fix: clean up Dockerfile.tpc and split CI into two jobs

- Remove invalid FROM stage that caused BASE_IMAGE to be blank
- Split workflow into build-base and build-tpc jobs so the TPC
  image can pull the base from GHCR after it's pushed

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jalagrange

.github/workflows/build-tpc.yml

@@ -17,11 +17,13 @@ env:
   TPC_IMAGE: ghcr.io/${{ github.repository }}-tpc
 
 jobs:
-  build:
+  build-base:
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
+    outputs:
+      tag: ${{ steps.version.outputs.tag }}
 
     steps:
       - name: Checkout
@@ -46,36 +48,55 @@ jobs:
             echo "tag=dev-$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
           fi
 
-      # Step 1: Build base OpenClaw image from upstream Dockerfile
-      - name: Build base OpenClaw image
+      - name: Build and push base OpenClaw image
         uses: docker/build-push-action@v5
         with:
           context: .
           file: Dockerfile
-          push: ${{ github.event_name == 'push' || inputs.push }}
+          push: true
           tags: |
             ${{ env.BASE_IMAGE }}:${{ steps.version.outputs.tag }}
             ${{ env.BASE_IMAGE }}:latest
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=base
+          cache-to: type=gha,scope=base,mode=max
+
+  build-tpc:
+    runs-on: ubuntu-latest
+    needs: build-base
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
-      # Step 2: Build TPC-extended image on top
-      - name: Build TPC OpenClaw image
+      - name: Build and push TPC OpenClaw image
         uses: docker/build-push-action@v5
         with:
           context: .
           file: Dockerfile.tpc
           build-args: |
-            BASE_IMAGE=${{ env.BASE_IMAGE }}:${{ steps.version.outputs.tag }}
+            BASE_IMAGE=${{ env.BASE_IMAGE }}:${{ needs.build-base.outputs.tag }}
           push: ${{ github.event_name == 'push' || inputs.push }}
           tags: |
-            ${{ env.TPC_IMAGE }}:${{ steps.version.outputs.tag }}
+            ${{ env.TPC_IMAGE }}:${{ needs.build-base.outputs.tag }}
             ${{ env.TPC_IMAGE }}:latest
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=tpc
+          cache-to: type=gha,scope=tpc,mode=max
 
       - name: Summary
         run: |
           echo "### Built images" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Base: \`${{ env.BASE_IMAGE }}:${{ steps.version.outputs.tag }}\`" >> "$GITHUB_STEP_SUMMARY"
-          echo "- TPC:  \`${{ env.TPC_IMAGE }}:${{ steps.version.outputs.tag }}\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Base: \`${{ env.BASE_IMAGE }}:${{ needs.build-base.outputs.tag }}\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- TPC:  \`${{ env.TPC_IMAGE }}:${{ needs.build-base.outputs.tag }}\`" >> "$GITHUB_STEP_SUMMARY"

Dockerfile.tpc

@@ -1,31 +1,16 @@
 # TPC-specific OpenClaw image
 #
-# Builds OpenClaw from source using the upstream multi-stage Dockerfile,
-# then adds agent-browser + Chromium for the Buyer Acquisition agent's
-# web research capability.
+# Extends the base OpenClaw image with agent-browser + Chromium for
+# the Buyer Acquisition agent's web research capability.
 #
-# Build locally:
+# Build locally (after building base image):
+#   docker build -t openclaw:local .
 #   docker build -f Dockerfile.tpc -t openclaw-tpc:local .
 #
 # Build via CI:
 #   Pushed automatically to ghcr.io/moonshot-partners/openclaw-tpc
 #   on tag push (see .github/workflows/build-tpc.yml)
 
-# --- Build OpenClaw from source using the upstream Dockerfile ---
-# This is equivalent to: docker build -t openclaw:local .
-# We use the upstream Dockerfile as a build stage.
-
-FROM openclaw-base AS openclaw-build
-
-# --- Extend with TPC customisations ---
-# We can't easily chain multi-stage Dockerfiles, so we use a simpler
-# approach: build the base image first, then extend it.
-#
-# In practice, the GitHub Actions workflow does:
-#   1. docker build -t openclaw:local .           (upstream Dockerfile)
-#   2. docker build -f Dockerfile.tpc -t openclaw-tpc:local .  (this file)
-
-# Start from the locally-built OpenClaw image
 ARG BASE_IMAGE=openclaw:local
 FROM ${BASE_IMAGE}