b7cb8cd9d0
All checks were successful
check / check (push) Successful in 29s
script/cibuild ran a bare "docker build .". The Dockerfile does "COPY . ." and then runs the checks, so on an unchanged tree every check layer was a cache hit: the suite never executed and the build still exited 0. A green from script/cibuild did not mean the checks had passed, only that they had passed at some point in the past. Declare "ARG CHECK_EPOCH" in each stage that runs a check, positioned below the dependency layers and immediately above the first check, and have script/cibuild pass a fresh "$(date +%s)" on every invocation. A changed build arg invalidates every layer below its declaration, so the checks always execute while the base images, "go mod download" and the "yarn install" in mdfmt stay cached. All three check-running stages are covered: lint (fmt-check-go, lint), mdfmt (prettier --check) and builder (test). ARG is scoped per stage, so a stage without its own declaration would keep serving a cached pass and be indistinguishable from a working fix at the exit code. "--no-cache" was not used: it would also discard "go mod download" and the yarn install, for no additional guarantee. The README's build-status claim is accurate again and now says why.