From bb69c34b4b62a1a229045bcd114f87cf4477ed8f Mon Sep 17 00:00:00 2001
From: Garry Tan <garrytan@gmail.com>
Date: Sat, 15 Aug 2026 17:30:06 -0700
Subject: [PATCH] ci: setup-buildx before every cache-exporting image build

First live run of the cache trio failed at flag-parse time: the
default buildx `docker` driver hard-errors on cache-to registry
export ('Cache export is not supported for the docker driver'), which
failed build-image on PR #2593 and skipped the entire gate eval
matrix behind it. docker/setup-buildx-action creates the
docker-container builder that supports registry cache export; all
three build sites (evals, evals-periodic, ci-image) get it.
---
 .github/workflows/ci-image.yml       | 4 ++++
 .github/workflows/evals-periodic.yml | 5 +++++
 .github/workflows/evals.yml          | 5 +++++
 3 files changed, 14 insertions(+)

diff --git a/.github/workflows/ci-image.yml b/.github/workflows/ci-image.yml
index 66e044297..2cb916063 100644
--- a/.github/workflows/ci-image.yml
+++ b/.github/workflows/ci-image.yml
@@ -37,6 +37,10 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      # Registry cache export needs a docker-container builder — the default
+      # `docker` driver hard-errors on cache-to.
+      - uses: docker/setup-buildx-action@v3
+
       - uses: docker/build-push-action@v6
         with:
           context: .github/docker
diff --git a/.github/workflows/evals-periodic.yml b/.github/workflows/evals-periodic.yml
index 3a6875cda..2bbfb5bf9 100644
--- a/.github/workflows/evals-periodic.yml
+++ b/.github/workflows/evals-periodic.yml
@@ -47,6 +47,11 @@ jobs:
       - if: steps.check.outputs.exists == 'false'
         run: cp package.json bun.lock .github/docker/
 
+      # Registry cache export needs a docker-container builder — the default
+      # `docker` driver hard-errors on cache-to.
+      - if: steps.check.outputs.exists == 'false'
+        uses: docker/setup-buildx-action@v3
+
       - if: steps.check.outputs.exists == 'false'
         uses: docker/build-push-action@v6
         with:
diff --git a/.github/workflows/evals.yml b/.github/workflows/evals.yml
index 629d371d3..56253b223 100644
--- a/.github/workflows/evals.yml
+++ b/.github/workflows/evals.yml
@@ -60,6 +60,11 @@ jobs:
       # Still BUILD (validates Dockerfile.ci changes), just don't publish. This
       # job intentionally keeps no `if:` so fork PRs still get one real, honest
       # green check here instead of a run where every job is grey.
+      # Registry cache export needs a docker-container builder — the default
+      # `docker` driver hard-errors on cache-to (first live run of the trio).
+      - if: steps.check.outputs.exists == 'false'
+        uses: docker/setup-buildx-action@v3
+
       - if: steps.check.outputs.exists == 'false'
         uses: docker/build-push-action@v6
         with: