fix(lighthouse): ship the fixed minio-cache instead of inheriting the old one

.github/workflows/docker-build.yml

@@ -14,6 +14,27 @@ on:
   workflow_dispatch:
 
 jobs:
+  # ── Stage 0: the minio-cache helper is duplicated per build context (Docker
+  # cannot COPY outside a context). Drift between copies is how the ILM
+  # rule-spam regression shipped, so fail fast when they diverge.
+  helper-parity:
+    name: "minio-cache copies identical"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Compare every baked minio-cache against the canonical copy
+        run: |
+          set -eux
+          canonical=keploy-ci-node/minio-cache
+          status=0
+          for f in $(git ls-files '*/minio-cache'); do
+            [ "$f" = "$canonical" ] && continue
+            diff -u "$canonical" "$f" || status=1
+          done
+          exit $status
+
   # ── Stage 1: base images (no cross-image deps) ─────────────────────
   base-images:
     name: "${{ matrix.tag-prefix || 'base' }} (${{ matrix.arch }})"

keploy-ci-lighthouse/Dockerfile

@@ -2,6 +2,11 @@
 # Used by: landing lighthouse.yml (Lighthouse score comparison on PRs)
 FROM ghcr.io/keploy/keploy-ci:node-1.2.17
 
+# The base node image pins a pre-fix tag whose baked minio-cache appended a MinIO
+# ILM rule on every cache save; ship the current helper so it cannot be inherited.
+COPY minio-cache /usr/local/bin/minio-cache
+RUN chmod +x /usr/local/bin/minio-cache
+
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install Chromium and all its runtime dependencies

keploy-ci-lighthouse/minio-cache

@@ -0,0 +1,92 @@
+#!/usr/bin/env sh
+# minio-cache — Save and restore CI caches via MinIO.
+#
+# Usage:
+#   minio-cache restore <cache-key>   # Download & unpack if available
+#   minio-cache save    <cache-key>   # Pack & upload
+#
+# Required environment variables:
+#   MINIO_ENDPOINT   – e.g. http://192.168.116.165:9001
+#   MINIO_ACCESS_KEY – e.g. keploy
+#   MINIO_SECRET_KEY – (from secret)
+#   CACHE_BUCKET     – defaults to $BUCKET or "woodpecker"
+#   CACHE_PATHS      – colon-separated list of directories to cache
+#                       e.g. "/root/.npm:/root/go/pkg/mod"
+#
+# The <cache-key> argument is used as the object name inside the bucket's
+# "caches/" prefix.  Typical keys:
+#   npm-<hash>      – node_modules / npm cache
+#   gomod-<hash>    – Go module cache
+#
+# Examples:
+#   # Restore npm cache before `npm ci`
+#   export CACHE_PATHS="/root/.npm"
+#   minio-cache restore "npm-${REPO_NAME}"
+#
+#   # After build, save it back
+#   minio-cache save "npm-${REPO_NAME}"
+#
+set -eu
+
+ACTION="${1:-}"
+CACHE_KEY="${2:-}"
+BUCKET="${CACHE_BUCKET:-${BUCKET:-woodpecker}}"
+ALIAS="cache_mc"
+PREFIX="caches"
+
+die()  { echo "ERROR: $*" >&2; exit 1; }
+info() { echo "[minio-cache] $*"; }
+
+[ -n "$ACTION" ] && [ -n "$CACHE_KEY" ] || die "Usage: minio-cache <restore|save> <cache-key>"
+
+# Validate env
+for v in MINIO_ENDPOINT MINIO_ACCESS_KEY MINIO_SECRET_KEY; do
+  eval val=\$$v
+  [ -n "$val" ] || die "Environment variable $v is required"
+done
+
+[ -n "${CACHE_PATHS:-}" ] || die "CACHE_PATHS must be set (colon-separated directories)"
+
+# Configure mc alias (idempotent)
+mc alias set "$ALIAS" "$MINIO_ENDPOINT" "$MINIO_ACCESS_KEY" "$MINIO_SECRET_KEY" >/dev/null 2>&1
+mc mb -p "${ALIAS}/${BUCKET}" >/dev/null 2>&1 || true
+
+OBJECT="${ALIAS}/${BUCKET}/${PREFIX}/${CACHE_KEY}.tar.zst"
+
+case "$ACTION" in
+  restore)
+    if mc stat "$OBJECT" >/dev/null 2>&1; then
+      info "Restoring cache: $CACHE_KEY"
+      mc cat "$OBJECT" | tar --zstd -xf - -C /
+      info "Cache restored successfully"
+    else
+      info "No cache found for key: $CACHE_KEY (cold start)"
+    fi
+    ;;
+
+  save)
+    # Convert colon-separated paths to space-separated, skip missing dirs
+    DIRS=""
+    OLDIFS="$IFS"; IFS=":"; set -- $CACHE_PATHS; IFS="$OLDIFS"
+    for d in "$@"; do
+      [ -d "$d" ] && DIRS="$DIRS $d"
+    done
+
+    if [ -z "$DIRS" ]; then
+      info "Nothing to cache (no directories exist)"
+      exit 0
+    fi
+
+    info "Saving cache: $CACHE_KEY (paths:$DIRS)"
+    tar --zstd -cf - $DIRS | mc pipe "$OBJECT"
+
+    # NOTE: MinIO lifecycle/retention is managed server-side (canonical rule set on the MinIO instance).
+    # Do NOT add lifecycle rules from CI - the add command is NOT idempotent; each call appends a
+    # duplicate rule and the bucket hit MinIO's 1000-rule cap, breaking retention (2026-08-13 incident).
+    info "Cache saved successfully"
+    ;;
+
+  *)
+    die "Unknown action: $ACTION (use 'restore' or 'save')"
+    ;;
+esac