script/cibuild ran a bare docker build .. The Dockerfile keys make fmt-check-go, make lint, the prettier check, and make test on the
build context, so on an unchanged tree every check layer was a cache hit and
the build exited 0 without running a single check — a green that proved
nothing (#89).
This adds ARG CHECK_EPOCH immediately above the first check RUN in all
three check stages (lint, mdfmt, builder) and has script/cibuild pass --build-arg CHECK_EPOCH="$(date +%s)". The changing value busts the layer
cache from the arg downward each run; go mod download and yarn install,
which sit above it, stay cached. The false claim in script/cibuild's header
comment is corrected.
Verification
Two back-to-back builds on an unchanged tree, each with a fresh --build-arg CHECK_EPOCH, both re-ran the checks. In the second build, go mod download (lint + builder) and yarn install (mdfmt) were CACHED
while make fmt-check-go, make lint, prettier --check, and make test
all executed. Buildkit work with dependencies cached was about 90s (longest
step make lint, 51s), well under the 5-minute budget. Both builds were
serialized behind the shared docker lock.
Disclosure: running the checks for real surfaced the pre-existing
intermittent internal/cli test timeout (panic: test timed out after 10s,
the gpg-subprocess flake tracked in #62 and #67) — one of the two builds failed at make test, the other passed. That flake is out of scope here; this change
is what makes it visible instead of masked, which is the point of the issue.
Disclosure: README.md's Build Status section already states the checks
execute and is now accurate, so per the touch-only-cibuild-and-Dockerfile
scope it was left unchanged; the literal false claim lived in script/cibuild's comment and is fixed there.
Model: opus-4-8
## What
`script/cibuild` ran a bare `docker build .`. The `Dockerfile` keys
`make fmt-check-go`, `make lint`, the prettier check, and `make test` on the
build context, so on an unchanged tree every check layer was a cache hit and
the build exited 0 without running a single check — a green that proved
nothing (https://git.eeqj.de/sneak/mfer/issues/89).
This adds `ARG CHECK_EPOCH` immediately above the first check `RUN` in all
three check stages (`lint`, `mdfmt`, `builder`) and has `script/cibuild` pass
`--build-arg CHECK_EPOCH="$(date +%s)"`. The changing value busts the layer
cache from the arg downward each run; `go mod download` and `yarn install`,
which sit above it, stay cached. The false claim in `script/cibuild`'s header
comment is corrected.
## Verification
Two back-to-back builds on an unchanged tree, each with a fresh
`--build-arg CHECK_EPOCH`, both re-ran the checks. In the second build,
`go mod download` (lint + builder) and `yarn install` (mdfmt) were `CACHED`
while `make fmt-check-go`, `make lint`, `prettier --check`, and `make test`
all executed. Buildkit work with dependencies cached was about 90s (longest
step `make lint`, 51s), well under the 5-minute budget. Both builds were
serialized behind the shared docker lock.
Disclosure: running the checks for real surfaced the pre-existing
intermittent `internal/cli` test timeout (`panic: test timed out after 10s`,
the gpg-subprocess flake tracked in
https://git.eeqj.de/sneak/mfer/issues/62 and
https://git.eeqj.de/sneak/mfer/issues/67) — one of the two builds failed at
`make test`, the other passed. That flake is out of scope here; this change
is what makes it visible instead of masked, which is the point of the issue.
Disclosure: `README.md`'s Build Status section already states the checks
execute and is now accurate, so per the touch-only-cibuild-and-Dockerfile
scope it was left unchanged; the literal false claim lived in
`script/cibuild`'s comment and is fixed there.
Model: opus-4-8
A bare `docker build .` keyed `make fmt-check-go`, `make lint`, the
prettier check, and `make test` on the build context, so on an unchanged
tree every check layer was a cache hit: the build exited 0 in under a
second having run none of them.
Add `ARG CHECK_EPOCH` immediately above the first check RUN in all three
check stages (lint, mdfmt, builder), and have script/cibuild pass a fresh
`--build-arg CHECK_EPOCH` each run. The changing value busts the cache from
that point down, while `go mod download` and `yarn install` above it stay
cached, so the build does not regress to cold. The false claim in
script/cibuild's header comment is corrected.
Running the checks for real surfaces the pre-existing intermittent
internal/cli test timeout (the gpg-subprocess flake in #62 / #67); that
defect is out of scope here.
Model: opus-4-8
Disclosure: gated on the branch rebased onto current next; it carries a trivial TODO.md conflict in Completed Steps, resolvable by keeping all entries.
Judgement call: the README (docker build .) gloss for script/cibuild (Build Status and Entrypoints) is now a slightly stale description of the command, but the issue's README criterion — a green build implying the checks actually ran — is true again after this fix, so it is left as-is.
Judgement call: the PR body runs a little over the ~250-word guideline, but the excess is protected disclosures (the known internal/cli flake and the README scope decision), so it is not treated as a finding.
Model: opus-4-8
Review passed.
- Disclosure: gated on the branch rebased onto current `next`; it carries a trivial `TODO.md` conflict in Completed Steps, resolvable by keeping all entries.
- Judgement call: the README `(docker build .)` gloss for `script/cibuild` (Build Status and Entrypoints) is now a slightly stale description of the command, but the issue's README criterion — a green build implying the checks actually ran — is true again after this fix, so it is left as-is.
- Judgement call: the PR body runs a little over the ~250-word guideline, but the excess is protected disclosures (the known `internal/cli` flake and the README scope decision), so it is not treated as a finding.
Model: opus-4-8
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What
script/cibuildran a baredocker build .. TheDockerfilekeysmake fmt-check-go,make lint, the prettier check, andmake teston thebuild context, so on an unchanged tree every check layer was a cache hit and
the build exited 0 without running a single check — a green that proved
nothing (#89).
This adds
ARG CHECK_EPOCHimmediately above the first checkRUNin allthree check stages (
lint,mdfmt,builder) and hasscript/cibuildpass--build-arg CHECK_EPOCH="$(date +%s)". The changing value busts the layercache from the arg downward each run;
go mod downloadandyarn install,which sit above it, stay cached. The false claim in
script/cibuild's headercomment is corrected.
Verification
Two back-to-back builds on an unchanged tree, each with a fresh
--build-arg CHECK_EPOCH, both re-ran the checks. In the second build,go mod download(lint + builder) andyarn install(mdfmt) wereCACHEDwhile
make fmt-check-go,make lint,prettier --check, andmake testall executed. Buildkit work with dependencies cached was about 90s (longest
step
make lint, 51s), well under the 5-minute budget. Both builds wereserialized behind the shared docker lock.
Disclosure: running the checks for real surfaced the pre-existing
intermittent
internal/clitest timeout (panic: test timed out after 10s,the gpg-subprocess flake tracked in
#62 and
#67) — one of the two builds failed at
make test, the other passed. That flake is out of scope here; this changeis what makes it visible instead of masked, which is the point of the issue.
Disclosure:
README.md's Build Status section already states the checksexecute and is now accurate, so per the touch-only-cibuild-and-Dockerfile
scope it was left unchanged; the literal false claim lived in
script/cibuild's comment and is fixed there.Model: opus-4-8
Review passed.
next; it carries a trivialTODO.mdconflict in Completed Steps, resolvable by keeping all entries.(docker build .)gloss forscript/cibuild(Build Status and Entrypoints) is now a slightly stale description of the command, but the issue's README criterion — a green build implying the checks actually ran — is true again after this fix, so it is left as-is.internal/cliflake and the README scope decision), so it is not treated as a finding.Model: opus-4-8
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.