ci(infra): Kaniko layer caching + age-based registry cleanup

[angel-manuel]

Two paired Cloud Build / Artifact Registry infra changes.

1. Kaniko layer caching for Cloud Build images

Problem: Cloud Build runs each build on a fresh ephemeral VM, so the existing docker build steps always start from a cold layer cache and recompile every Rust dependency from scratch. The API image build step alone is ~6 min of a 7–9 min build. The Dockerfiles are carefully structured around a dependency-caching layer (dummy-source trick), but with no persistent cache that optimization was dead on arrival.

Change: Replace docker build + docker push in all three build modules with a single Kaniko step using --cache=true:

• infra/modules/cloud-build (overslash-api)
• infra/modules/cloud-build-shortener (oversla-sh)
• infra/modules/cloud-build-metrics-exporter (overslash-metrics-exporter)

Kaniko stores each layer — including the builder-stage dependency layer — as a content-addressed blob in <dest>/cache, keyed by (command + input files) hash, so unchanged layers are reused across builds. It also pushes the image directly (the separate push step is removed).

Why Kaniko over --cache-from :latest: these are multi-stage builds; the expensive cargo build lives in the builder stage, whose layers never reach the final pushed image — --cache-from inline cache would cache almost nothing here. Kaniko also doesn't depend on a :latest tag existing, so first builds / fresh environments work unchanged.

Isolation/safety: cache repo is derived from project_id/repository_name → dev and prod caches are isolated automatically; cache hits are content-addressed (safe for prod); same AR repo → no extra IAM; --cache-ttl=168h bounds staleness.

Expected impact: code-only builds drop from ~6 min to ~1–2 min once the cache is warm.

2. Age-based cleanup policy to bound registry growth

Problem: the registry had only a KEEP policy (keep 10 most recent), which in Artifact Registry is a no-op without a paired DELETE policy — nothing was ever deleted and the repo grew unbounded (~11.6 GB on dev). Kaniko caching pushes new cache blobs on every build, which would accelerate that growth.

Change: add a DELETE policy in infra/modules/artifact-registry removing versions older than a configurable threshold (default 30 days), covering both images and Kaniko cache layers. The keep-recent (10 newest) policy stays as a rollback safety net and takes precedence.

Why it's cache-safe: the delete age (30d) stays well above the Kaniko --cache-ttl (7d). Any cache layer Kaniko would reuse is re-pushed within the TTL, so it's always younger than the delete threshold and never pruned. Both the age and a cleanup_dry_run toggle are variables with defaults (no caller changes needed); flip dry-run to preview deletion scope before enforcing.

Notes

• Kaniko executor image is unpinned, matching the repo's existing convention (gcr.io/cloud-builders/docker was also unpinned). Pinning to a digest is a reasonable follow-up.
• terraform fmt passes on all four modules. Full terraform validate/plan not run here (no provider/backend access in this environment) — worth a plan on dev before merge.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
overslash	Ready	Preview, Comment	Jun 14, 2026 1:02pm