Ensure using the latest image

Author: kou

.github/workflows/rc.yml

@@ -138,6 +138,11 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build Docker image
+        env:
+          VCPKG_BINARY_SOURCES: "clear;nuget,GitHub,readwrite"
+        run: |
+          docker compose build --pull vcpkg-jni
       - name: Cache
         uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:

ci/docker/vcpkg-jni.dockerfile

@@ -18,9 +18,21 @@
 ARG base
 FROM ${base}
 
-# Install the libraries required by Gandiva to run
-# Use enable llvm[enable-rtti] in the vcpkg.json to avoid link problems in Gandiva
-RUN vcpkg install \
+# For --mount=type=secret: The GITHUB_TOKEN is the only real secret
+# but we use --mount=type=secret for GITHUB_REPOSITORY_OWNER and
+# VCPKG_BINARY_SOURCES too because we don't want to store them into
+# the built image in order to easily reuse the built image cache.
+#
+# Install the libraries required by Gandiva to run. Use enable
+# llvm[enable-rtti] in the vcpkg.json to avoid link problems in
+# Gandiva.
+RUN --mount=type=secret,id=github_repository_owner \
+    --mount=type=secret,id=github_token \
+    --mount=type=secret,id=vcpkg_binary_sources \
+      export GITHUB_REPOSITORY_OWNER=$(cat /run/secrets/github_repository_owner); \
+      export GITHUB_TOKEN=$(cat /run/secrets/github_token); \
+      export VCPKG_BINARY_SOURCES=$(cat /run/secrets/vcpkg_binary_sources); \
+      vcpkg install \
         --clean-after-build \
         --x-install-root=${VCPKG_ROOT}/installed \
         --x-manifest-root=/arrow/ci/vcpkg \
@@ -30,7 +42,8 @@ RUN vcpkg install \
         --x-feature=json \
         --x-feature=parquet \
         --x-feature=gandiva \
-        --x-feature=s3
+        --x-feature=s3 && \
+      rm -rf ~/.config/NuGet/
 
 # Install Java
 # We need Java for JNI headers, but we don't invoke Maven in this build.

compose.yaml

@@ -100,6 +100,10 @@ services:
         - ${REPO}:${ARCH}-vcpkg-jni-${VCPKG}
       args:
         base: ${ARROW_REPO}:${ARCH}-python-${PYTHON}-wheel-manylinux-2-28-vcpkg-${VCPKG}
+      secrets:
+        - github_repository_owner
+        - github_token
+        - vcpkg_binary_sources
     volumes:
       - .:/arrow-java:delegated
       - ${ARROW_REPO_ROOT}:/arrow:delegated
@@ -111,3 +115,11 @@ services:
     command:
       ["git config --global --add safe.directory /arrow-java && \
         /arrow-java/ci/scripts/jni_manylinux_build.sh /arrow-java /arrow /build/java /arrow-java/jni"]
+
+secrets:
+  github_repository_owner:
+    environment: GITHUB_REPOSITORY_OWNER
+  github_token:
+    environment: GITHUB_TOKEN
+  vcpkg_binary_sources:
+    environment: VCPKG_BINARY_SOURCES