sneak/prompts
1
0
Fork 0
Code Issues 6 Pull Requests 2 Actions 3 Packages Projects Releases Wiki Activity

Keep a Python test phase's lockfile install in check builds (closes #133)
check / check (push) Canceled after 0s
Details

Browse Source 
On sneak's ruling in
sneak/rfscan#80 (comment), a Python
test phase installs its packages from Pipfile.lock above ARG CACHEBUST,
so Docker keeps them until the base image, Pipfile, Pipfile.lock or a
line up to the install changes. The step is COPY Pipfile Pipfile.lock ./
and one RUN of pipenv install --deploy, or a script/bootstrap that
installs nothing beyond system packages, the pinned pipenv and the
lockfile's packages. --deploy installs only what the lockfile names and
checks its hashes. The tests, and every other stage's Python installs,
stay after the line. REPO_POLICIES.md gains a short example; both
checklists and the README state the rule the same way.

Model: opus-5-5
This commit is contained in:
sneak
2026-10-21 15:11:57 +00:00
parent aef30c320a
commit 83f148f3b2
5 changed files with 126 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+10 -9
View File
@@ -145,15 +145,16 @@ alpine. We provide:
`make hooks` installs the pre-commit hook that runs `script/precommit`.
In every stage of a `Dockerfile`, `ARG CACHEBUST` comes right after the steps
that install system packages and download Go's modules, or right after `FROM` in
a stage with neither, and every step that lints, tests or compiles comes after
it. The `script/` builds pass a new `CACHEBUST` value on every build, which
reruns every `RUN` step after that line and leaves the layers above it and the
cache mounts in place; `--no-cache` would build those layers again and empty the
mounts. This repo's own `Dockerfile` declares `ARG CACHEBUST` right after `FROM`
in every stage: each stage installs system packages and node packages together
in one `script/bootstrap` step, and check builds may keep system packages but
not node packages.
that install system packages, download Go's modules or install a `test` phase's
Python packages from `Pipfile.lock`, or right after `FROM` in a stage with none
of these, and every step that lints, tests or compiles comes after it. The
`script/` builds pass a new `CACHEBUST` value on every build, which reruns every
`RUN` step after that line and leaves the layers above it and the cache mounts
in place; `--no-cache` would build those layers again and empty the mounts. This
repo's own `Dockerfile` declares `ARG CACHEBUST` right after `FROM` in every
stage: each stage installs system packages and node packages together in one
`script/bootstrap` step, and check builds may keep system packages but not node
packages.
## Rationale