use per-checkout cache directories for builds

Dockerfile

@@ -11,10 +11,11 @@ FROM ${SDK} as sdk
 FROM scratch AS cache
 ARG PACKAGE
 ARG ARCH
+ARG TOKEN
 # We can't create directories via RUN in a scratch container, so take an existing one.
 COPY --chown=1000:1000 --from=sdk /tmp /cache
 # Ensure the ARG variables are used in the layer to prevent reuse by other builds.
-COPY --chown=1000:1000 .dockerignore /cache/.${PACKAGE}.${ARCH}
+COPY --chown=1000:1000 .dockerignore /cache/.${PACKAGE}.${ARCH}.${TOKEN}
 
 # Some builds need to modify files in the source directory, for example Rust
 # software using build.rs to generate code.  The source directory is mounted in
@@ -32,10 +33,11 @@ FROM scratch AS variantcache
 ARG PACKAGE
 ARG ARCH
 ARG VARIANT
+ARG TOKEN
 # We can't create directories via RUN in a scratch container, so take an existing one.
 COPY --chown=1000:1000 --from=sdk /tmp /variantcache
 # Ensure the ARG variables are used in the layer to prevent reuse by other builds.
-COPY --chown=1000:1000 .dockerignore /variantcache/.${PACKAGE}.${ARCH}.${VARIANT}
+COPY --chown=1000:1000 .dockerignore /variantcache/.${PACKAGE}.${ARCH}.${VARIANT}.${TOKEN}
 
 FROM sdk AS rpmbuild
 ARG PACKAGE

tools/buildsys/src/builder.rs

@@ -123,8 +123,8 @@ fn build(target: &str, build_args: &str, tag: &str, output: &str) -> Result<()>
     let mut d = Sha512::new();
     d.update(&root);
     let digest = hex::encode(d.finalize());
-    let suffix = &digest[..12];
-    let tag = format!("{}-{}", tag, suffix);
+    let token = &digest[..12];
+    let tag = format!("{}-{}", tag, token);
 
     // Our SDK image is picked by the external `cargo make` invocation.
     let sdk = getenv("BUILDSYS_SDK_IMAGE")?;
@@ -134,18 +134,23 @@ fn build(target: &str, build_args: &str, tag: &str, output: &str) -> Result<()>
     let nocache = rand::thread_rng().gen::<u32>();
     let nocache_args = format!("--build-arg NOCACHE={}", nocache);
 
+    // Avoid using a cached layer from a concurrent build in another checkout.
+    let token_args = format!("--build-arg TOKEN={}", token);
+
     let build = args(format!(
         "build . \
          --network none \
          --target {target} \
          {build_args} \
          {sdk_args} \
          {nocache_args} \
+         {token_args} \
          --tag {tag}",
         target = target,
         build_args = build_args,
         sdk_args = sdk_args,
         nocache_args = nocache_args,
+        token_args = token_args,
         tag = tag,
     ));