From 2efcd8c29c27bd31312462aa0611e43129c9997b Mon Sep 17 00:00:00 2001
From: Jordan Simonovski <jordan.simonovski@clickhouse.com>
Date: Thu, 16 Jul 2026 15:11:00 +1000
Subject: [PATCH] ci: enforce immutable installs and scope the docker bake
 cache

Use `yarn install --immutable` across CI install steps (main.yml lint/unit/
integration/clickhouse-static-build, knip.yml, e2e-setup) so CI fails on
lockfile drift instead of silently re-resolving.

Scope the integration job's docker buildx bake cache with mode=max and a
stable scope=ci-integration (was unscoped, mode=min), mirroring
docker-build.yml so layers persist between runs.

node_modules caching was evaluated and dropped: a timing gate showed
restoring the ~1.8G tree (~30s decompress+extract, before the network
download of the 241M blob) loses to a warm-download `yarn install` (~23s).
---
 .github/actions/e2e-setup/action.yml |  2 +-
 .github/workflows/knip.yml           |  2 +-
 .github/workflows/main.yml           | 10 +++++-----
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/actions/e2e-setup/action.yml b/.github/actions/e2e-setup/action.yml
index c2d2c80c5b..8b8c842695 100644
--- a/.github/actions/e2e-setup/action.yml
+++ b/.github/actions/e2e-setup/action.yml
@@ -36,7 +36,7 @@ runs:
 
     - name: Install dependencies
       shell: bash
-      run: yarn install
+      run: yarn install --immutable
 
     - name: Build dependencies
       shell: bash
diff --git a/.github/workflows/knip.yml b/.github/workflows/knip.yml
index ff782ed03d..0e8c55b1c5 100644
--- a/.github/workflows/knip.yml
+++ b/.github/workflows/knip.yml
@@ -26,7 +26,7 @@ jobs:
           cache: 'yarn'
 
       - name: Install dependencies
-        run: yarn install
+        run: yarn install --immutable
 
       - name: Run Knip
         run:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 7df016c548..6ab5302f25 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -21,7 +21,7 @@ jobs:
           cache-dependency-path: 'yarn.lock'
           cache: 'yarn'
       - name: Install root dependencies
-        run: yarn install
+        run: yarn install --immutable
       - name: Build dependencies
         run: make ci-build
       - name: Install core libs
@@ -41,7 +41,7 @@ jobs:
           cache-dependency-path: 'yarn.lock'
           cache: 'yarn'
       - name: Install root dependencies
-        run: yarn install
+        run: yarn install --immutable
       - name: Build dependencies
         run: make ci-build
       - name: Run unit tests
@@ -59,13 +59,13 @@ jobs:
           cache-dependency-path: 'yarn.lock'
           cache: 'yarn'
       - name: Install root dependencies
-        run: yarn install
+        run: yarn install --immutable
       - name: Expose GitHub Runtime
         uses: crazy-max/ghaction-github-runtime@v4
       - name: Spin up docker services
         run: |
           docker buildx create --use --driver=docker-container
-          docker buildx bake -f ./docker-compose.ci.yml --set *.cache-to="type=gha" --set *.cache-from="type=gha" --load
+          docker buildx bake -f ./docker-compose.ci.yml --set *.cache-to="type=gha,mode=max,scope=ci-integration" --set *.cache-from="type=gha,scope=ci-integration" --load
       - name: Build dependencies
         run: make ci-build
       - name: Run integration tests
@@ -264,7 +264,7 @@ jobs:
           cache: 'yarn'
 
       - name: Install dependencies
-        run: yarn install
+        run: yarn install --immutable
 
       - name: Build App
         run: yarn build:clickhouse