From 1e33821e19d8cdc59cb6a47da142e8aa39963af1 Mon Sep 17 00:00:00 2001
From: DaniPopes <57450786+DaniPopes@users.noreply.github.com>
Date: Mon, 26 Jan 2026 21:37:33 +0100
Subject: [PATCH] ci: use depot cache in Dockerfile.depot (#21450)

---
 .github/workflows/docker.yml |  1 +
 Dockerfile.depot             | 13 ++++++++-----
 docker-bake.hcl              |  8 +++++++-
 3 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index c0b77e4ac0..6d4c4cad18 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -93,6 +93,7 @@ jobs:
           VERGEN_GIT_SHA: ${{ steps.git.outputs.sha }}
           VERGEN_GIT_DESCRIBE: ${{ steps.git.outputs.describe }}
           VERGEN_GIT_DIRTY: ${{ steps.git.outputs.dirty }}
+          DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
           files: docker-bake.hcl
diff --git a/Dockerfile.depot b/Dockerfile.depot
index a94eedd11b..341ce881e6 100644
--- a/Dockerfile.depot
+++ b/Dockerfile.depot
@@ -1,4 +1,4 @@
-# syntax=docker.io/docker/dockerfile:1.7-labs
+# syntax=docker/dockerfile:1
 
 # Unified Dockerfile for reth and op-reth, optimized for Depot builds
 # Usage:
@@ -17,6 +17,7 @@ RUN apt-get update && apt-get install -y libclang-dev pkg-config
 RUN cargo install sccache --locked
 ENV RUSTC_WRAPPER=sccache
 ENV SCCACHE_DIR=/sccache
+ENV SCCACHE_WEBDAV_ENDPOINT=https://cache.depot.dev
 
 # Builds a cargo-chef plan
 FROM chef AS planner
@@ -52,15 +53,17 @@ ENV VERGEN_GIT_SHA=$VERGEN_GIT_SHA
 ENV VERGEN_GIT_DESCRIBE=$VERGEN_GIT_DESCRIBE
 ENV VERGEN_GIT_DIRTY=$VERGEN_GIT_DIRTY
 
-# Build dependencies with cache mounts
-RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
+# Build dependencies
+RUN --mount=type=secret,id=DEPOT_TOKEN,env=SCCACHE_WEBDAV_TOKEN \
+    --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
     --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
     --mount=type=cache,target=$SCCACHE_DIR,sharing=locked \
     cargo chef cook --profile $BUILD_PROFILE --features "$FEATURES" --locked --recipe-path recipe.json --manifest-path $MANIFEST_PATH/Cargo.toml
 
-# Build application with cache mounts
+# Build application
 COPY --exclude=.git . .
-RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
+RUN --mount=type=secret,id=DEPOT_TOKEN,env=SCCACHE_WEBDAV_TOKEN \
+    --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
     --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
     --mount=type=cache,target=$SCCACHE_DIR,sharing=locked \
     cargo build --profile $BUILD_PROFILE --features "$FEATURES" --locked --bin $BINARY --manifest-path $MANIFEST_PATH/Cargo.toml
diff --git a/docker-bake.hcl b/docker-bake.hcl
index 2cec47ccdb..ffa824668b 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -52,7 +52,13 @@ target "_base" {
     VERGEN_GIT_SHA     = "${VERGEN_GIT_SHA}"
     VERGEN_GIT_DESCRIBE = "${VERGEN_GIT_DESCRIBE}"
     VERGEN_GIT_DIRTY   = "${VERGEN_GIT_DIRTY}"
-  }
+  },
+  secret = [
+    {
+      type = "env"
+      id   = "DEPOT_TOKEN"
+    }
+  ]
 }
 target "_base_profiling" {
   inherits = ["_base"]