sneak
906c8e97e8
check / check (push) Waiting to run
A plain `docker build .`, which is how upaas builds, stamped `dev`: `.dockerignore` left out `.git` and the builder declared `ARG VERSION=dev`. `.dockerignore` now sends `.git` without `.git/config`, which can hold a credential, and lists no tracked file, which git would count as deleted. `ARG VERSION` has no default. The Makefile takes a non-empty `VERSION` from the command line or the environment, so a build arg still wins; otherwise `git describe` runs in the builder, which trusts the checkout whoever owns it, as a context sent as a tar archive keeps its owners. A new `make version` prints the version; the build fails when the context carries `.git` and it comes out empty, `dev` or `unknown`. Model: opus-5-5
10 lines
458 B
Plaintext
10 lines
458 B
Plaintext
# .git is sent, without its config: the builder stage derives the version it
|
|
# stamps into the binary from it, and `git describe` does not need the config,
|
|
# which can hold a credential (a password in the remote URL, a CI token). No
|
|
# tracked file may be listed here: git in the build would see it as deleted
|
|
# and mark the version -dirty, and an excluded .md would silently drop out of
|
|
# the prettier check in Dockerfile.fmt.
|
|
.git/config
|
|
bin/
|
|
node_modules/
|