b7cb8cd9d0
All checks were successful
check / check (push) Successful in 29s
script/cibuild ran a bare "docker build .". The Dockerfile does "COPY . ." and then runs the checks, so on an unchanged tree every check layer was a cache hit: the suite never executed and the build still exited 0. A green from script/cibuild did not mean the checks had passed, only that they had passed at some point in the past. Declare "ARG CHECK_EPOCH" in each stage that runs a check, positioned below the dependency layers and immediately above the first check, and have script/cibuild pass a fresh "$(date +%s)" on every invocation. A changed build arg invalidates every layer below its declaration, so the checks always execute while the base images, "go mod download" and the "yarn install" in mdfmt stay cached. All three check-running stages are covered: lint (fmt-check-go, lint), mdfmt (prettier --check) and builder (test). ARG is scoped per stage, so a stage without its own declaration would keep serving a cached pass and be indistinguishable from a working fix at the exit code. "--no-cache" was not used: it would also discard "go mod download" and the yarn install, for no additional guarantee. The README's build-status claim is accurate again and now says why.
70 lines
2.3 KiB
Docker
70 lines
2.3 KiB
Docker
# Lint stage — fast feedback on formatting and lint issues
|
|
# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
|
|
FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
|
|
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
# Touch .pb.go so make does not try to regenerate via protoc (file is committed)
|
|
RUN touch mfer/mf.pb.go
|
|
|
|
# Cache buster. script/cibuild passes a fresh CHECK_EPOCH on every invocation,
|
|
# which invalidates every layer below this line so the checks always really
|
|
# execute. Layers ABOVE it (base image, go mod download) keep their cache, so
|
|
# this costs nothing but the checks themselves. Every stage that runs a check
|
|
# needs its own copy: ARG is scoped per stage, and a stage without one silently
|
|
# serves a cached pass. See https://git.eeqj.de/sneak/mfer/issues/89.
|
|
ARG CHECK_EPOCH
|
|
|
|
# Go half of fmt-check only: this image has no node, so no prettier. The
|
|
# markdown half runs in the mdfmt stage below.
|
|
RUN make fmt-check-go
|
|
RUN make lint
|
|
|
|
# Markdown/JSON format stage — prettier needs node, which the Go images
|
|
# do not have. node:22.17.0-bookworm-slim (2026-08-09); ships node
|
|
# 22.17.0 and yarn 1.22.22, the versions script/bootstrap pins.
|
|
FROM node@sha256:b04ce4ae4e95b522112c2e5c52f781471a5cbc3b594527bcddedee9bc48c03a0 AS mdfmt
|
|
|
|
WORKDIR /src
|
|
COPY package.json yarn.lock ./
|
|
RUN yarn install --frozen-lockfile
|
|
|
|
COPY . .
|
|
|
|
# Cache buster, so the check below always executes; see the lint stage.
|
|
ARG CHECK_EPOCH
|
|
|
|
# No make in this image; call the script entrypoint directly.
|
|
RUN script/prettier --check
|
|
|
|
# Build stage — tests and compilation
|
|
# golang:1.23 (2026-03-14)
|
|
FROM golang@sha256:60deed95d3888cc5e4d9ff8a10c54e5edc008c6ae3fba6187be6fb592e19e8c0 AS builder
|
|
|
|
# Force BuildKit to run the lint and mdfmt stages by creating stage dependencies
|
|
COPY --from=lint /src/go.sum /dev/null
|
|
COPY --from=mdfmt /src/go.sum /dev/null
|
|
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
# Touch .pb.go so make does not try to regenerate via protoc (file is committed)
|
|
RUN touch mfer/mf.pb.go
|
|
|
|
# Cache buster, so the check below always executes; see the lint stage.
|
|
ARG CHECK_EPOCH
|
|
|
|
RUN make test
|
|
RUN cd cmd/mfer && go build -tags urfave_cli_no_docs -o /mfer .
|
|
|
|
FROM scratch
|
|
COPY --from=builder /mfer /mfer
|
|
ENTRYPOINT ["/mfer"]
|