script: force lint and test to run in cibuild and docker (closes #115)

script/cibuild and script/docker were plain docker build. On an
unchanged tree the lint stage and the builder stage's make test came
from the layer cache, so the build reported success having linted
nothing and queried no live DNS. Both scripts now pass
--no-cache-filter=lint,builder, so those stages run on every build;
this mirrors script/lint, which already does the same for the lint
stage alone. Dependency downloads inside the disabled stages re-run,
which the issue accepts. No pins, .golangci.yml, or test behaviour
changed. README and TODO.md updated to match.

Model: opus-4-8

README.md

@@ -426,7 +426,10 @@ them. We provide:
 - `script/check` — run test, lint, and fmt-check
 - `script/docker` — build the Docker image tagged via
   `script/projectname`
-- `script/cibuild` — CI entrypoint: plain `docker build .`
+- `script/cibuild` — CI entrypoint: `docker build` with
+  `--no-cache-filter=lint,builder`, forcing the lint and test stages to
+  run on every invocation, because a cached build lints nothing and
+  queries no DNS
 - `script/precommit` — run by the git pre-commit hook; `go mod tidy`
   guard, then `script/check`
 - `script/install-precommit` — install the git pre-commit hook

TODO.md

@@ -23,6 +23,8 @@ Rationale, Design, TODO, License, Author) if any are still missing.
 
 # Completed Steps
 
+- 2026-09-21: `script/cibuild` and `script/docker` now pass
+  `--no-cache-filter=lint,builder` so lint and tests run every build.
 - 2026-09-21: `go mod tidy` dropped the redundant `golang.org/x/sync`
   `// indirect` line so `script/bootstrap` leaves a clean tree (#132)
 - 2026-08-10: comment-only corrections to `script/bootstrap`,

script/cibuild

@@ -1,14 +1,19 @@
 #!/bin/sh
 # script/cibuild: run the CI build. The Dockerfile's lint stage runs
 # make fmt-check and golangci-lint; its builder stage runs make test
-# and make build. A successful build implies all of those passed.
+# and make build.
+#
+# --no-cache-filter=lint,builder forces both of those stages to run on
+# every invocation. Without it an unchanged tree serves them from the
+# layer cache, reporting success having linted nothing and queried no
+# live DNS. A successful build then implies those stages actually ran.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build .
+    docker build --no-cache-filter=lint,builder .
 }
 
 main "$@"

script/docker

@@ -1,6 +1,11 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
-# Identical in all repos; the tag comes from script/projectname.
+# The tag comes from script/projectname.
+#
+# --no-cache-filter=lint,builder forces the lint stage and the builder
+# stage (make test) to run on every invocation. Without it an unchanged
+# tree serves them from the layer cache, producing an image whose build
+# linted nothing and queried no live DNS.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -8,7 +13,7 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build -t "$("$SCRIPT_DIR/projectname")" .
+    docker build --no-cache-filter=lint,builder -t "$("$SCRIPT_DIR/projectname")" .
 }
 
 main "$@"