WIP: force check layers to execute via CHECK_EPOCH build arg

Dockerfile

@@ -11,6 +11,14 @@ COPY . .
 # Touch .pb.go so make does not try to regenerate via protoc (file is committed)
 RUN touch mfer/mf.pb.go
 
+# Cache buster. script/cibuild passes a fresh CHECK_EPOCH on every invocation,
+# which invalidates every layer below this line so the checks always really
+# execute. Layers ABOVE it (base image, go mod download) keep their cache, so
+# this costs nothing but the checks themselves. Every stage that runs a check
+# needs its own copy: ARG is scoped per stage, and a stage without one silently
+# serves a cached pass. See https://git.eeqj.de/sneak/mfer/issues/89.
+ARG CHECK_EPOCH
+
 # Go half of fmt-check only: this image has no node, so no prettier. The
 # markdown half runs in the mdfmt stage below.
 RUN make fmt-check-go
@@ -27,6 +35,9 @@ RUN yarn install --frozen-lockfile
 
 COPY . .
 
+# Cache buster, so the check below always executes; see the lint stage.
+ARG CHECK_EPOCH
+
 # No make in this image; call the script entrypoint directly.
 RUN script/prettier --check
 
@@ -47,6 +58,9 @@ COPY . .
 # Touch .pb.go so make does not try to regenerate via protoc (file is committed)
 RUN touch mfer/mf.pb.go
 
+# Cache buster, so the check below always executes; see the lint stage.
+ARG CHECK_EPOCH
+
 RUN make test
 RUN cd cmd/mfer && go build -tags urfave_cli_no_docs -o /mfer .