suffix>.

Earthly pushes straight from buildkit's internal store to ghcr without tagging the image in the host daemon, so save needs the tag present first. The step does image inspect and only pulls if absent: fork runs hit the locally-built image, non-fork runs pay a single pull here instead of one per test job.

Secondary benefit: ~67 test jobs per run stop fetching the image from ghcr and read it from in-run artifact storage instead, which doesn't rate-limit. Note this moves the bytes rather than eliminating them — the gain is reliability, not bandwidth.

Prerequisite fix included

Both if: conditions on the build-and-push path are widened:

-if: github.event_name == 'push' || github.event_name == 'merge_group' || <same-repo PR>
+if: github.event_name != 'pull_request' || <same-repo PR>

This is load-bearing, not cosmetic. ci-staging-deploy.yml calls build-earthly.yml on workflow_dispatch, which satisfies none of the three original event names — so today a manually dispatched staging deploy silently skips "Build and push +ci-release" entirely. That goes unnoticed because nothing downstream needs the image to exist. Once the tarball step is unconditional it becomes a hard failure, so the latent skip has to be fixed here. The GHCR-login step needs the same widening or the push has no credentials.

The new condition covers push, merge_group, schedule, workflow_dispatch and same-repo PRs.

For review

The staging tag is built from ${{ github.sha }}, but the tag +ci-release actually pushes comes from earthly's EARTHLY_GIT_HASH:

./buildkitd+buildkitd --TAG=${EARTHLY_GIT_HASH}-${TAG_SUFFIX} --DOCKERHUB_BUILDKIT_IMG="buildkitd-staging"

So this assumes github.sha == EARTHLY_GIT_HASH. main already bakes that assumption into the fork path in both files, so it isn't new — but it graduates from affecting fork PRs only to affecting every job. Worth a second pair of eyes.

Relationship to #736

Content-disjoint (no retry wrappers, swap, or diagnostics here) but both PRs touch build-earthly.yml, in three overlapping hunk ranges. The conflicts are orthogonal — #736 rewrites step bodies, this changes if: lines — but merging #736 first is preferable: if this lands first, a reviewer resolving #736's if: conflicts could take main's side and silently revert the condition fix, quietly reintroducing the workflow_dispatch skip.

Verification

• yq parses all workflows and both composite actions.
• actionlint clean on build-earthly.yml and ci-staging-deploy.yml.
• Confirmed free of ci: retry transient buildkit Canceled failures, add memory headroom and failure diagnostics #736's content by grep (max_attempts, Add swap, failure-diagnostics, continue-on-error).

🤖 Generated with Claude Code

https://claude.ai/code/session_01GQK1DssrULoDFoX5JU9njo

[github-actions]

⚠️ Are we earthbuild yet?

Warning: "earthly" occurrences have increased by 8 (0.17%)

📈 Overall Progress

Branch	Total Count
main	4748
This PR	4756
Difference	+8 (0.17%)

---

Keep up the great work migrating from Earthly to Earthbuild! 🚀

💡 Tips for finding more occurrences

Run locally to see detailed breakdown:

./.github/scripts/count-earthly.sh

Note that the goal is not to reach 0.
There is anticipated to be at least some occurences of earthly in the source code due to backwards compatibility with config files and language constructs.

[janishorsts]

Please rename earthly to earth.

Suggested change

	- name: Download build-earthly artifacts
	- name: Download build-earth artifacts

[janishorsts]

The inputs.BINARY has no impact on the built BuildKit. #615 tackles the duplicated builds.

Suggested change

	TAG_SUFFIX="ubuntu-latest-${{inputs.BINARY}}"
	TAG_SUFFIX="ubuntu-latest"

[janishorsts]

I would actually simplify to two tags: latest and latest-tiktok.