sneak
5d182b5fd6
check / check (push) Successful in 1m25s
A plain `docker build .`, which is how upaas builds, stamped `dev`: `.dockerignore` left out `.git` and the builder declared `ARG VERSION=dev`. `.dockerignore` now sends `.git` without `.git/config`, which can hold a credential, and lists no tracked file, which git would count as deleted. `ARG VERSION` has no default. The Makefile takes a non-empty `VERSION` from the command line or the environment, so a build arg still wins; otherwise `git describe` runs in the builder, which trusts the checkout whoever owns it, as a context sent as a tar archive keeps its owners. A new `make version` prints the version; the build fails when the context carries `.git` and it comes out empty, `dev` or `unknown`. Model: opus-5-5
27 lines
987 B
Bash
Executable File
27 lines
987 B
Bash
Executable File
#!/bin/sh
|
|
# script/docker: build the Docker image tagged with the project name.
|
|
# The tag comes from script/projectname.
|
|
#
|
|
# --no-cache-filter=lint,builder runs the lint stage and the builder
|
|
# stage (make test) on every invocation; otherwise an unchanged tree is
|
|
# served from the layer cache without linting or querying live DNS.
|
|
set -eu
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
|
ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
|
|
|
main() {
|
|
cd "$ROOT"
|
|
# Own line: a failing command substitution inside an argument does
|
|
# not trip `set -e`, so the inline form degrades silently to an
|
|
# empty constant. The VERSION build arg takes precedence over what
|
|
# the build would derive from the .git in its context.
|
|
version="$(git describe --tags --always --dirty 2>/dev/null || true)"
|
|
[ -n "$version" ] || version="unknown"
|
|
docker build --no-cache-filter=lint,builder \
|
|
--build-arg VERSION="$version" \
|
|
-t "$("$SCRIPT_DIR/projectname")" .
|
|
}
|
|
|
|
main "$@"
|