From e2ea5502e31c698f5b36380ae81769c4fc519e78 Mon Sep 17 00:00:00 2001
From: han0110 <tinghan0110@gmail.com>
Date: Tue, 10 Feb 2026 15:24:24 +0000
Subject: [PATCH] ci: split test and image publishing

---
 .github/scripts/build-image.sh                |  25 +--
 .../scripts/pull-or-build-base-zkvm-image.sh  |  46 +++--
 .github/workflows/build-and-push-images.yml   | 182 ++++++++++++++++++
 .github/workflows/test-zkvm-airbender.yml     |   5 -
 .github/workflows/test-zkvm-jolt.yml          |   5 -
 .github/workflows/test-zkvm-miden.yml         |   5 -
 .github/workflows/test-zkvm-nexus.yml         |   5 -
 .github/workflows/test-zkvm-openvm.yml        |   5 -
 .github/workflows/test-zkvm-pico.yml          |   5 -
 .github/workflows/test-zkvm-risc0.yml         |   5 -
 .github/workflows/test-zkvm-sp1.yml           |   5 -
 .github/workflows/test-zkvm-ziren.yml         |   5 -
 .github/workflows/test-zkvm-zisk.yml          |   5 -
 .github/workflows/test-zkvm.yml               | 170 ++--------------
 14 files changed, 233 insertions(+), 240 deletions(-)
 create mode 100644 .github/workflows/build-and-push-images.yml

diff --git a/.github/scripts/build-image.sh b/.github/scripts/build-image.sh
index badd329..6375bfa 100755
--- a/.github/scripts/build-image.sh
+++ b/.github/scripts/build-image.sh
@@ -18,20 +18,20 @@ usage() {
     echo "Usage: $0 --zkvm <zkvm> --tag <tag> [--base] [--compiler] [--server] [--cluster] [--registry <registry>] [--cuda] [--cuda-archs <archs>] [--rustflags <flags>]"
     echo ""
     echo "Required:"
-    echo "  --zkvm <zkvm>       zkVM to build for (e.g., zisk, sp1, risc0)"
-    echo "  --tag <tag>         Image tag (e.g., 0.1.3, a8d7bc0, local)"
+    echo "  --zkvm <zkvm>            zkVM to build for (e.g., zisk, sp1, risc0)"
+    echo "  --tag <tag>              Image tag (e.g., 0.1.3, a8d7bc0, local, local-cuda)"
     echo ""
     echo "Image types (at least one required):"
-    echo "  --base              Build the base images"
-    echo "  --compiler          Build the compiler image"
-    echo "  --server            Build the server image"
-    echo "  --cluster           Build the cluster image"
+    echo "  --base                   Build the base images"
+    echo "  --compiler               Build the compiler image"
+    echo "  --server                 Build the server image"
+    echo "  --cluster                Build the cluster image"
     echo ""
     echo "Optional:"
-    echo "  --registry <reg>    Registry prefix (e.g., ghcr.io/eth-act/ere)"
-    echo "  --cuda              Enable CUDA support (appends -cuda to tag)"
-    echo "  --cuda-archs <archs> Set CUDA architectures (comma-separated, e.g., 89,120). Implies --cuda."
-    echo "  --rustflags <flags> Pass RUSTFLAGS to build"
+    echo "  --registry <registry>    Registry prefix (e.g., ghcr.io/eth-act/ere)"
+    echo "  --cuda                   Enable CUDA support"
+    echo "  --cuda-archs <archs>     Set CUDA architectures (comma-separated, e.g., 89,120). Implies --cuda."
+    echo "  --rustflags <flags>      Pass RUSTFLAGS to build"
     exit 1
 }
 
@@ -105,11 +105,6 @@ if [ "$BUILD_BASE" = false ] && [ "$BUILD_COMPILER" = false ] && [ "$BUILD_SERVE
     usage
 fi
 
-# Format tag with optional -cuda suffix
-if [ "$CUDA" = true ]; then
-    IMAGE_TAG="${IMAGE_TAG}-cuda"
-fi
-
 # Format image prefix
 if [ -n "$IMAGE_REGISTRY" ]; then
     # Remove trailing slash if present
diff --git a/.github/scripts/pull-or-build-base-zkvm-image.sh b/.github/scripts/pull-or-build-base-zkvm-image.sh
index 311f2d8..dbff1f3 100755
--- a/.github/scripts/pull-or-build-base-zkvm-image.sh
+++ b/.github/scripts/pull-or-build-base-zkvm-image.sh
@@ -9,17 +9,19 @@ ZKVM=""
 IMAGE_REGISTRY=""
 IMAGE_TAG=""
 CACHED_IMAGE_TAG=""
+CUDA_ARCHS=""
 
 usage() {
-    echo "Usage: $0 --zkvm <zkvm> --registry <registry> --tag <tag> [--cached-tag <cached-tag>]"
+    echo "Usage: $0 --zkvm <zkvm> --tag <tag> [--registry <registry>] [--cached-tag <cached-tag>] [--cuda-archs <archs>]"
     echo ""
     echo "Required:"
     echo "  --zkvm <zkvm>              zkVM to build for (e.g., zisk, sp1, risc0)"
-    echo "  --registry <registry>      Registry prefix (e.g., ghcr.io/eth-act/ere)"
-    echo "  --tag <tag>                Image tag (e.g., 0.1.3, a8d7bc0)"
+    echo "  --tag <tag>                Image tag (e.g., 0.1.3, a8d7bc0, local, local-cuda)"
     echo ""
     echo "Optional:"
+    echo "  --registry <registry>      Registry prefix (e.g., ghcr.io/eth-act/ere)"
     echo "  --cached-tag <cached-tag>  Cached image tag to try pulling from (skips pull if empty)"
+    echo "  --cuda-archs <archs>       Set CUDA architectures (comma-separated, e.g., 89,120)"
     exit 1
 }
 
@@ -42,6 +44,10 @@ while [[ $# -gt 0 ]]; do
             CACHED_IMAGE_TAG="$2"
             shift 2
             ;;
+        --cuda-archs)
+            CUDA_ARCHS="$2"
+            shift 2
+            ;;
         --help|-h)
             usage
             ;;
@@ -58,20 +64,26 @@ if [ -z "$ZKVM" ]; then
     usage
 fi
 
-if [ -z "$IMAGE_REGISTRY" ]; then
-    echo "Error: --registry is required"
-    usage
-fi
-
 if [ -z "$IMAGE_TAG" ]; then
     echo "Error: --tag is required"
     usage
 fi
 
-BASE_IMAGE="$IMAGE_REGISTRY/ere-base:$IMAGE_TAG"
-BASE_ZKVM_IMAGE="$IMAGE_REGISTRY/ere-base-$ZKVM:$IMAGE_TAG"
-CACHED_BASE_IMAGE="$IMAGE_REGISTRY/ere-base:$CACHED_IMAGE_TAG"
-CACHED_BASE_ZKVM_IMAGE="$IMAGE_REGISTRY/ere-base-$ZKVM:$CACHED_IMAGE_TAG"
+# Format image prefix
+if [ -n "$IMAGE_REGISTRY" ]; then
+    # Remove trailing slash if present
+    IMAGE_REGISTRY="${IMAGE_REGISTRY%/}"
+    IMAGE_PREFIX="${IMAGE_REGISTRY}/"
+else
+    IMAGE_PREFIX=""
+fi
+
+# Format image
+
+BASE_IMAGE="${IMAGE_PREFIX}ere-base:${IMAGE_TAG}"
+BASE_ZKVM_IMAGE="${IMAGE_PREFIX}ere-base-${ZKVM}:${IMAGE_TAG}"
+CACHED_BASE_IMAGE="${IMAGE_PREFIX}ere-base:${CACHED_IMAGE_TAG}"
+CACHED_BASE_ZKVM_IMAGE="${IMAGE_PREFIX}ere-base-${ZKVM}:${CACHED_IMAGE_TAG}"
 
 # Pull or build ere-base and ere-base-$ZKVM locally
 if [ -n "$CACHED_IMAGE_TAG" ] \
@@ -84,9 +96,9 @@ then
     docker tag "$CACHED_BASE_ZKVM_IMAGE" "$BASE_ZKVM_IMAGE"
 else
     echo "Building base images using build-image.sh"
-    "$SCRIPT_DIR/build-image.sh" \
-        --zkvm "$ZKVM" \
-        --registry "$IMAGE_REGISTRY" \
-        --tag "$IMAGE_TAG" \
-        --base
+    BUILD_ARGS=(--zkvm "$ZKVM" --registry "$IMAGE_REGISTRY" --tag "$IMAGE_TAG" --base)
+    if [ -n "$CUDA_ARCHS" ]; then
+        BUILD_ARGS+=(--cuda-archs "$CUDA_ARCHS")
+    fi
+    "$SCRIPT_DIR/build-image.sh" "${BUILD_ARGS[@]}"
 fi
diff --git a/.github/workflows/build-and-push-images.yml b/.github/workflows/build-and-push-images.yml
new file mode 100644
index 0000000..efbc002
--- /dev/null
+++ b/.github/workflows/build-and-push-images.yml
@@ -0,0 +1,182 @@
+name: Build and push images
+
+on:
+  push:
+    branches:
+      - master
+    tags:
+      - 'v*'
+
+jobs:
+  build_and_push:
+    name: Build and push docker image (${{ matrix.zkvm }})
+    if: github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { zkvm: airbender, cuda: true  }
+          - { zkvm: jolt,      cuda: false }
+          - { zkvm: miden,     cuda: false }
+          - { zkvm: nexus,     cuda: false }
+          - { zkvm: openvm,    cuda: true  }
+          - { zkvm: pico,      cuda: false }
+          - { zkvm: risc0,     cuda: true  }
+          - { zkvm: sp1,       cuda: true  }
+          - { zkvm: ziren,     cuda: false }
+          - { zkvm: zisk,      cuda: true  }
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Free up disk space
+        run: bash .github/scripts/free-up-disk-space.sh
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Compute image tag and registry
+        id: meta
+        run: |
+          GIT_SHA="${{ github.sha }}"
+          echo "tag=${GIT_SHA:0:7}" >> $GITHUB_OUTPUT
+          echo "registry=ghcr.io/${{ github.repository }}" >> $GITHUB_OUTPUT
+
+      - name: Build ere-base and ere-base-${{ matrix.zkvm }} images
+        run: |
+          bash .github/scripts/build-image.sh \
+            --zkvm ${{ matrix.zkvm }} \
+            --registry ${{ steps.meta.outputs.registry }} \
+            --tag ${{ steps.meta.outputs.tag }} \
+            --base
+
+      - name: Push ere-base and ere-base-${{ matrix.zkvm }} images
+        run: |
+          docker push ${{ steps.meta.outputs.registry }}/ere-base:${{ steps.meta.outputs.tag }}
+          docker push ${{ steps.meta.outputs.registry }}/ere-base-${{ matrix.zkvm }}:${{ steps.meta.outputs.tag }}
+
+      - name: Build ere-compiler-${{ matrix.zkvm }} and ere-server-${{ matrix.zkvm }} images
+        run: |
+          bash .github/scripts/build-image.sh \
+            --zkvm ${{ matrix.zkvm }} \
+            --registry ${{ steps.meta.outputs.registry }} \
+            --tag ${{ steps.meta.outputs.tag }} \
+            --compiler \
+            --server
+
+      - name: Push ere-compiler-${{ matrix.zkvm }} and ere-server-${{ matrix.zkvm }} images
+        run: |
+          docker push ${{ steps.meta.outputs.registry }}/ere-compiler-${{ matrix.zkvm }}:${{ steps.meta.outputs.tag }}
+          docker push ${{ steps.meta.outputs.registry }}/ere-server-${{ matrix.zkvm }}:${{ steps.meta.outputs.tag }}
+
+      - name: Build ere-base and ere-base-${{ matrix.zkvm }} images with CUDA enabled
+        if: matrix.cuda
+        run: |
+          bash .github/scripts/build-image.sh \
+            --zkvm ${{ matrix.zkvm }} \
+            --registry ${{ steps.meta.outputs.registry }} \
+            --tag ${{ steps.meta.outputs.tag }}-cuda \
+            --base \
+            --cuda-archs '89,120'
+
+      - name: Push ere-base and ere-base-${{ matrix.zkvm }} images with CUDA enabled
+        if: matrix.cuda
+        run: |
+          docker push ${{ steps.meta.outputs.registry }}/ere-base:${{ steps.meta.outputs.tag }}-cuda
+          docker push ${{ steps.meta.outputs.registry }}/ere-base-${{ matrix.zkvm }}:${{ steps.meta.outputs.tag }}-cuda
+
+      - name: Build ere-server-${{ matrix.zkvm }} image with CUDA enabled
+        if: matrix.cuda
+        run: |
+          bash .github/scripts/build-image.sh \
+            --zkvm ${{ matrix.zkvm }} \
+            --registry ${{ steps.meta.outputs.registry }} \
+            --tag ${{ steps.meta.outputs.tag }}-cuda \
+            --server \
+            --cuda-archs '89,120'
+
+      - name: Push ere-server-${{ matrix.zkvm }} image with CUDA enabled
+        if: matrix.cuda
+        run: |
+          docker push ${{ steps.meta.outputs.registry }}/ere-server-${{ matrix.zkvm }}:${{ steps.meta.outputs.tag }}-cuda
+
+  create_semver_tag:
+    name: Tag images with SemVer (${{ matrix.zkvm }})
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { zkvm: airbender, cuda: true  }
+          - { zkvm: jolt,      cuda: false }
+          - { zkvm: miden,     cuda: false }
+          - { zkvm: nexus,     cuda: false }
+          - { zkvm: openvm,    cuda: true  }
+          - { zkvm: pico,      cuda: false }
+          - { zkvm: risc0,     cuda: true  }
+          - { zkvm: sp1,       cuda: true  }
+          - { zkvm: ziren,     cuda: false }
+          - { zkvm: zisk,      cuda: true  }
+    steps:
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Add SemVer tag to images
+        run: |
+          GIT_SHA="${{ github.sha }}"
+          GIT_SHA_TAG="${GIT_SHA:0:7}"
+
+          GIT_TAG="${{ github.ref_name }}"
+          SEMVER_TAG="${GIT_TAG#v}"
+
+          IMAGE_REGISTRY="ghcr.io/${{ github.repository }}"
+
+          for IMAGE in \
+            "ere-base" \
+            "ere-base-${{ matrix.zkvm }}" \
+            "ere-compiler-${{ matrix.zkvm }}" \
+            "ere-server-${{ matrix.zkvm }}"
+          do
+            echo "Tagging $IMAGE_REGISTRY/$IMAGE:$GIT_SHA_TAG as $SEMVER_TAG"
+            docker buildx imagetools create \
+              "$IMAGE_REGISTRY/$IMAGE:$GIT_SHA_TAG" \
+              --tag "$IMAGE_REGISTRY/$IMAGE:$SEMVER_TAG"
+          done
+
+      - name: Add SemVer tag to images with CUDA enabled
+        if: matrix.cuda
+        run: |
+          GIT_SHA="${{ github.sha }}"
+          GIT_SHA_TAG="${GIT_SHA:0:7}"
+
+          GIT_TAG="${{ github.ref_name }}"
+          SEMVER_TAG="${GIT_TAG#v}"
+
+          IMAGE_REGISTRY="ghcr.io/${{ github.repository }}"
+
+          for IMAGE in \
+            "ere-base" \
+            "ere-base-${{ matrix.zkvm }}" \
+            "ere-server-${{ matrix.zkvm }}"
+          do
+            echo "Tagging $IMAGE_REGISTRY/$IMAGE:${GIT_SHA_TAG}-cuda as ${SEMVER_TAG}-cuda"
+            docker buildx imagetools create \
+              "$IMAGE_REGISTRY/$IMAGE:${GIT_SHA_TAG}-cuda" \
+              --tag "$IMAGE_REGISTRY/$IMAGE:${SEMVER_TAG}-cuda"
+          done
diff --git a/.github/workflows/test-zkvm-airbender.yml b/.github/workflows/test-zkvm-airbender.yml
index 66a5b03..e91be35 100644
--- a/.github/workflows/test-zkvm-airbender.yml
+++ b/.github/workflows/test-zkvm-airbender.yml
@@ -8,16 +8,11 @@ on:
   push:
     branches:
       - master
-    tags:
-      - 'v*'
   pull_request:
 
 jobs:
   test:
     uses: ./.github/workflows/test-zkvm.yml
-    permissions:
-      contents: read
-      packages: write
     with:
       zkvm: airbender
       skip_prove_test: true
diff --git a/.github/workflows/test-zkvm-jolt.yml b/.github/workflows/test-zkvm-jolt.yml
index 3139b01..bb35b01 100644
--- a/.github/workflows/test-zkvm-jolt.yml
+++ b/.github/workflows/test-zkvm-jolt.yml
@@ -8,15 +8,10 @@ on:
   push:
     branches:
       - master
-    tags:
-      - 'v*'
   pull_request:
 
 jobs:
   test:
     uses: ./.github/workflows/test-zkvm.yml
-    permissions:
-      contents: read
-      packages: write
     with:
       zkvm: jolt
diff --git a/.github/workflows/test-zkvm-miden.yml b/.github/workflows/test-zkvm-miden.yml
index 4d44703..6592c30 100644
--- a/.github/workflows/test-zkvm-miden.yml
+++ b/.github/workflows/test-zkvm-miden.yml
@@ -8,15 +8,10 @@ on:
   push:
     branches:
       - master
-    tags:
-      - 'v*'
   pull_request:
 
 jobs:
   test:
     uses: ./.github/workflows/test-zkvm.yml
-    permissions:
-      contents: read
-      packages: write
     with:
       zkvm: miden
diff --git a/.github/workflows/test-zkvm-nexus.yml b/.github/workflows/test-zkvm-nexus.yml
index 94ac704..31c8397 100644
--- a/.github/workflows/test-zkvm-nexus.yml
+++ b/.github/workflows/test-zkvm-nexus.yml
@@ -8,15 +8,10 @@ on:
   push:
     branches:
       - master
-    tags:
-      - 'v*'
   pull_request:
 
 jobs:
   test:
     uses: ./.github/workflows/test-zkvm.yml
-    permissions:
-      contents: read
-      packages: write
     with:
       zkvm: nexus
diff --git a/.github/workflows/test-zkvm-openvm.yml b/.github/workflows/test-zkvm-openvm.yml
index d6880b8..8223725 100644
--- a/.github/workflows/test-zkvm-openvm.yml
+++ b/.github/workflows/test-zkvm-openvm.yml
@@ -8,16 +8,11 @@ on:
   push:
     branches:
       - master
-    tags:
-      - 'v*'
   pull_request:
 
 jobs:
   test:
     uses: ./.github/workflows/test-zkvm.yml
-    permissions:
-      contents: read
-      packages: write
     with:
       zkvm: openvm
       cuda: true
diff --git a/.github/workflows/test-zkvm-pico.yml b/.github/workflows/test-zkvm-pico.yml
index 958d9f3..8a00e91 100644
--- a/.github/workflows/test-zkvm-pico.yml
+++ b/.github/workflows/test-zkvm-pico.yml
@@ -8,15 +8,10 @@ on:
   push:
     branches:
       - master
-    tags:
-      - 'v*'
   pull_request:
 
 jobs:
   test:
     uses: ./.github/workflows/test-zkvm.yml
-    permissions:
-      contents: read
-      packages: write
     with:
       zkvm: pico
diff --git a/.github/workflows/test-zkvm-risc0.yml b/.github/workflows/test-zkvm-risc0.yml
index 7d9d4d8..d294eb6 100644
--- a/.github/workflows/test-zkvm-risc0.yml
+++ b/.github/workflows/test-zkvm-risc0.yml
@@ -8,16 +8,11 @@ on:
   push:
     branches:
       - master
-    tags:
-      - 'v*'
   pull_request:
 
 jobs:
   test:
     uses: ./.github/workflows/test-zkvm.yml
-    permissions:
-      contents: read
-      packages: write
     with:
       zkvm: risc0
       cuda: true
diff --git a/.github/workflows/test-zkvm-sp1.yml b/.github/workflows/test-zkvm-sp1.yml
index 33e915b..e5e7e45 100644
--- a/.github/workflows/test-zkvm-sp1.yml
+++ b/.github/workflows/test-zkvm-sp1.yml
@@ -8,16 +8,11 @@ on:
   push:
     branches:
       - master
-    tags:
-      - 'v*'
   pull_request:
 
 jobs:
   test:
     uses: ./.github/workflows/test-zkvm.yml
-    permissions:
-      contents: read
-      packages: write
     with:
       zkvm: sp1
       cuda: true
diff --git a/.github/workflows/test-zkvm-ziren.yml b/.github/workflows/test-zkvm-ziren.yml
index 2ea7712..66dac7e 100644
--- a/.github/workflows/test-zkvm-ziren.yml
+++ b/.github/workflows/test-zkvm-ziren.yml
@@ -8,15 +8,10 @@ on:
   push:
     branches:
       - master
-    tags:
-      - 'v*'
   pull_request:
 
 jobs:
   test:
     uses: ./.github/workflows/test-zkvm.yml
-    permissions:
-      contents: read
-      packages: write
     with:
       zkvm: ziren
diff --git a/.github/workflows/test-zkvm-zisk.yml b/.github/workflows/test-zkvm-zisk.yml
index b60ba64..2d1209d 100644
--- a/.github/workflows/test-zkvm-zisk.yml
+++ b/.github/workflows/test-zkvm-zisk.yml
@@ -8,16 +8,11 @@ on:
   push:
     branches:
       - master
-    tags:
-      - 'v*'
   pull_request:
 
 jobs:
   test:
     uses: ./.github/workflows/test-zkvm.yml
-    permissions:
-      contents: read
-      packages: write
     with:
       zkvm: zisk
       cuda: true
diff --git a/.github/workflows/test-zkvm.yml b/.github/workflows/test-zkvm.yml
index ca941e9..8cf9b1a 100644
--- a/.github/workflows/test-zkvm.yml
+++ b/.github/workflows/test-zkvm.yml
@@ -23,65 +23,6 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
-  create_semver_image_tag:
-    name: Tag image with SemVer
-    if: startsWith(github.ref, 'refs/tags/')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Add SemVer tag to images
-        run: |
-          GIT_SHA="${{ github.sha }}"
-          GIT_SHA_TAG="${GIT_SHA:0:7}"
-
-          GIT_TAG="${{ github.ref_name }}"
-          SEMVER_TAG="${GIT_TAG#v}"
-
-          IMAGE_REGISTRY="ghcr.io/${{ github.repository }}"
-
-          for IMAGE in \
-            "ere-base" \
-            "ere-base-${{ inputs.zkvm }}" \
-            "ere-compiler-${{ inputs.zkvm }}" \
-            "ere-server-${{ inputs.zkvm }}"
-          do
-            echo "Tagging $IMAGE_REGISTRY/$IMAGE:$GIT_SHA_TAG as $SEMVER_TAG"
-            docker buildx imagetools create \
-              "$IMAGE_REGISTRY/$IMAGE:$GIT_SHA_TAG" \
-              --tag "$IMAGE_REGISTRY/$IMAGE:$SEMVER_TAG"
-          done
-
-      - name: Add SemVer tag to CUDA images
-        if: inputs.cuda
-        run: |
-          GIT_SHA="${{ github.sha }}"
-          GIT_SHA_TAG="${GIT_SHA:0:7}"
-
-          GIT_TAG="${{ github.ref_name }}"
-          SEMVER_TAG="${GIT_TAG#v}"
-
-          IMAGE_REGISTRY="ghcr.io/${{ github.repository }}"
-
-          for IMAGE in \
-            "ere-base" \
-            "ere-base-${{ inputs.zkvm }}" \
-            "ere-server-${{ inputs.zkvm }}"
-          do
-            echo "Tagging $IMAGE_REGISTRY/$IMAGE:${GIT_SHA_TAG}-cuda as ${SEMVER_TAG}-cuda"
-            docker buildx imagetools create \
-              "$IMAGE_REGISTRY/$IMAGE:${GIT_SHA_TAG}-cuda" \
-              --tag "$IMAGE_REGISTRY/$IMAGE:${SEMVER_TAG}-cuda"
-          done
-
   get_image_metadata:
     name: Get image metadata
     runs-on: ubuntu-latest
@@ -89,13 +30,7 @@ jobs:
       image_registry: ${{ steps.image_meta.outputs.image_registry }}
       image_tag: ${{ steps.image_meta.outputs.image_tag }}
       cached_image_tag: ${{ steps.image_meta.outputs.cached_image_tag }}
-      base_image: ${{ steps.image_meta.outputs.base_image }}
       base_zkvm_image: ${{ steps.image_meta.outputs.base_zkvm_image }}
-      compiler_zkvm_image: ${{ steps.image_meta.outputs.compiler_zkvm_image }}
-      server_zkvm_image: ${{ steps.image_meta.outputs.server_zkvm_image }}
-      base_image_cuda: ${{ steps.image_meta.outputs.base_image_cuda }}
-      base_zkvm_image_cuda: ${{ steps.image_meta.outputs.base_zkvm_image_cuda }}
-      server_zkvm_image_cuda: ${{ steps.image_meta.outputs.server_zkvm_image_cuda }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -121,32 +56,18 @@ jobs:
           fi
 
           IMAGE_REGISTRY="ghcr.io/${{ github.repository }}"
-          BASE_IMAGE="$IMAGE_REGISTRY/ere-base:$IMAGE_TAG"
           BASE_ZKVM_IMAGE="$IMAGE_REGISTRY/ere-base-${{ inputs.zkvm }}:$IMAGE_TAG"
-          COMPILER_ZKVM_IMAGE="$IMAGE_REGISTRY/ere-compiler-${{ inputs.zkvm }}:$IMAGE_TAG"
-          SERVER_ZKVM_IMAGE="$IMAGE_REGISTRY/ere-server-${{ inputs.zkvm }}:$IMAGE_TAG"
 
           echo "image_registry=$IMAGE_REGISTRY" >> $GITHUB_OUTPUT
           echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
           echo "cached_image_tag=$CACHED_IMAGE_TAG" >> $GITHUB_OUTPUT
-
-          echo "base_image=$BASE_IMAGE" >> $GITHUB_OUTPUT
           echo "base_zkvm_image=$BASE_ZKVM_IMAGE" >> $GITHUB_OUTPUT
-          echo "compiler_zkvm_image=$COMPILER_ZKVM_IMAGE" >> $GITHUB_OUTPUT
-          echo "server_zkvm_image=$SERVER_ZKVM_IMAGE" >> $GITHUB_OUTPUT
 
-          echo "base_image_cuda=$IMAGE_REGISTRY/ere-base:${IMAGE_TAG}-cuda" >> $GITHUB_OUTPUT
-          echo "base_zkvm_image_cuda=$IMAGE_REGISTRY/ere-base-${{ inputs.zkvm }}:${IMAGE_TAG}-cuda" >> $GITHUB_OUTPUT
-          echo "server_zkvm_image_cuda=$IMAGE_REGISTRY/ere-server-${{ inputs.zkvm }}:${IMAGE_TAG}-cuda" >> $GITHUB_OUTPUT
-
-  build_image:
-    name: Build image
-    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/master')
+  build_image_cuda_check:
+    name: Build image with CUDA enabled
+    if: inputs.cuda
     needs: get_image_metadata
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -154,95 +75,28 @@ jobs:
       - name: Free up disk space
         run: bash .github/scripts/free-up-disk-space.sh
 
-      - name: Log in to GitHub Container Registry
-        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build ere-base and ere-base-${{ inputs.zkvm }} images
+      - name: Pull or build ere-base and ere-base-${{ inputs.zkvm }} images with CUDA enabled
         run: |
-          bash .github/scripts/build-image.sh \
+          CACHED_TAG="${{ needs.get_image_metadata.outputs.cached_image_tag }}"
+          if [ -n "$CACHED_TAG" ]; then
+            CACHED_TAG="${CACHED_TAG}-cuda"
+          fi
+          bash .github/scripts/pull-or-build-base-zkvm-image.sh \
             --zkvm ${{ inputs.zkvm }} \
             --registry ${{ needs.get_image_metadata.outputs.image_registry }} \
-            --tag ${{ needs.get_image_metadata.outputs.image_tag }} \
-            --base
-
-      - name: Push ere-base and ere-base-${{ inputs.zkvm }} images
-        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
-        run: |
-          docker push ${{ needs.get_image_metadata.outputs.base_image }}
-          docker push ${{ needs.get_image_metadata.outputs.base_zkvm_image }}
-
-      - name: Build ere-compiler-${{ inputs.zkvm }} and ere-server-${{ inputs.zkvm }} images
-        run: |
-          bash .github/scripts/build-image.sh \
-            --zkvm ${{ inputs.zkvm }} \
-            --registry ${{ needs.get_image_metadata.outputs.image_registry }} \
-            --tag ${{ needs.get_image_metadata.outputs.image_tag }} \
-            --compiler \
-            --server
-
-      - name: Push ere-compiler-${{ inputs.zkvm }} and ere-server-${{ inputs.zkvm }} images
-        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
-        run: |
-          docker push ${{ needs.get_image_metadata.outputs.compiler_zkvm_image }}
-          docker push ${{ needs.get_image_metadata.outputs.server_zkvm_image }}
-
-  build_image_cuda:
-    name: Build image (CUDA)
-    if: inputs.cuda && (github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/master'))
-    needs: get_image_metadata
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Free up disk space
-        run: bash .github/scripts/free-up-disk-space.sh
-
-      - name: Log in to GitHub Container Registry
-        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build ere-base and ere-base-${{ inputs.zkvm }} CUDA images
-        run: |
-          bash .github/scripts/build-image.sh \
-            --zkvm ${{ inputs.zkvm }} \
-            --registry ${{ needs.get_image_metadata.outputs.image_registry }} \
-            --tag ${{ needs.get_image_metadata.outputs.image_tag }} \
-            --base \
+            --tag ${{ needs.get_image_metadata.outputs.image_tag }}-cuda \
+            --cached-tag "$CACHED_TAG" \
             --cuda-archs '89,120'
 
-      - name: Push ere-base and ere-base-${{ inputs.zkvm }} CUDA images
-        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
-        run: |
-          docker push ${{ needs.get_image_metadata.outputs.base_image_cuda }}
-          docker push ${{ needs.get_image_metadata.outputs.base_zkvm_image_cuda }}
-
       - name: Build ere-server-${{ inputs.zkvm }} CUDA image
         run: |
           bash .github/scripts/build-image.sh \
             --zkvm ${{ inputs.zkvm }} \
             --registry ${{ needs.get_image_metadata.outputs.image_registry }} \
-            --tag ${{ needs.get_image_metadata.outputs.image_tag }} \
+            --tag ${{ needs.get_image_metadata.outputs.image_tag }}-cuda \
             --server \
             --cuda-archs '89,120'
 
-      - name: Push ere-server-${{ inputs.zkvm }} CUDA image
-        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
-        run: |
-          docker push ${{ needs.get_image_metadata.outputs.server_zkvm_image_cuda }}
-
   clippy_via_docker:
     name: Clippy via Docker
     needs: get_image_metadata