refactor: call getDeterministicMtime() once per build function

Move getDeterministicMtime() calls to the beginning of each build function
to avoid duplicate calls and ensure the same timestamp is used throughout.

- buildYarn(): call once at start
- buildGo(): call once at start
- buildDocker(): call once at start (was called 3 times)
- buildGeneric(): call once at start (was called 2 times)

This is more efficient and guarantees the same timestamp is used for all
tar archives created within a single build function.

Co-authored-by: Ona <no-reply@ona.com>

Author: leodido

pkg/leeway/build.go

@@ -1934,6 +1934,12 @@ func (p *Package) buildDocker(buildctx *buildContext, wd, result string) (res *p
 		return nil, err
 	}
 
+	// Get deterministic mtime for tar archives (call once, reuse throughout)
+	mtime, err := p.getDeterministicMtime()
+	if err != nil {
+		return nil, err
+	}
+
 	// Determine final exportToCache value with proper precedence
 	determineDockerExportMode(p, &cfg, buildctx)
 
@@ -2075,12 +2081,6 @@ func (p *Package) buildDocker(buildctx *buildContext, wd, result string) (res *p
 			return subjects, containerDir, nil
 		}
 
-		// Get deterministic mtime for tar archives
-		mtime, err := p.getDeterministicMtime()
-		if err != nil {
-			return nil, err
-		}
-
 		// Create package with improved diagnostic logging
 		var pkgcmds [][]string
 
@@ -2134,12 +2134,6 @@ func (p *Package) buildDocker(buildctx *buildContext, wd, result string) (res *p
 		encodedMetadata := base64.StdEncoding.EncodeToString(metadataContent)
 		pkgCommands = append(pkgCommands, []string{"sh", "-c", fmt.Sprintf("echo %s | base64 -d > %s", encodedMetadata, dockerMetadataFile)})
 
-		// Get deterministic mtime for tar archives
-		mtime, err := p.getDeterministicMtime()
-		if err != nil {
-			return nil, err
-		}
-
 		// Prepare for packaging
 		sourcePaths := []string{fmt.Sprintf("./%s", dockerImageNamesFiles), fmt.Sprintf("./%s", dockerMetadataFile)}
 		if p.C.W.Provenance.Enabled {
@@ -2197,12 +2191,6 @@ func (p *Package) buildDocker(buildctx *buildContext, wd, result string) (res *p
 			)
 		}
 
-		// Get deterministic mtime for tar archives
-		mtime, err := p.getDeterministicMtime()
-		if err != nil {
-			return nil, err
-		}
-
 		// Package everything into final tar.gz
 		sourcePaths := []string{"./image.tar", fmt.Sprintf("./%s", dockerImageNamesFiles), "./docker-export-metadata.json"}
 		if len(cfg.Metadata) > 0 {
@@ -2430,6 +2418,12 @@ func (p *Package) buildGeneric(buildctx *buildContext, wd, result string) (res *
 		return nil, xerrors.Errorf("package should have generic config")
 	}
 
+	// Get deterministic mtime for tar archives (call once, reuse throughout)
+	mtime, err := p.getDeterministicMtime()
+	if err != nil {
+		return nil, err
+	}
+
 	// shortcut: no command == empty package
 	if len(cfg.Commands) == 0 && len(cfg.Test) == 0 {
 		log.WithField("package", p.FullName()).Debug("package has no commands nor test - creating empty tar")
@@ -2458,12 +2452,6 @@ func (p *Package) buildGeneric(buildctx *buildContext, wd, result string) (res *
 			}...)
 		}
 
-		// Get deterministic mtime for tar archives
-		mtime, err := p.getDeterministicMtime()
-		if err != nil {
-			return nil, err
-		}
-
 		// Use buildTarCommand directly which will handle compression internally
 		var tarCmd []string
 		if p.C.W.Provenance.Enabled || p.C.W.SBOM.Enabled {
@@ -2546,12 +2534,6 @@ func (p *Package) buildGeneric(buildctx *buildContext, wd, result string) (res *
 		commands = append(commands, cfg.Test...)
 	}
 
-	// Get deterministic mtime for tar archives
-	mtime, err := p.getDeterministicMtime()
-	if err != nil {
-		return nil, err
-	}
-
 	return &packageBuild{
 		Commands: map[PackageBuildPhase][][]string{
 			PackageBuildPhaseBuild: commands,