sneak/prompts
1
0
Fork 0
Code Issues 6 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Keep a Python test phase's lockfile install in check builds (closes #133)
check / check (push) Canceled after 0s
Details

Browse Source 
On sneak's ruling in
sneak/rfscan#80 (comment), a Python
test phase installs its packages from Pipfile.lock above ARG CACHEBUST,
so Docker keeps them until the base image, Pipfile, Pipfile.lock or a
line up to the install changes. The step is COPY Pipfile Pipfile.lock ./
and one RUN of pipenv install --deploy, or a script/bootstrap that
installs nothing beyond system packages, the pinned pipenv and the
lockfile's packages. --deploy installs only what the lockfile names and
checks its hashes. The tests, and every other stage's Python installs,
stay after the line. REPO_POLICIES.md gains a short example; both
checklists and the README state the rule the same way.

Model: opus-5-5
This commit is contained in:
sneak
2026-10-21 15:11:57 +00:00
parent aef30c320a
commit 83f148f3b2
5 changed files with 126 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TODO.md
+13
View File
@@ -21,6 +21,19 @@ fmt-check, and commit.
# Completed Steps
- 2026-10-21: Check builds may now also keep the Python packages a `test` phase
installs from `Pipfile.lock` (issue 133), on sneak's ruling in
https://git.eeqj.de/sneak/rfscan/issues/80#issuecomment-153437. The install
comes before `ARG CACHEBUST`: `COPY Pipfile Pipfile.lock ./`, then one `RUN`
that runs `pipenv install --deploy`, or a `script/bootstrap` that installs
nothing beyond system packages, the pinned pipenv and the packages from the
lockfile. `--deploy` installs only what the lockfile names, checks every
package against its hashes, and fails when the lockfile is out of date with
`Pipfile`. The packages are kept as a layer, not a cache mount, for the reason
Go's modules are. The tests still run after `ARG CACHEBUST`, and every other
stage still installs its Python packages after it. `REPO_POLICIES.md` gains a
short Python `test` phase example, and both checklists and the README state
the rule the same way. rfscan picks this up on its next re-vendor.
- 2026-10-21: The canonical `.golangci.yml` now accepts a local `replace` of
`github.com/grafana/sobek` in a repository's root `go.mod` (issue 134), for
homoicon, which keeps a local copy of sobek on sneak's decision in