- [docker-buildkit] in rule, use `when: on_success`, not `always`