From 89903fa1cd2fc5f15ef93c06298f09405e648d92 Mon Sep 17 00:00:00 2001
From: clawbot <clawbot@noreply.example.org>
Date: Sun, 15 Mar 2026 18:56:25 +0100
Subject: [PATCH] Split Dockerfile: pre-built golangci-lint stage for faster CI
 (#45)

Closes #39

Splits the Dockerfile into a dedicated lint stage using the `golangci/golangci-lint` image directly, rather than copying the binary into the builder stage.

## Changes

### Dockerfile

- **Lint stage** (`AS lint`): Uses the pre-built `golangci/golangci-lint` image (pinned by sha256) to run `make fmt-check` and `make lint`. This is a self-contained stage with its own `go mod download` and source copy.
- **Builder stage** (`AS builder`): Runs only `make test` and the final binary build. No longer needs golangci-lint installed.
- **Stage dependency**: `COPY --from=lint /src/go.sum /dev/null` forces BuildKit to always execute the lint stage (without this, unused stages are silently skipped).
- Both stages touch `mfer/mf.pb.go` to prevent make from trying to regenerate via protoc.

With BuildKit, the lint and builder stages run in parallel after their shared `go mod download` layers complete, so lint/formatting failures surface much faster without blocking on test execution.

### Makefile

- Added `lint` to the `check` target prereqs: `check: test lint fmt-check` (was `check: test fmt-check`), matching the [REPO_POLICIES](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/REPO_POLICIES.md) requirement.

Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de>
Reviewed-on: https://git.eeqj.de/sneak/mfer/pulls/45
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>
---
 Dockerfile | 30 +++++++++++++++++++++++++-----
 Makefile   |  2 +-
 2 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 9a816e2..e6dd403 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,16 +1,36 @@
+# Lint stage — fast feedback on formatting and lint issues
 # golangci/golangci-lint:v2.0.2 (2026-03-14)
-FROM golangci/golangci-lint@sha256:d55581f7797e7a0877a7c3aaa399b01bdc57d2874d6412601a046cc4062cb62e AS lint-bin
+FROM golangci/golangci-lint@sha256:d55581f7797e7a0877a7c3aaa399b01bdc57d2874d6412601a046cc4062cb62e AS lint
 
-# golang:1.23 (2026-03-14)
-FROM golang@sha256:60deed95d3888cc5e4d9ff8a10c54e5edc008c6ae3fba6187be6fb592e19e8c0 AS builder
-COPY --from=lint-bin /usr/bin/golangci-lint /usr/local/bin/golangci-lint
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
+
 COPY . .
+
 # Touch .pb.go so make does not try to regenerate via protoc (file is committed)
 RUN touch mfer/mf.pb.go
-RUN make check
+
+RUN make fmt-check
+RUN make lint
+
+# Build stage — tests and compilation
+# golang:1.23 (2026-03-14)
+FROM golang@sha256:60deed95d3888cc5e4d9ff8a10c54e5edc008c6ae3fba6187be6fb592e19e8c0 AS builder
+
+# Force BuildKit to run the lint stage by creating a stage dependency
+COPY --from=lint /src/go.sum /dev/null
+
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+# Touch .pb.go so make does not try to regenerate via protoc (file is committed)
+RUN touch mfer/mf.pb.go
+
+RUN make test
 RUN cd cmd/mfer && go build -tags urfave_cli_no_docs -o /mfer .
 
 FROM scratch
diff --git a/Makefile b/Makefile
index 89ad942..cab3f5b 100644
--- a/Makefile
+++ b/Makefile
@@ -32,7 +32,7 @@ $(PROTOC_GEN_GO):
 fixme:
 	@grep -nir fixme . | grep -v Makefile
 
-check: test fmt-check
+check: test lint fmt-check
 
 fmt-check: mfer/mf.pb.go
 	sh -c 'test -z "$$(gofmt -l .)"'