fix(ci): reduce Docker Actions cost without weakening PR gates (#232)

* fix(docker): update workflow to improve Docker image build and push process, add timeout

* fix(licenses): allow Apache-2.0 WITH LLVM-exception

.github/workflows/docker.yml

@@ -6,6 +6,16 @@ on:
         tags: ["v*"]
     pull_request:
         branches: [main]
+        paths:
+            - "Dockerfile"
+            - "docker-compose.yml"
+            - "dev/docker-compose.yml"
+            - "dev/sandbox/**"
+            - ".github/workflows/docker.yml"
+
+concurrency:
+    group: docker-${{ github.event.pull_request.number || github.ref }}
+    cancel-in-progress: true
 
 env:
     REGISTRY: ghcr.io
@@ -15,10 +25,10 @@ jobs:
     build-and-push:
         name: Build and Push Docker Image
         runs-on: ubuntu-latest
+        timeout-minutes: 25
         permissions:
             contents: read
             packages: write
-    continue-on-error: true  # Don't block PRs on Docker build failures
 
         steps:
             - name: Checkout repository
@@ -48,19 +58,31 @@ jobs:
                       type=semver,pattern={{major}}
                       type=raw,value=latest,enable={{is_default_branch}}
 
-      - name: Build and push Docker image
+            - name: Build and push Docker image (push/tag)
+              if: github.event_name != 'pull_request'
               uses: docker/build-push-action@v5
               with:
                   context: .
-          push: ${{ github.event_name != 'pull_request' }}
+                  push: true
                   tags: ${{ steps.meta.outputs.tags }}
                   labels: ${{ steps.meta.outputs.labels }}
                   cache-from: type=gha
                   cache-to: type=gha,mode=max
                   platforms: linux/amd64,linux/arm64
 
+            - name: Build smoke image (PR only)
+              if: github.event_name == 'pull_request'
+              uses: docker/build-push-action@v5
+              with:
+                  context: .
+                  push: false
+                  load: true
+                  tags: zeroclaw-pr-smoke:latest
+                  labels: ${{ steps.meta.outputs.labels }}
+                  cache-from: type=gha
+                  platforms: linux/amd64
+
             - name: Verify image (PR only)
               if: github.event_name == 'pull_request'
               run: |
-          docker build -t zeroclaw-test .
-          docker run --rm zeroclaw-test --version
+                  docker run --rm zeroclaw-pr-smoke:latest --version

deny.toml

@@ -10,6 +10,7 @@ yanked = "warn"
 allow = [
     "MIT",
     "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
     "BSD-2-Clause",
     "BSD-3-Clause",
     "ISC",