sneak/prompts
1
0
Fork 0
Code Issues 6 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Keep a Python test phase's lockfile install in check builds (closes #133)
check / check (push) Canceled after 0s
Details

Browse Source 
A Python `test` phase that installs its packages from `Pipfile.lock` now does so above `ARG CACHEBUST`, through `script/bootstrap`, in a layer of its own. Check builds keep that layer as they keep Go's modules, and the tests still run after the line on every build. In that step `script/bootstrap` installs only system packages, pipenv and its dependencies by hash, and the lockfile's packages. The policy, both checklists and the README list the steps above the line the same way; the policy has a short example. This writes down sneak's ruling at sneak/rfscan#80 (comment).

rfscan installs pipenv by version, not by hash, so its `script/bootstrap` does not meet this rule yet.

Model: opus-5-5
This commit was merged in pull request #135.
This commit is contained in:
clawbot
2026-10-26 20:39:00 +01:00
parent aef30c320a
commit 279b10164d
5 changed files with 173 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+12 -6
View File
@@ -144,12 +144,18 @@ alpine. We provide:
`make hooks` installs the pre-commit hook that runs `script/precommit`.
In every stage of a `Dockerfile`, `ARG CACHEBUST` comes right after the steps
that install system packages and download Go's modules, or right after `FROM` in
a stage with neither, and every step that lints, tests or compiles comes after
it. The `script/` builds pass a new `CACHEBUST` value on every build, which
reruns every `RUN` step after that line and leaves the layers above it and the
cache mounts in place; `--no-cache` would build those layers again and empty the
In every stage of a `Dockerfile`, every step that lints, tests or compiles comes
after `ARG CACHEBUST`. `ARG CACHEBUST` comes right after these steps:
- the steps that install system packages
- the steps that download Go's modules
- the step that runs `script/bootstrap` to install a Python `test` phase's
packages from `Pipfile.lock`
A stage with none of these steps declares `ARG CACHEBUST` right after `FROM`.
The `script/` builds pass a new `CACHEBUST` value on every build, which reruns
every `RUN` step after that line and leaves the layers above it and the cache
mounts in place; `--no-cache` would build those layers again and empty the
mounts. This repo's own `Dockerfile` declares `ARG CACHEBUST` right after `FROM`
in every stage: each stage installs system packages and node packages together
in one `script/bootstrap` step, and check builds may keep system packages but