From bb0f3eceab272aa339b5b3614358081f9a60c707 Mon Sep 17 00:00:00 2001
From: Shaun Arman <shaun.arman@motorolasolutions.com>
Date: Sun, 12 Apr 2026 18:17:35 -0500
Subject: [PATCH 1/7] perf(ci): use pre-baked images and add cargo/npm caching
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Switch all test and release build jobs from raw base images to the
pre-baked images already defined in .docker/ and pushed to the local
Gitea registry. Add actions/cache@v3 for Cargo registry and npm to
eliminate redundant downloads on subsequent runs.

Changes:
- Dockerfile.linux-amd64/arm64: bake in rustfmt and clippy components
- test.yml: rust jobs → trcaa-linux-amd64:rust1.88-node22; drop inline
  apt-get and rustup component-add steps; add cargo cache
- test.yml: frontend jobs → add npm cache
- auto-tag.yml: build-linux-amd64 → trcaa-linux-amd64; drop Install
  dependencies step and rustup target add
- auto-tag.yml: build-windows-amd64 → trcaa-windows-cross; drop Install
  dependencies step and rustup target add
- auto-tag.yml: build-linux-arm64 → trcaa-linux-arm64 (ubuntu:22.04-based);
  drop ~40-line Install dependencies step, . "$HOME/.cargo/env", and
  rustup target add (all pre-baked in image ENV PATH)
- All build jobs: add cargo and npm cache steps
- docs/wiki/CICD-Pipeline.md: document pre-baked images, cache keys,
  and insecure-registries daemon prerequisite

Expected savings: ~70% faster PR test suite (~1.5 min vs ~5 min),
~72% faster release builds (~7 min vs ~25 min) after cache warms up.

NOTE: Trigger build-images.yml via workflow_dispatch before merging
to ensure images contain rustfmt/clippy before workflow changes land.
---
 .docker/Dockerfile.linux-amd64          |   1 +
 .docker/Dockerfile.linux-arm64          |   3 +-
 .gitea/workflows/auto-tag.yml           | 115 +++++++++++-------------
 .gitea/workflows/test.yml               |  57 +++++++++---
 docs/wiki/CICD-Pipeline.md              | 100 +++++++++++++++------
 tickets/ci-runner-speed-optimization.md | 107 ++++++++++++++++++++++
 6 files changed, 285 insertions(+), 98 deletions(-)
 create mode 100644 tickets/ci-runner-speed-optimization.md

diff --git a/.docker/Dockerfile.linux-amd64 b/.docker/Dockerfile.linux-amd64
index 191037db..600862a1 100644
--- a/.docker/Dockerfile.linux-amd64
+++ b/.docker/Dockerfile.linux-amd64
@@ -22,3 +22,4 @@ RUN apt-get update -qq \
     && rm -rf /var/lib/apt/lists/*
 
 RUN rustup target add x86_64-unknown-linux-gnu
+RUN rustup component add rustfmt clippy
diff --git a/.docker/Dockerfile.linux-arm64 b/.docker/Dockerfile.linux-arm64
index e8939475..2c43af2c 100644
--- a/.docker/Dockerfile.linux-arm64
+++ b/.docker/Dockerfile.linux-arm64
@@ -40,6 +40,7 @@ RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
 # Step 4: Rust 1.88 with arm64 cross-compilation target
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
     --default-toolchain 1.88.0 --profile minimal --no-modify-path \
-    && /root/.cargo/bin/rustup target add aarch64-unknown-linux-gnu
+    && /root/.cargo/bin/rustup target add aarch64-unknown-linux-gnu \
+    && /root/.cargo/bin/rustup component add rustfmt clippy
 
 ENV PATH="/root/.cargo/bin:${PATH}"
diff --git a/.gitea/workflows/auto-tag.yml b/.gitea/workflows/auto-tag.yml
index e306a8a8..dd48d02c 100644
--- a/.gitea/workflows/auto-tag.yml
+++ b/.gitea/workflows/auto-tag.yml
@@ -132,27 +132,34 @@ jobs:
     needs: autotag
     runs-on: linux-amd64
     container:
-      image: rust:1.88-slim
+      image: 172.0.0.29:3000/sarman/trcaa-linux-amd64:rust1.88-node22
     steps:
       - name: Checkout
         run: |
-          apt-get update -qq && apt-get install -y -qq git
           git init
           git remote add origin http://172.0.0.29:3000/sarman/tftsr-devops_investigation.git
           git fetch --depth=1 origin "$GITHUB_SHA"
           git checkout FETCH_HEAD
-      - name: Install dependencies
-        run: |
-          apt-get update -qq && apt-get install -y -qq \
-            libwebkit2gtk-4.1-dev libssl-dev libgtk-3-dev \
-            libayatana-appindicator3-dev librsvg2-dev patchelf \
-            pkg-config curl perl jq
-          curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
-          apt-get install -y nodejs
+      - name: Cache cargo registry
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+      - name: Cache npm
+        uses: actions/cache@v3
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-npm-
       - name: Build
         run: |
           npm ci --legacy-peer-deps
-          rustup target add x86_64-unknown-linux-gnu
           CI=true npx tauri build --target x86_64-unknown-linux-gnu
       - name: Upload artifacts
         env:
@@ -218,20 +225,31 @@ jobs:
     needs: autotag
     runs-on: linux-amd64
     container:
-      image: rust:1.88-slim
+      image: 172.0.0.29:3000/sarman/trcaa-windows-cross:rust1.88-node22
     steps:
       - name: Checkout
         run: |
-          apt-get update -qq && apt-get install -y -qq git
           git init
           git remote add origin http://172.0.0.29:3000/sarman/tftsr-devops_investigation.git
           git fetch --depth=1 origin "$GITHUB_SHA"
           git checkout FETCH_HEAD
-      - name: Install dependencies
-        run: |
-          apt-get update -qq && apt-get install -y -qq mingw-w64 curl nsis perl make jq
-          curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
-          apt-get install -y nodejs
+      - name: Cache cargo registry
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+          key: ${{ runner.os }}-cargo-windows-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-windows-
+      - name: Cache npm
+        uses: actions/cache@v3
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-npm-
       - name: Build
         env:
           CC_x86_64_pc_windows_gnu: x86_64-w64-mingw32-gcc
@@ -242,7 +260,6 @@ jobs:
           OPENSSL_STATIC: "1"
         run: |
           npm ci --legacy-peer-deps
-          rustup target add x86_64-pc-windows-gnu
           CI=true npx tauri build --target x86_64-pc-windows-gnu
       - name: Upload artifacts
         env:
@@ -392,53 +409,31 @@ jobs:
     needs: autotag
     runs-on: linux-amd64
     container:
-      image: ubuntu:22.04
+      image: 172.0.0.29:3000/sarman/trcaa-linux-arm64:rust1.88-node22
     steps:
       - name: Checkout
         run: |
-          apt-get update -qq && apt-get install -y -qq git
           git init
           git remote add origin http://172.0.0.29:3000/sarman/tftsr-devops_investigation.git
           git fetch --depth=1 origin "$GITHUB_SHA"
           git checkout FETCH_HEAD
-      - name: Install dependencies
-        env:
-          DEBIAN_FRONTEND: noninteractive
-        run: |
-          # Step 1: Host tools + cross-compiler (all amd64, no multiarch yet)
-          apt-get update -qq
-          apt-get install -y -qq curl git gcc g++ make patchelf pkg-config perl jq \
-            gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
-
-          # Step 2: Multiarch — Ubuntu uses ports.ubuntu.com for arm64,
-          # keeping it on a separate mirror from amd64 (archive.ubuntu.com).
-          # This avoids the binary-all index duplication and -dev package
-          # conflicts that plagued the Debian single-mirror approach.
-          dpkg --add-architecture arm64
-          sed -i 's|^deb http://archive.ubuntu.com|deb [arch=amd64] http://archive.ubuntu.com|g' /etc/apt/sources.list
-          sed -i 's|^deb http://security.ubuntu.com|deb [arch=amd64] http://security.ubuntu.com|g' /etc/apt/sources.list
-          printf '%s\n' \
-            'deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports jammy main restricted universe multiverse' \
-            'deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports jammy-updates main restricted universe multiverse' \
-            'deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports jammy-security main restricted universe multiverse' \
-            > /etc/apt/sources.list.d/arm64-ports.list
-          apt-get update -qq
-
-          # Step 3: ARM64 dev libs — libayatana omitted (no tray icon in this app)
-          apt-get install -y -qq \
-            libwebkit2gtk-4.1-dev:arm64 \
-            libssl-dev:arm64 \
-            libgtk-3-dev:arm64 \
-            librsvg2-dev:arm64
-
-          # Step 4: Node.js
-          curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
-          apt-get install -y nodejs
-
-          # Step 5: Rust (not pre-installed in ubuntu:22.04)
-          # source "$HOME/.cargo/env" in the Build step handles PATH — no GITHUB_PATH needed
-          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
-            --default-toolchain 1.88.0 --profile minimal --no-modify-path
+      - name: Cache cargo registry
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+          key: ${{ runner.os }}-cargo-arm64-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-arm64-
+      - name: Cache npm
+        uses: actions/cache@v3
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-npm-
       - name: Build
         env:
           CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
@@ -452,9 +447,7 @@ jobs:
           OPENSSL_STATIC: "1"
           APPIMAGE_EXTRACT_AND_RUN: "1"
         run: |
-          . "$HOME/.cargo/env"
           npm ci --legacy-peer-deps
-          rustup target add aarch64-unknown-linux-gnu
           CI=true npx tauri build --target aarch64-unknown-linux-gnu --bundles deb,rpm
       - name: Upload artifacts
         env:
diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index f0b5b056..1613500c 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -7,12 +7,11 @@ jobs:
   rust-fmt-check:
     runs-on: ubuntu-latest
     container:
-      image: rust:1.88-slim
+      image: 172.0.0.29:3000/sarman/trcaa-linux-amd64:rust1.88-node22
     steps:
       - name: Checkout
         run: |
           set -eux
-          apt-get update -qq && apt-get install -y -qq git
           git init
           git remote add origin http://172.0.0.29:3000/sarman/tftsr-devops_investigation.git
           if [ -n "${GITHUB_SHA:-}" ] && git fetch --depth=1 origin "$GITHUB_SHA"; then
@@ -28,18 +27,26 @@ jobs:
             echo "Fetched fallback ref: master"
           fi
           git checkout FETCH_HEAD
-      - run: rustup component add rustfmt
+      - name: Cache cargo registry
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
       - run: cargo fmt --manifest-path src-tauri/Cargo.toml --check
 
   rust-clippy:
     runs-on: ubuntu-latest
     container:
-      image: rust:1.88-slim
+      image: 172.0.0.29:3000/sarman/trcaa-linux-amd64:rust1.88-node22
     steps:
       - name: Checkout
         run: |
           set -eux
-          apt-get update -qq && apt-get install -y -qq git
           git init
           git remote add origin http://172.0.0.29:3000/sarman/tftsr-devops_investigation.git
           if [ -n "${GITHUB_SHA:-}" ] && git fetch --depth=1 origin "$GITHUB_SHA"; then
@@ -55,19 +62,26 @@ jobs:
             echo "Fetched fallback ref: master"
           fi
           git checkout FETCH_HEAD
-      - run: apt-get update -qq && apt-get install -y -qq libwebkit2gtk-4.1-dev libssl-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev patchelf pkg-config perl
-      - run: rustup component add clippy
+      - name: Cache cargo registry
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
       - run: cargo clippy --manifest-path src-tauri/Cargo.toml -- -D warnings
 
   rust-tests:
     runs-on: ubuntu-latest
     container:
-      image: rust:1.88-slim
+      image: 172.0.0.29:3000/sarman/trcaa-linux-amd64:rust1.88-node22
     steps:
       - name: Checkout
         run: |
           set -eux
-          apt-get update -qq && apt-get install -y -qq git
           git init
           git remote add origin http://172.0.0.29:3000/sarman/tftsr-devops_investigation.git
           if [ -n "${GITHUB_SHA:-}" ] && git fetch --depth=1 origin "$GITHUB_SHA"; then
@@ -83,7 +97,16 @@ jobs:
             echo "Fetched fallback ref: master"
           fi
           git checkout FETCH_HEAD
-      - run: apt-get update -qq && apt-get install -y -qq libwebkit2gtk-4.1-dev libssl-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev patchelf pkg-config perl
+      - name: Cache cargo registry
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
       - run: cargo test --manifest-path src-tauri/Cargo.toml -- --test-threads=1
 
   frontend-typecheck:
@@ -110,6 +133,13 @@ jobs:
             echo "Fetched fallback ref: master"
           fi
           git checkout FETCH_HEAD
+      - name: Cache npm
+        uses: actions/cache@v3
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-npm-
       - run: npm ci --legacy-peer-deps
       - run: npx tsc --noEmit
 
@@ -137,5 +167,12 @@ jobs:
             echo "Fetched fallback ref: master"
           fi
           git checkout FETCH_HEAD
+      - name: Cache npm
+        uses: actions/cache@v3
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-npm-
       - run: npm ci --legacy-peer-deps
       - run: npm run test:run
diff --git a/docs/wiki/CICD-Pipeline.md b/docs/wiki/CICD-Pipeline.md
index f59fb316..2d10f30c 100644
--- a/docs/wiki/CICD-Pipeline.md
+++ b/docs/wiki/CICD-Pipeline.md
@@ -27,12 +27,77 @@ macOS runner runs jobs **directly on the host** (no Docker container) — macOS
 
 ---
 
-## Test Pipeline (`.woodpecker/test.yml`)
+## Pre-baked Builder Images
+
+CI build and test jobs use pre-baked Docker images pushed to the local Gitea registry
+at `172.0.0.29:3000`. These images bake in all system dependencies (Tauri libs, Node.js,
+Rust toolchain, cross-compilers) so that CI jobs skip package installation entirely.
+
+| Image | Used by jobs | Contents |
+|-------|-------------|----------|
+| `172.0.0.29:3000/sarman/trcaa-linux-amd64:rust1.88-node22` | `rust-fmt-check`, `rust-clippy`, `rust-tests`, `build-linux-amd64` | Rust 1.88 + rustfmt + clippy + Tauri amd64 libs + Node.js 22 |
+| `172.0.0.29:3000/sarman/trcaa-windows-cross:rust1.88-node22` | `build-windows-amd64` | Rust 1.88 + mingw-w64 + NSIS + Node.js 22 |
+| `172.0.0.29:3000/sarman/trcaa-linux-arm64:rust1.88-node22` | `build-linux-arm64` | Rust 1.88 + aarch64 cross-toolchain + arm64 multiarch libs + Node.js 22 |
+
+**Rebuild triggers:** Rust toolchain version bump, webkit2gtk/gtk major version change, Node.js major version change.
+
+**How to rebuild images:**
+1. Trigger `build-images.yml` via `workflow_dispatch` in the Gitea Actions UI
+2. Confirm all 3 images appear in the Gitea package/container registry at `172.0.0.29:3000`
+3. Only then merge workflow changes that depend on the new image contents
+
+**Server prerequisite — insecure registry** (one-time, on 172.0.0.29):
+```sh
+echo '{"insecure-registries":["172.0.0.29:3000"]}' | sudo tee /etc/docker/daemon.json
+sudo systemctl restart docker
+```
+This must be configured on every machine running an act_runner for the runner's Docker
+daemon to pull from the local HTTP registry.
+
+---
+
+## Cargo and npm Caching
+
+All Rust and build jobs use `actions/cache@v3` to cache downloaded package artifacts.
+Gitea 1.22 implements the GitHub Actions cache API natively.
+
+**Cargo cache** (Rust jobs):
+```yaml
+- name: Cache cargo registry
+  uses: actions/cache@v3
+  with:
+    path: |
+      ~/.cargo/registry/index
+      ~/.cargo/registry/cache
+      ~/.cargo/git/db
+    key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+    restore-keys: |
+      ${{ runner.os }}-cargo-
+```
+
+**npm cache** (frontend and build jobs):
+```yaml
+- name: Cache npm
+  uses: actions/cache@v3
+  with:
+    path: ~/.npm
+    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+    restore-keys: |
+      ${{ runner.os }}-npm-
+```
+
+Cache keys for cross-compile jobs use a suffix to avoid collisions:
+- Windows build: `${{ runner.os }}-cargo-windows-${{ hashFiles('**/Cargo.lock') }}`
+- arm64 build: `${{ runner.os }}-cargo-arm64-${{ hashFiles('**/Cargo.lock') }}`
+
+---
+
+## Test Pipeline (`.gitea/workflows/test.yml`)
 
 **Triggers:** Pull requests only.
 
 ```
-Pipeline steps:
+Pipeline jobs (run in parallel):
   1. rust-fmt-check     → cargo fmt --check
   2. rust-clippy        → cargo clippy -- -D warnings
   3. rust-tests         → cargo test  (64 tests)
@@ -41,28 +106,9 @@ Pipeline steps:
 ```
 
 **Docker images used:**
-- `rust:1.88-slim` — Rust steps (minimum for cookie_store + time + darling)
+- `172.0.0.29:3000/sarman/trcaa-linux-amd64:rust1.88-node22` — Rust steps (replaces `rust:1.88-slim`)
 - `node:22-alpine` — Frontend steps
 
-**Pipeline YAML format (Woodpecker 2.x — steps list format):**
-```yaml
-clone:
-  git:
-    image: woodpeckerci/plugin-git
-    network_mode: gogs_default     # requires repo_trusted=1
-    environment:
-      - CI_REPO_CLONE_URL=http://gitea_app:3000/sarman/tftsr-devops_investigation.git
-
-steps:
-  - name: step-name                 # LIST format (- name:)
-    image: rust:1.88-slim
-    commands:
-      - cargo test
-```
-
-> ⚠️ Woodpecker 2.x uses the `steps:` list format. The legacy `pipeline:` map format from
-> Woodpecker 0.15.4 is no longer supported.
-
 ---
 
 ## Release Pipeline (`.gitea/workflows/auto-tag.yml`)
@@ -73,14 +119,16 @@ Auto tags are created by `.gitea/workflows/auto-tag.yml` using `git tag` + `git
 Release jobs are executed in the same workflow and depend on `autotag` completion.
 
 ```
-Jobs (run in parallel):
-  build-linux-amd64   → cargo tauri build (x86_64-unknown-linux-gnu)
+Jobs (run in parallel after autotag):
+  build-linux-amd64   → image: trcaa-linux-amd64:rust1.88-node22
+                         → cargo tauri build (x86_64-unknown-linux-gnu)
                          → {.deb, .rpm, .AppImage} uploaded to Gitea release
                          → fails fast if no Linux artifacts are produced
-  build-windows-amd64 → cargo tauri build (x86_64-pc-windows-gnu) via mingw-w64
+  build-windows-amd64 → image: trcaa-windows-cross:rust1.88-node22
+                         → cargo tauri build (x86_64-pc-windows-gnu) via mingw-w64
                          → {.exe, .msi} uploaded to Gitea release
                          → fails fast if no Windows artifacts are produced
-  build-linux-arm64   → Ubuntu 22.04 base (ports.ubuntu.com for arm64 packages)
+  build-linux-arm64   → image: trcaa-linux-arm64:rust1.88-node22 (ubuntu:22.04-based)
                          → cargo tauri build (aarch64-unknown-linux-gnu)
                          → {.deb, .rpm, .AppImage} uploaded to Gitea release
                          → fails fast if no Linux artifacts are produced
diff --git a/tickets/ci-runner-speed-optimization.md b/tickets/ci-runner-speed-optimization.md
new file mode 100644
index 00000000..577e43d0
--- /dev/null
+++ b/tickets/ci-runner-speed-optimization.md
@@ -0,0 +1,107 @@
+# CI Runner Speed Optimization via Pre-baked Images + Caching
+
+## Description
+
+Every CI run (both `test.yml` and `auto-tag.yml`) was installing system packages from scratch
+on each job invocation: `apt-get update`, Tauri system libs, Node.js via nodesource, and in
+the arm64 job — a full `rustup` install. This was the primary cause of slow builds.
+
+The repository already contains pre-baked builder Docker images (`.docker/Dockerfile.*`) and a
+`build-images.yml` workflow to push them to the local Gitea registry at `172.0.0.29:3000`.
+These images were never referenced by the actual CI jobs — a critical gap. This work closes
+that gap and adds `actions/cache@v3` for Cargo and npm.
+
+## Acceptance Criteria
+
+- [ ] `Dockerfile.linux-amd64` includes `rustfmt` and `clippy` components
+- [ ] `Dockerfile.linux-arm64` includes `rustfmt` and `clippy` components
+- [ ] `test.yml` Rust jobs use `172.0.0.29:3000/sarman/trcaa-linux-amd64:rust1.88-node22`
+- [ ] `test.yml` Rust jobs have no inline `apt-get` or `rustup component add` steps
+- [ ] `test.yml` Rust jobs include `actions/cache@v3` for `~/.cargo/registry`
+- [ ] `test.yml` frontend jobs include `actions/cache@v3` for `~/.npm`
+- [ ] `auto-tag.yml` `build-linux-amd64` uses pre-baked `trcaa-linux-amd64` image
+- [ ] `auto-tag.yml` `build-windows-amd64` uses pre-baked `trcaa-windows-cross` image
+- [ ] `auto-tag.yml` `build-linux-arm64` uses pre-baked `trcaa-linux-arm64` image
+- [ ] All three build jobs have no `Install dependencies` step
+- [ ] All three build jobs include `actions/cache@v3` for Cargo and npm
+- [ ] `docs/wiki/CICD-Pipeline.md` documents pre-baked images, cache keys, and server prerequisites
+- [ ] `build-images.yml` triggered manually before merging to ensure images exist in registry
+
+## Work Implemented
+
+### `.docker/Dockerfile.linux-amd64`
+Added `RUN rustup component add rustfmt clippy` after the existing target add line.
+The `rust-fmt-check` and `rust-clippy` CI jobs now rely on these being pre-installed
+in the image rather than installing them at job runtime.
+
+### `.docker/Dockerfile.linux-arm64`
+Added `&& /root/.cargo/bin/rustup component add rustfmt clippy` appended to the
+existing `rustup` installation RUN command (chained with `&&` to keep it one layer).
+
+### `.gitea/workflows/test.yml`
+- **rust-fmt-check**, **rust-clippy**, **rust-tests**: switched container image from
+  `rust:1.88-slim` → `172.0.0.29:3000/sarman/trcaa-linux-amd64:rust1.88-node22`.
+  Removed `apt-get install git` from Checkout steps (git is pre-installed in image).
+  Removed `apt-get install libwebkit2gtk-...` steps.
+  Removed `rustup component add rustfmt` and `rustup component add clippy` steps.
+  Added `actions/cache@v3` step for `~/.cargo/registry/index`, `~/.cargo/registry/cache`,
+  `~/.cargo/git/db` keyed on `Cargo.lock` hash.
+- **frontend-typecheck**, **frontend-tests**: kept `node:22-alpine` image (no change needed).
+  Added `actions/cache@v3` step for `~/.npm` keyed on `package-lock.json` hash.
+
+### `.gitea/workflows/auto-tag.yml`
+- **build-linux-amd64**: image `rust:1.88-slim` → `trcaa-linux-amd64:rust1.88-node22`.
+  Removed Checkout apt-get install git, removed entire Install dependencies step.
+  Removed `rustup target add x86_64-unknown-linux-gnu` from Build step. Added cargo + npm cache.
+- **build-windows-amd64**: image `rust:1.88-slim` → `trcaa-windows-cross:rust1.88-node22`.
+  Removed Checkout apt-get install git, removed entire Install dependencies step.
+  Removed `rustup target add x86_64-pc-windows-gnu` from Build step.
+  Added cargo (with `-windows-` suffix key to avoid collision) + npm cache.
+- **build-linux-arm64**: image `ubuntu:22.04` → `trcaa-linux-arm64:rust1.88-node22`.
+  Removed Checkout apt-get install git, removed entire Install dependencies step (~40 lines).
+  Removed `. "$HOME/.cargo/env"` (PATH already set via `ENV` in Dockerfile).
+  Removed `rustup target add aarch64-unknown-linux-gnu` from Build step.
+  Added cargo (with `-arm64-` suffix key) + npm cache.
+
+### `docs/wiki/CICD-Pipeline.md`
+Added two new sections before the Test Pipeline section:
+- **Pre-baked Builder Images**: table of all three images and their contents, rebuild
+  triggers, how-to-rebuild instructions, and the insecure-registries Docker daemon
+  prerequisite for 172.0.0.29.
+- **Cargo and npm Caching**: documents the `actions/cache@v3` key patterns in use,
+  including the per-platform cache key suffixes for cross-compile jobs.
+Updated the Test Pipeline section to reference the correct pre-baked image name.
+Updated the Release Pipeline job table to show which image each build job uses.
+
+## Testing Needed
+
+1. **Pre-build images** (prerequisite): Trigger `build-images.yml` via `workflow_dispatch`
+   on Gitea Actions UI. Confirm all 3 images are pushed and visible in the registry.
+
+2. **Server prerequisite**: Confirm `/etc/docker/daemon.json` on `172.0.0.29` contains
+   `{"insecure-registries":["172.0.0.29:3000"]}` and Docker was restarted after.
+
+3. **PR test suite**: Open a PR with these changes. Verify:
+   - All 5 test jobs pass (`rust-fmt-check`, `rust-clippy`, `rust-tests`,
+     `frontend-typecheck`, `frontend-tests`)
+   - Job logs show no `apt-get` or `rustup component add` output
+   - Cache hit messages appear on second run
+
+4. **Release build**: Merge to master. Verify `auto-tag.yml` runs and:
+   - All 3 Linux/Windows build jobs start without Install dependencies step
+   - Artifacts are produced and uploaded to the Gitea release
+   - Total release time is significantly reduced (~7 min vs ~25 min before)
+
+5. **Expected time savings after caching warms up**:
+   | Job | Before | After |
+   |-----|--------|-------|
+   | rust-fmt-check | ~2 min | ~20 sec |
+   | rust-clippy | ~4 min | ~45 sec |
+   | rust-tests | ~5 min | ~1.5 min |
+   | frontend-typecheck | ~2 min | ~30 sec |
+   | frontend-tests | ~3 min | ~40 sec |
+   | build-linux-amd64 | ~10 min | ~3 min |
+   | build-windows-amd64 | ~12 min | ~4 min |
+   | build-linux-arm64 | ~15 min | ~4 min |
+   | PR test total (parallel) | ~5 min | ~1.5 min |
+   | Release total | ~25 min | ~7 min |

From 16930dca708bfd24b284d8d88c94ffc3b0ade6a7 Mon Sep 17 00:00:00 2001
From: Shaun Arman <shaun.arman@motorolasolutions.com>
Date: Sun, 12 Apr 2026 18:28:07 -0500
Subject: [PATCH 2/7] =?UTF-8?q?fix(ci):=20address=20AI=20review=20?=
 =?UTF-8?q?=E2=80=94=20rustup=20idempotency=20and=20cargo=20--locked?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Dockerfiles:
- Merge rustup target add and component add into one chained RUN with
  || true guard, making it safe if rustfmt/clippy are already present
  in the base image's default toolchain profile (rust:1.88-slim default
  profile includes both; the guard is belt-and-suspenders)

test.yml:
- Add --locked to cargo clippy and cargo test to enforce Cargo.lock
  during CI, preventing silent dependency upgrades

Not addressed (accepted/out of scope):
- git in images: already installed in all three Dockerfiles (lines 19,
  13, 15 respectively) — reviewer finding was incorrect
- HTTP registry: accepted risk for air-gapped self-hosted infrastructure
- Image signing (Cosign): no infrastructure in place yet
- Hardcoded registry IP: consistent with project-wide pattern
---
 .docker/Dockerfile.linux-amd64 | 4 ++--
 .docker/Dockerfile.linux-arm64 | 2 +-
 .gitea/workflows/test.yml      | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.docker/Dockerfile.linux-amd64 b/.docker/Dockerfile.linux-amd64
index 600862a1..50267841 100644
--- a/.docker/Dockerfile.linux-amd64
+++ b/.docker/Dockerfile.linux-amd64
@@ -21,5 +21,5 @@ RUN apt-get update -qq \
     && apt-get install -y --no-install-recommends nodejs \
     && rm -rf /var/lib/apt/lists/*
 
-RUN rustup target add x86_64-unknown-linux-gnu
-RUN rustup component add rustfmt clippy
+RUN rustup target add x86_64-unknown-linux-gnu \
+    && rustup component add rustfmt clippy || true
diff --git a/.docker/Dockerfile.linux-arm64 b/.docker/Dockerfile.linux-arm64
index 2c43af2c..be6a9f51 100644
--- a/.docker/Dockerfile.linux-arm64
+++ b/.docker/Dockerfile.linux-arm64
@@ -41,6 +41,6 @@ RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
     --default-toolchain 1.88.0 --profile minimal --no-modify-path \
     && /root/.cargo/bin/rustup target add aarch64-unknown-linux-gnu \
-    && /root/.cargo/bin/rustup component add rustfmt clippy
+    && (/root/.cargo/bin/rustup component add rustfmt clippy || true)
 
 ENV PATH="/root/.cargo/bin:${PATH}"
diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index 1613500c..a87baff0 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -72,7 +72,7 @@ jobs:
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
             ${{ runner.os }}-cargo-
-      - run: cargo clippy --manifest-path src-tauri/Cargo.toml -- -D warnings
+      - run: cargo clippy --locked --manifest-path src-tauri/Cargo.toml -- -D warnings
 
   rust-tests:
     runs-on: ubuntu-latest
@@ -107,7 +107,7 @@ jobs:
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
             ${{ runner.os }}-cargo-
-      - run: cargo test --manifest-path src-tauri/Cargo.toml -- --test-threads=1
+      - run: cargo test --locked --manifest-path src-tauri/Cargo.toml -- --test-threads=1
 
   frontend-typecheck:
     runs-on: ubuntu-latest

From decd1fe5cf665241e69e3a32d95178459ea2bf45 Mon Sep 17 00:00:00 2001
From: Shaun Arman <shaun.arman@motorolasolutions.com>
Date: Sun, 12 Apr 2026 18:30:15 -0500
Subject: [PATCH 3/7] fix(ci): replace docker:24-cli with alpine + docker-cli
 in build-images
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

act_runner v0.3.1 has special-case handling for images named docker:*:
it automatically adds /var/run/docker.sock to the container's bind
mounts. The runner's own global config already mounts the socket, so
the two entries collide and the container fails to start with
"Duplicate mount point: /var/run/docker.sock".

Fix: use alpine:latest (no special handling) and install docker-cli
via apk alongside git in each Checkout step. The docker socket is
still available via the runner's global bind — we just stop triggering
the duplicate.
---
 .gitea/workflows/build-images.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.gitea/workflows/build-images.yml b/.gitea/workflows/build-images.yml
index 07cb0fa1..5bf6abc3 100644
--- a/.gitea/workflows/build-images.yml
+++ b/.gitea/workflows/build-images.yml
@@ -37,11 +37,11 @@ jobs:
   linux-amd64:
     runs-on: linux-amd64
     container:
-      image: docker:24-cli
+      image: alpine:latest
     steps:
       - name: Checkout
         run: |
-          apk add --no-cache git
+          apk add --no-cache git docker-cli
           git init
           git remote add origin http://172.0.0.29:3000/sarman/tftsr-devops_investigation.git
           git fetch --depth=1 origin "$GITHUB_SHA"
@@ -60,11 +60,11 @@ jobs:
   windows-cross:
     runs-on: linux-amd64
     container:
-      image: docker:24-cli
+      image: alpine:latest
     steps:
       - name: Checkout
         run: |
-          apk add --no-cache git
+          apk add --no-cache git docker-cli
           git init
           git remote add origin http://172.0.0.29:3000/sarman/tftsr-devops_investigation.git
           git fetch --depth=1 origin "$GITHUB_SHA"
@@ -83,11 +83,11 @@ jobs:
   linux-arm64:
     runs-on: linux-amd64
     container:
-      image: docker:24-cli
+      image: alpine:latest
     steps:
       - name: Checkout
         run: |
-          apk add --no-cache git
+          apk add --no-cache git docker-cli
           git init
           git remote add origin http://172.0.0.29:3000/sarman/tftsr-devops_investigation.git
           git fetch --depth=1 origin "$GITHUB_SHA"

From a86ae811616f699e872d8646dc09f3c09090c613 Mon Sep 17 00:00:00 2001
From: Shaun Arman <shaun.arman@motorolasolutions.com>
Date: Sun, 12 Apr 2026 18:54:57 -0500
Subject: [PATCH 4/7] docs(docker): expand rebuild trigger comments to include
 OpenSSL and Tauri CLI

---
 .docker/Dockerfile.linux-amd64   | 4 +++-
 .docker/Dockerfile.linux-arm64   | 4 +++-
 .docker/Dockerfile.windows-cross | 4 +++-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/.docker/Dockerfile.linux-amd64 b/.docker/Dockerfile.linux-amd64
index 50267841..922a937a 100644
--- a/.docker/Dockerfile.linux-amd64
+++ b/.docker/Dockerfile.linux-amd64
@@ -1,7 +1,9 @@
 # Pre-baked builder for Linux amd64 Tauri releases.
 # All system dependencies are installed once here; CI jobs skip apt-get entirely.
 # Rebuild when: Rust toolchain version changes, webkit2gtk/gtk major version changes,
-# or Node.js major version changes.  Tag format: rust<VER>-node<VER>
+# Node.js major version changes, OpenSSL major version changes (used via OPENSSL_STATIC=1),
+# or Tauri CLI version changes that affect bundler system deps.
+# Tag format: rust<VER>-node<VER>
 FROM rust:1.88-slim
 
 RUN apt-get update -qq \
diff --git a/.docker/Dockerfile.linux-arm64 b/.docker/Dockerfile.linux-arm64
index be6a9f51..0b9dc3e9 100644
--- a/.docker/Dockerfile.linux-arm64
+++ b/.docker/Dockerfile.linux-arm64
@@ -1,7 +1,9 @@
 # Pre-baked cross-compiler for Linux arm64 Tauri releases (runs on Linux amd64).
 # Bakes in: amd64 cross-toolchain, arm64 multiarch dev libs, Node.js, and Rust.
 # This image takes ~15 min to build but is only rebuilt when deps change.
-# Rebuild when: Rust toolchain version, webkit2gtk/gtk major version, or Node.js changes.
+# Rebuild when: Rust toolchain version, webkit2gtk/gtk major version, Node.js major version,
+# OpenSSL major version (used via OPENSSL_STATIC=1), or Tauri CLI changes that affect
+# bundler system deps.
 # Tag format: rust<VER>-node<VER>
 FROM ubuntu:22.04
 
diff --git a/.docker/Dockerfile.windows-cross b/.docker/Dockerfile.windows-cross
index 8399f8c6..879934fb 100644
--- a/.docker/Dockerfile.windows-cross
+++ b/.docker/Dockerfile.windows-cross
@@ -1,6 +1,8 @@
 # Pre-baked cross-compiler for Windows amd64 Tauri releases (runs on Linux amd64).
 # All MinGW and Node.js dependencies are installed once here; CI jobs skip apt-get entirely.
-# Rebuild when: Rust toolchain version changes or Node.js major version changes.
+# Rebuild when: Rust toolchain version changes, Node.js major version changes,
+# OpenSSL major version changes (used via OPENSSL_STATIC=1), or Tauri CLI changes
+# that affect bundler system deps.
 # Tag format: rust<VER>-node<VER>
 FROM rust:1.88-slim
 

From 461959fbcae41ffbee96dfb4b8e19c74fb3eb5e6 Mon Sep 17 00:00:00 2001
From: Shaun Arman <shaun.arman@motorolasolutions.com>
Date: Sun, 12 Apr 2026 19:42:08 -0500
Subject: [PATCH 5/7] fix(docker): add ca-certificates to arm64 base image step
 1

ubuntu:22.04 minimal does not guarantee ca-certificates is present
before the multiarch apt operations in Step 2. curl in Step 3 then
fails with error 77 (CURLE_SSL_CACERT_BADFILE) when fetching the
nodesource setup script over HTTPS.
---
 .docker/Dockerfile.linux-arm64 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.docker/Dockerfile.linux-arm64 b/.docker/Dockerfile.linux-arm64
index 0b9dc3e9..20536949 100644
--- a/.docker/Dockerfile.linux-arm64
+++ b/.docker/Dockerfile.linux-arm64
@@ -12,7 +12,7 @@ ARG DEBIAN_FRONTEND=noninteractive
 # Step 1: amd64 host tools and cross-compiler
 RUN apt-get update -qq \
     && apt-get install -y -qq --no-install-recommends \
-       curl git gcc g++ make patchelf pkg-config perl jq \
+       ca-certificates curl git gcc g++ make patchelf pkg-config perl jq \
        gcc-aarch64-linux-gnu g++-aarch64-linux-gnu \
     && rm -rf /var/lib/apt/lists/*
 

From 2ce38b9477d45f400302200a60652608cbee8d86 Mon Sep 17 00:00:00 2001
From: Shaun Arman <shaun.arman@motorolasolutions.com>
Date: Sun, 12 Apr 2026 19:59:41 -0500
Subject: [PATCH 6/7] =?UTF-8?q?fix(ci):=20resolve=20test.yml=20failures=20?=
 =?UTF-8?q?=E2=80=94=20Cargo.lock,=20updated=20test=20assertions?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cargo.lock:
- Commit the pre-existing version bump (0.1.0 → 0.2.50) so cargo
  --locked does not fail in CI; Cargo.toml already at 0.2.50

releaseWorkflowCrossPlatformArtifacts.test.ts:
- Update test that previously checked for ubuntu:22.04 / ports mirror
  inline in auto-tag.yml; that setup moved to the pre-baked
  trcaa-linux-arm64 image so the test now verifies the image reference
  and cross-compile env vars instead

ciDockerBuilders.test.ts:
- Update test that checked for docker:24-cli; changed to alpine:latest
  + docker-cli to avoid act_runner v0.3.1 duplicate socket mount bug;
  negative assertion on docker:24-cli retained
---
 src-tauri/Cargo.lock                                   |  2 +-
 tests/unit/ciDockerBuilders.test.ts                    |  8 ++++++--
 .../unit/releaseWorkflowCrossPlatformArtifacts.test.ts | 10 ++++++----
 3 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index 2e493b36..a201eec9 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -6139,7 +6139,7 @@ dependencies = [
 
 [[package]]
 name = "trcaa"
-version = "0.1.0"
+version = "0.2.50"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
diff --git a/tests/unit/ciDockerBuilders.test.ts b/tests/unit/ciDockerBuilders.test.ts
index bc2d2541..92f3225f 100644
--- a/tests/unit/ciDockerBuilders.test.ts
+++ b/tests/unit/ciDockerBuilders.test.ts
@@ -129,8 +129,12 @@ describe("build-images.yml workflow", () => {
     expect(wf).toContain("trcaa-linux-arm64:rust1.88-node22");
   });
 
-  it("uses docker:24-cli image for build jobs", () => {
-    expect(wf).toContain("docker:24-cli");
+  it("uses alpine:latest with docker-cli (not docker:24-cli which triggers duplicate socket mount in act_runner)", () => {
+    // act_runner v0.3.1 special-cases docker:* images and adds the socket bind;
+    // combined with its global socket bind this causes a 'Duplicate mount point' error.
+    expect(wf).toContain("alpine:latest");
+    expect(wf).toContain("docker-cli");
+    expect(wf).not.toContain("docker:24-cli");
   });
 
   it("runs all three build jobs on linux-amd64 runner", () => {
diff --git a/tests/unit/releaseWorkflowCrossPlatformArtifacts.test.ts b/tests/unit/releaseWorkflowCrossPlatformArtifacts.test.ts
index eeea410a..abe69ac1 100644
--- a/tests/unit/releaseWorkflowCrossPlatformArtifacts.test.ts
+++ b/tests/unit/releaseWorkflowCrossPlatformArtifacts.test.ts
@@ -44,11 +44,13 @@ describe("auto-tag release cross-platform artifact handling", () => {
     expect(workflow).toContain("UPLOAD_NAME=\"linux-arm64-$NAME\"");
   });
 
-  it("uses Ubuntu 22.04 with ports mirror for arm64 cross-compile", () => {
+  it("uses pre-baked Ubuntu 22.04 cross-compiler image for arm64", () => {
     const workflow = readFileSync(autoTagWorkflowPath, "utf-8");
 
-    expect(workflow).toContain("ubuntu:22.04");
-    expect(workflow).toContain("ports.ubuntu.com/ubuntu-ports");
-    expect(workflow).toContain("jammy");
+    // Multiarch ubuntu:22.04 + ports mirror setup moved to pre-baked image;
+    // verify workflow references the correct image and cross-compile env vars.
+    expect(workflow).toContain("trcaa-linux-arm64:rust1.88-node22");
+    expect(workflow).toContain("CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc");
+    expect(workflow).toContain("aarch64-unknown-linux-gnu");
   });
 });

From a365cba30e4de647572ab8e16da217cf6733acdf Mon Sep 17 00:00:00 2001
From: Shaun Arman <shaun.arman@motorolasolutions.com>
Date: Sun, 12 Apr 2026 20:07:20 -0500
Subject: [PATCH 7/7] =?UTF-8?q?fix(ci):=20address=20second=20AI=20review?=
 =?UTF-8?q?=20=E2=80=94=20||=20true,=20ca-certs,=20cache@v4,=20key=20suffi?=
 =?UTF-8?q?xes?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Dockerfiles:
- Remove || true from rustup component add in all three Linux images;
  rust:1.88-slim default profile already includes both components so the
  command is a clean no-op, not a failure risk — silencing errors served
  no purpose and only hid potential toolchain issues
- Add ca-certificates explicitly to Dockerfile.linux-amd64 and
  Dockerfile.windows-cross (rust:1.88-slim includes it, but being
  explicit is consistent with the arm64 fix and future-proofs against
  base image changes)

Workflows:
- Upgrade actions/cache@v3 → @v4 across test.yml and auto-tag.yml
  (v3 deprecated; v4 has parallel uploads and better large-cache support)
- Add linux-amd64 suffix to cargo cache keys in test.yml Rust jobs and
  auto-tag.yml build-linux-amd64 job; all four jobs target the same
  architecture and now share a cache, benefiting from cross-job hits
  (registry cache is source tarballs, not compiled artifacts — no
  pollution risk between targets)

Not changed:
- alpine:latest + docker-cli in build-images.yml is correct; the reviewer
  confused DinD with socket passthrough — docker:24-cli also has no daemon,
  both use the host socket; the builds already proved alpine works
- curl|bash for rustup is the official install method; rustup.rs publishes
  no checksums for the installer script itself
---
 .docker/Dockerfile.linux-amd64   |  3 ++-
 .docker/Dockerfile.linux-arm64   |  2 +-
 .docker/Dockerfile.windows-cross |  1 +
 .gitea/workflows/auto-tag.yml    | 16 ++++++++--------
 .gitea/workflows/test.yml        | 22 +++++++++++-----------
 5 files changed, 23 insertions(+), 21 deletions(-)

diff --git a/.docker/Dockerfile.linux-amd64 b/.docker/Dockerfile.linux-amd64
index 922a937a..1dbb3cc5 100644
--- a/.docker/Dockerfile.linux-amd64
+++ b/.docker/Dockerfile.linux-amd64
@@ -8,6 +8,7 @@ FROM rust:1.88-slim
 
 RUN apt-get update -qq \
     && apt-get install -y -qq --no-install-recommends \
+       ca-certificates \
        libwebkit2gtk-4.1-dev \
        libssl-dev \
        libgtk-3-dev \
@@ -24,4 +25,4 @@ RUN apt-get update -qq \
     && rm -rf /var/lib/apt/lists/*
 
 RUN rustup target add x86_64-unknown-linux-gnu \
-    && rustup component add rustfmt clippy || true
+    && rustup component add rustfmt clippy
diff --git a/.docker/Dockerfile.linux-arm64 b/.docker/Dockerfile.linux-arm64
index 20536949..328a33ef 100644
--- a/.docker/Dockerfile.linux-arm64
+++ b/.docker/Dockerfile.linux-arm64
@@ -43,6 +43,6 @@ RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
     --default-toolchain 1.88.0 --profile minimal --no-modify-path \
     && /root/.cargo/bin/rustup target add aarch64-unknown-linux-gnu \
-    && (/root/.cargo/bin/rustup component add rustfmt clippy || true)
+    && /root/.cargo/bin/rustup component add rustfmt clippy
 
 ENV PATH="/root/.cargo/bin:${PATH}"
diff --git a/.docker/Dockerfile.windows-cross b/.docker/Dockerfile.windows-cross
index 879934fb..bbef7507 100644
--- a/.docker/Dockerfile.windows-cross
+++ b/.docker/Dockerfile.windows-cross
@@ -8,6 +8,7 @@ FROM rust:1.88-slim
 
 RUN apt-get update -qq \
     && apt-get install -y -qq --no-install-recommends \
+       ca-certificates \
        mingw-w64 \
        curl \
        nsis \
diff --git a/.gitea/workflows/auto-tag.yml b/.gitea/workflows/auto-tag.yml
index dd48d02c..03680170 100644
--- a/.gitea/workflows/auto-tag.yml
+++ b/.gitea/workflows/auto-tag.yml
@@ -141,17 +141,17 @@ jobs:
           git fetch --depth=1 origin "$GITHUB_SHA"
           git checkout FETCH_HEAD
       - name: Cache cargo registry
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry/index
             ~/.cargo/registry/cache
             ~/.cargo/git/db
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-linux-amd64-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-cargo-
+            ${{ runner.os }}-cargo-linux-amd64-
       - name: Cache npm
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.npm
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
@@ -234,7 +234,7 @@ jobs:
           git fetch --depth=1 origin "$GITHUB_SHA"
           git checkout FETCH_HEAD
       - name: Cache cargo registry
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry/index
@@ -244,7 +244,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-cargo-windows-
       - name: Cache npm
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.npm
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
@@ -418,7 +418,7 @@ jobs:
           git fetch --depth=1 origin "$GITHUB_SHA"
           git checkout FETCH_HEAD
       - name: Cache cargo registry
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry/index
@@ -428,7 +428,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-cargo-arm64-
       - name: Cache npm
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.npm
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index a87baff0..c4347717 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -28,15 +28,15 @@ jobs:
           fi
           git checkout FETCH_HEAD
       - name: Cache cargo registry
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry/index
             ~/.cargo/registry/cache
             ~/.cargo/git/db
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-linux-amd64-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-cargo-
+            ${{ runner.os }}-cargo-linux-amd64-
       - run: cargo fmt --manifest-path src-tauri/Cargo.toml --check
 
   rust-clippy:
@@ -63,15 +63,15 @@ jobs:
           fi
           git checkout FETCH_HEAD
       - name: Cache cargo registry
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry/index
             ~/.cargo/registry/cache
             ~/.cargo/git/db
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-linux-amd64-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-cargo-
+            ${{ runner.os }}-cargo-linux-amd64-
       - run: cargo clippy --locked --manifest-path src-tauri/Cargo.toml -- -D warnings
 
   rust-tests:
@@ -98,15 +98,15 @@ jobs:
           fi
           git checkout FETCH_HEAD
       - name: Cache cargo registry
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry/index
             ~/.cargo/registry/cache
             ~/.cargo/git/db
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-linux-amd64-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-cargo-
+            ${{ runner.os }}-cargo-linux-amd64-
       - run: cargo test --locked --manifest-path src-tauri/Cargo.toml -- --test-threads=1
 
   frontend-typecheck:
@@ -134,7 +134,7 @@ jobs:
           fi
           git checkout FETCH_HEAD
       - name: Cache npm
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.npm
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
@@ -168,7 +168,7 @@ jobs:
           fi
           git checkout FETCH_HEAD
       - name: Cache npm
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.npm
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}