Restrict recipe stage to manifest-only COPY to prevent spurious cook cache invalidation

[josecelano]

Goal

Prevent the cargo chef cook (dependency) layers from being invalidated on every source code change by replacing the full-tree COPY . /build/src in the recipe stage with a manifest-only copy of Cargo.toml and Cargo.lock files.

Background

The current recipe stage does:

FROM chef AS recipe
WORKDIR /build/src
COPY . /build/src          # copies the entire source tree
RUN cargo chef prepare --recipe-path /build/recipe.json

The cargo chef prepare command only reads Cargo.toml manifests and Cargo.lock to build recipe.json. It does not read any .rs source files. This is explicitly stated in cargo-chef's own CLI description:

"Analyze the current project to determine the minimum subset of files (Cargo.lock and Cargo.toml manifests) required to build it and cache dependencies"

Because COPY . /build/src copies all source files into the recipe stage, Docker invalidates that layer's cache whenever any tracked file changes — including .rs files, documentation, and scripts. Since the recipe stage is upstream of both dependencies and dependencies_debug cook stages, this cascades into a full external dependency recompile (~200–400 s) on every PR that only changes application code.

The Fix

Replace the full-tree copy with a manifest-only copy in the recipe stage — one COPY line per workspace member Cargo.toml, plus the root Cargo.lock. After this change, the recipe stage cache (and therefore the cook layers) is only invalidated when Cargo.toml or Cargo.lock actually changes — not on every .rs edit.

Maintenance Cost

The manifest-only COPY list must be kept in sync with the workspace member list in the root Cargo.toml. The workspace is relatively stable (packages are being extracted to separate repos under EPIC #1669, reducing the list over time). A CI check can catch drift automatically.

Acceptance Criteria

• AC1: The recipe stage uses only manifest-only COPY lines — no COPY . /build/src.
• AC2: cargo chef prepare produces a recipe.json equivalent to the current output.
• AC3: A warm-cache rebuild triggered by a .rs-only change no longer invalidates the cook layers.
• AC4: All Containerfile targets build successfully end-to-end.
• AC5: Build time improvement for .rs-only changes is measured and documented.
• AC6: A mechanism exists to detect workspace-member drift from the Containerfile manifest list.

Related

• Parent EPIC: EPIC: Improve PR Workflow Performance #1840
• Baseline analysis: Baseline workflow profiling and bottleneck analysis (EPIC #1840) #1841
• Companion issue: Audit .dockerignore to minimize Docker build context #1851 (reduces context size; this issue fixes the recipe-layer invalidation)
• Full spec: docs/issues/open/ (after spec PR merge)