Install the pinned node when the installed one is another major version (closes #118)

script/bootstrap used whatever node was installed, so on the CI runner
image, which ships node 24, the pinned yarn 1.22.22 printed the
deprecation warning DEP0169 on every bootstrap. It now uses the
installed node only when its major version is the pinned one, and
otherwise installs the pinned node with nvm, as it already did when node
was missing, with yarn and the packages under it. It prints the node
version it uses. Only the major is compared because the Dockerfile
stages use a node 22 alpine image that nvm cannot replace. script/fmt
and script/fmt-check carry the same test to pick their yarn: the yarn on
PATH, or yarn under the pinned node loaded through nvm.

Model: opus-5-5

.gitea/workflows/check.yml

@@ -7,10 +7,14 @@ concurrency:
 jobs:
     check:
         runs-on: ubuntu-latest
+        # Free the shared runner from a hung build.
+        timeout-minutes: 20
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
               # script/cibuild needs no token, so none is left in .git/config.
               with:
                   persist-credentials: false
+                  # All history and tags, so git describe finds the version tag.
+                  fetch-depth: 0
             - run: script/cibuild

.golangci.yml

@@ -25,6 +25,8 @@ linters:
     # silenced by disabling that name, not by enabling the successor.
     - wsl              # Deprecated, replaced by wsl_v5
     - gomodguard       # Deprecated, replaced by gomodguard_v2
+    # Misses findings at random in v2.14.0; back once a pinned release fixes it
+    - canonicalheader
   settings:
     lll:
       line-length: 88

README.md

@@ -116,10 +116,14 @@ alpine. We provide:
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (our own extension); used by
   `script/docker` for the image tag
-- `script/test` — `docker build --no-cache --target test -t prompts-test .`,
+- `script/test` —
-  building the `test` phase of the `Dockerfile` (no tests defined here)
+  `docker build --no-cache --target test --output type=cacheonly .`, building
-- `script/lint` — `docker build --no-cache --target lint -t prompts-lint .`,
+  the `test` phase of the `Dockerfile` without writing an image (no tests
-  building the `lint` phase, which runs prettier over the markdown files
+  defined here)
+- `script/lint` —
+  `docker build --no-cache --target lint --output type=cacheonly .`, building
+  the `lint` phase, which runs prettier over the markdown files, without writing
+  an image
 - `script/fmt` — format all markdown files with prettier (writes; native, not in
   a container)
 - `script/fmt-check` — check formatting (read-only; native)

TODO.md

@@ -21,12 +21,83 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-08: The canonical `script/bootstrap` now uses the installed node only
+  when its major version is the pinned one (issue 118). Otherwise, as when node
+  is missing, it installs the pinned node under nvm and installs yarn and the
+  packages under it. It prints the version of the node it uses either way. The
+  CI runner image ships node 24, under which the pinned yarn 1.22.22 printed the
+  deprecation warning DEP0169 on every bootstrap. Only the major is compared
+  because the `Dockerfile` stages start from a node 22 alpine image whose exact
+  version is not the pin, and nvm cannot install a prebuilt node on alpine; the
+  version-comparison rule in `REPO_POLICIES.md` names node as its exception.
+  `script/fmt` and `script/fmt-check` pick their yarn with the same test: the
+  `yarn` on `PATH` when the installed node is the pinned major, and otherwise
+  yarn under the pinned node through nvm. `REPO_POLICIES.md` and both checklists
+  say so, and the checklists' final `script/cibuild` check names what the CI
+  runner image has: node 24 and no yarn. Not yet tried on the shared runner.
+  Repositories pick this up on their next re-vendor.
+- 2026-10-07: The `script/cibuild` item in `NEW_REPO_CHECKLIST.md` now matches
+  the canonical `script/cibuild` (issue 125). Its image build carries the tag,
+  `-t "$tag"`, and the item says that `$version` comes from
+  `git describe --tags --always --dirty` (`unknown` if empty) and `$tag` from
+  `script/projectname`, each assigned on its own line before the build. A
+  repository written from the checklist got an untagged build, which leaves a
+  dangling image behind on every run, and was never told where `$version` comes
+  from. The other `docker build` commands the checklists and `REPO_POLICIES.md`
+  give for `script/` already matched their scripts.
+- 2026-10-07: `script/lint` and `script/test` now build with
+  `--output type=cacheonly` in place of a tag (issue 123), so they still run
+  their phase uncached and fail on a failing step but write no image. Nothing
+  used those images, and writing one out cost about 16 seconds of a Go
+  repository's test build. `script/cibuild` and `script/docker` keep their tags.
+  `REPO_POLICIES.md`, both checklists and the README no longer say the gate
+  builds are tagged. Not yet tried on the shared runner. Repositories pick this
+  up on their next re-vendor.
+- 2026-10-07: The canonical `.gitea/workflows/check.yml` now sets
+  `timeout-minutes: 20` on its `check` job (issue 120), so a hung build frees
+  the shared runner instead of holding it until the runner's own limit.
+  `script/cibuild` runs three Docker builds, each held to the 5-minute Docker
+  build limit, plus the bootstrap; if that limit changes (issue 113), the value
+  follows it. `REPO_POLICIES.md` and both checklists name the limit among what
+  the workflow sets. Not yet tried on the shared runner. Repositories pick this
+  up on their next re-vendor.
+- 2026-10-07: The canonical `package.json` now has `"private": true` in place of
+  `"license": "MIT"` (issue 119), so a repository that copies it no longer
+  declares MIT whatever its own licence is. yarn does not print "No license
+  field" for a private package. This repository's own licence is unchanged.
+- 2026-10-06: The canonical `.gitea/workflows/check.yml` now sets
+  `fetch-depth: 0` on its checkout step (issue 110), so CI fetches the history
+  and tags that `git describe --tags --always` needs, and a tagged repository
+  stamps the same version in CI as in a local build. `REPO_POLICIES.md` and both
+  checklists name `fetch-depth: 0` among what the workflow does, next to
+  `persist-credentials: false` and the `concurrency` block, instead of asking
+  each tagged repository to add it. Not yet tried on the shared runner, which is
+  out of disk space. Repositories pick this up on their next re-vendor.
+- 2026-10-06: The canonical `script/bootstrap` now runs `apt-get update` once,
+  before the first `apt-get install` of a run (issue 115). The Gitea runner
+  image starts with empty package lists, so installing anything it lacks, such
+  as Go, failed with `Unable to locate package`. A repository's own section no
+  longer needs a refresh of its own; `sneak/bsfirehose` and `sneak/dnswatcher`
+  drop theirs at their next re-vendor.
+- 2026-10-06: `REPO_POLICIES.md` and both checklists now say that a checkout
+  whose `.git` is a file, a linked worktree or a repository checked out as a
+  submodule, is the exception to a plain `docker build .` succeeding (issue
+  111): that file points to a git directory outside the build context, so the
+  build cannot read the version and the version check in the canonical
+  `Dockerfile` stops it. Such a build is given its version with
+  `--build-arg VERSION=...`, as `script/docker` and `script/cibuild` already do.
+  The check itself is unchanged.
 - 2026-10-06: The canonical `.gitea/workflows/check.yml` now has a `concurrency`
   block, so a new push cancels the older run on the same branch and no other,
   and its checkout step sets `persist-credentials: false`, so the job's token is
   not left in `.git/config` (issue 107). `REPO_POLICIES.md` and both checklists
   describe the workflow as it now is. Not yet tried on the shared runner, which
   is out of disk space. Repositories pick this up on their next re-vendor.
+- 2026-10-06: The canonical `.golangci.yml` now disables `canonicalheader`
+  (issue 105). In golangci-lint v2.14.0 it misses findings at random in a
+  package that also calls `ResponseWriter.Header()`, so the same tree can fail
+  lint on one run and pass on the next. It comes back once a pinned
+  golangci-lint release fixes it.
 - 2026-10-06: The canonical `.gitignore` and `.editorconfig` now each end with a
   comment saying the repository's own entries go below it and a re-vendor keeps
   them (issue 103, which took in issue 104), as `.dockerignore`'s header already

package.json

@@ -1,5 +1,5 @@
 {
-  "license": "MIT",
+  "private": true,
   "devDependencies": {
     "prettier": "3.8.1"
   }

prompts/EXISTING_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: Existing Repo Checklist
-last_modified: 2026-10-06
+last_modified: 2026-10-08
 ---
 
 Use this checklist when beginning work in a repo that may not yet conform to our
@@ -91,14 +91,21 @@ with your task.
       version still comes out empty, `dev` or `unknown`. A plain
       `docker build .` with no build arguments must succeed; a Dockerfile that
       refuses an empty build argument drops that refusal and keeps the argument.
-      `script/docker` and `script/cibuild` pass the version they compute on the
+      A checkout whose `.git` is a file (a linked worktree, or a repository
-      host; it takes precedence. A tag-derived version additionally needs
+      checked out as a submodule) is the exception: that file points to a git
-      `fetch-depth: 0` on the CI checkout step, which clones shallow and fetches
+      directory outside the build context, so the build cannot read the version
-      no tags by default.
+      and a plain `docker build .` fails; pass the version with
+      `--build-arg VERSION=...`. `script/docker` and `script/cibuild` already
+      pass the version they compute on the host; it takes precedence. The
+      canonical `.gitea/workflows/check.yml` sets `fetch-depth: 0` on its
+      checkout step, which otherwise clones shallow and fetches no tags, so a CI
+      build finds the tag too.
 - [ ] Gitea Actions workflow in `.gitea/workflows/` runs `script/cibuild` on
-      push, checks out with `persist-credentials: false`, and carries the
+      push, checks out with `persist-credentials: false` and with
-      `concurrency` block that lets a new push cancel only the same branch's
+      `fetch-depth: 0` (which fetches the tags `git describe` needs), carries
-      older run — reference
+      the `concurrency` block that lets a new push cancel only the same branch's
+      older run, and sets `timeout-minutes: 20` on the `check` job so a hung
+      build frees the shared runner — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`
 - [ ] Language-specific config:
     - [ ] Go: `go.mod`, `go.sum`, `.golangci.yml` (fetch from
@@ -125,25 +132,30 @@ with your task.
       `script/install-precommit`, shimmed by `make hooks`) runs it
 - [ ] README has an **Entrypoints** section documenting the `script/`
       entrypoints and linking the standard
-- [ ] `script/lint` and `script/test` build their phase by name
+- [ ] `script/lint` and `script/test` each run
-      (`docker build --no-cache --target <phase> -t <name>-<phase> .`), and no
+      `docker build --no-cache --target <phase> --output type=cacheonly .`,
-      host invocation anywhere in the repo can produce a lint verdict — grep for
+      which builds their phase by name and writes no image, and no host
-      the linter's own name across `script/`, the `Makefile` and CI config, not
+      invocation anywhere in the repo can produce a lint verdict — grep for the
-      just `script/lint`. A second path is likeliest here: a `make lint-fast`,
+      linter's own name across `script/`, the `Makefile` and CI config, not just
-      an older host-versus-container branch, or a CI step calling the binary
+      `script/lint`. A second path is likeliest here: a `make lint-fast`, an
+      older host-versus-container branch, or a CI step calling the binary
       directly. `script/fmt` and `script/fmt-check` are expected hits and stay
       on the host.
-- [ ] Every `docker build` in `script/` is tagged — an untagged one leaves a
+- [ ] No `docker build` in `script/` leaves a dangling image behind:
-      dangling image behind on every run, on every host and CI runner
+      `script/lint` and `script/test` write no image, and `script/docker` and
+      `script/cibuild` tag theirs. A build that writes an untagged image leaves
+      one behind on every run, on every host and CI runner.
 - [ ] `script/cibuild` runs `script/bootstrap` before `script/check`, and builds
       the image with `--no-cache`. Without the bootstrap the CI run dies in
       `script/fmt-check`, which runs the formatter on the host and finds nothing
       installed.
-- [ ] `script/fmt` and `script/fmt-check` source nvm for the pinned node version
+- [ ] `script/fmt` and `script/fmt-check` pick their `yarn` with the same test
-      before invoking `yarn`, as `script/bootstrap`'s own install step does.
+      as `script/bootstrap`: the `yarn` on `PATH` when the node on `PATH` has
-      `script/bootstrap` leaves the node and yarn it installs off the `PATH` of
+      the pinned major version, and otherwise yarn under the pinned node, with
-      the shell that called it, so a bare `yarn` exits 127 on a runner carrying
+      nvm loaded through `$HOME/.nvm/nvm.sh`. `script/bootstrap` leaves the node
-      nothing but docker and git.
+      and yarn it installs under nvm off the `PATH` of the shell that called it,
+      so a bare `yarn` exits 127 on a runner carrying nothing but docker and
+      git, or runs under another node.
 - [ ] `script/bootstrap` installs no linter of its own — delete the block, its
       version variables and its call site. A JS repo's `yarn install` stays; it
       brings a linter along with every other dependency, and no verdict is taken
@@ -196,10 +208,11 @@ with your task.
 # Final
 
 - [ ] `make check` passes
-- [ ] `script/cibuild` succeeds in a fresh clone on a host carrying nothing but
+- [ ] `script/cibuild` succeeds in a fresh clone on a host carrying what CI has
-      docker and git, with no node or yarn on `PATH`, which is what CI has, and
+      (the runner image `docker.gitea.com/runner-images:ubuntu-latest`: docker,
-      demonstrably executed the checks — a sub-second build, or `CACHED` on a
+      git and node 24, with no yarn on `PATH`), and demonstrably executed the
-      gate layer, means nothing ran
+      checks — a sub-second build, or `CACHED` on a gate layer, means nothing
+      ran
 - [ ] A planted lint violation fails both `make lint` and a plain
       `docker build .`; revert it afterwards
 - [ ] Commit and merge fixes before starting your actual task

prompts/NEW_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: New Repo Checklist
-last_modified: 2026-10-06
+last_modified: 2026-10-08
 ---
 
 Use this checklist when creating a new repository from scratch. Follow the steps
@@ -97,6 +97,12 @@ Template files can be fetched from:
       version still comes out empty, `dev` or `unknown`. A plain
       `docker build .` with no build arguments must succeed; a Dockerfile that
       refuses an empty build argument drops that refusal and keeps the argument.
+      A checkout whose `.git` is a file (a linked worktree, or a repository
+      checked out as a submodule) is the exception: that file points to a git
+      directory outside the build context, so the build cannot read the version
+      and a plain `docker build .` fails; pass the version with
+      `--build-arg VERSION=...`, as `script/docker` and `script/cibuild` already
+      do.
     - The Dockerfile carries a `lint` phase and a `test` phase, each invoking
       its tool directly rather than through `make` or `script/`, and the final
       stage carries a `COPY --from=` of a harmless file from each so the image
@@ -106,9 +112,11 @@ Template files can be fetched from:
     - Non-server: the final stage brings up the dev environment
     - Image pinned by sha256 hash with version/date comment
 - [ ] Gitea Actions workflow at `.gitea/workflows/check.yml` that runs
-      `script/cibuild` on push, checks out with `persist-credentials: false`,
+      `script/cibuild` on push, checks out with `persist-credentials: false` and
-      and carries the `concurrency` block that lets a new push cancel only the
+      with `fetch-depth: 0` (which fetches the tags `git describe` needs),
-      same branch's older run — reference
+      carries the `concurrency` block that lets a new push cancel only the same
+      branch's older run, and sets `timeout-minutes: 20` on the `check` job so a
+      hung build frees the shared runner — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`
 - [ ] Language-specific:
     - [ ] Go: `go mod init sneak.berlin/go/<name>`, `.golangci.yml` (fetch from
@@ -128,18 +136,22 @@ are thin shims calling them. Model scripts:
       alpine images without bash
 - [ ] `script/bootstrap` / `make bootstrap` — installs all dependencies,
       idempotently, assuming nothing (pkg manager detection nix/apt/brew/apk;
-      node used if present, else pinned version via nvm from a hash-verified
+      node used if its major version is the pinned one, else pinned version via
-      archive; pinned yarn via corepack); a non-server repo's development
+      nvm from a hash-verified archive, with yarn and the packages installed
+      under it; pinned yarn via corepack); a non-server repo's development
       environment stage runs it instead of inline installs; a gate phase or the
       build stage installs what its base image lacks either inline or by running
       it
 - [ ] `script/setup` / `make setup` — readies a fresh clone: runs `bootstrap`,
       then `install-precommit`, plus repo-specific init
-- [ ] `script/test` / `make test` — `docker build --no-cache --target test .`,
+- [ ] `script/test` / `make test` —
-      tagged; the phase runs real tests, not a no-op (90-second timeout,
+      `docker build --no-cache --target test --output type=cacheonly .`, which
-      60-second hard cap on wall time)
+      writes no image; the phase runs real tests, not a no-op (90-second
-- [ ] `script/lint` / `make lint` — `docker build --no-cache --target lint .`,
+      timeout, 60-second hard cap on wall time)
-      tagged. No lint verdict may come from a host invocation of the linter.
+- [ ] `script/lint` / `make lint` —
+      `docker build --no-cache --target lint --output type=cacheonly .`, which
+      writes no image. No lint verdict may come from a host invocation of the
+      linter.
 - [ ] `script/fmt` / `make fmt` — formats code (writes; native, never in a
       container)
 - [ ] `script/fmt-check` / `make fmt-check` — checks formatting (read-only;
@@ -153,16 +165,22 @@ are thin shims calling them. Model scripts:
       version as a build arg
 - [ ] `script/cibuild` — cd to repo root, run `script/bootstrap`, run
       `script/check`, then
-      `docker build --no-cache --build-arg VERSION="$version" .` (what CI runs).
+      `docker build --no-cache --build-arg VERSION="$version" -t "$tag" .` (what
-      The bootstrap is required: CI checks out and runs this alone, and
+      CI runs), with `$version` from `git describe --tags --always --dirty`
-      `script/fmt-check` runs the formatter on the host.
+      (`unknown` if empty) and `$tag` from `script/projectname`, each assigned
-- [ ] `script/fmt` and `script/fmt-check` source nvm for the pinned node version
+      on its own line before the build. The bootstrap is required: CI checks out
-      before invoking `yarn`, as `script/bootstrap`'s own install step does.
+      and runs this alone, and `script/fmt-check` runs the formatter on the
-      `script/bootstrap` leaves the node and yarn it installs off the `PATH` of
+      host.
-      the shell that called it, so a bare `yarn` exits 127 on a runner carrying
+- [ ] `script/fmt` and `script/fmt-check` pick their `yarn` with the same test
-      nothing but docker and git.
+      as `script/bootstrap`: the `yarn` on `PATH` when the node on `PATH` has
-- [ ] Every `docker build` in `script/` is tagged, so no invocation leaves a
+      the pinned major version, and otherwise yarn under the pinned node, with
-      dangling image behind
+      nvm loaded through `$HOME/.nvm/nvm.sh`. `script/bootstrap` leaves the node
+      and yarn it installs under nvm off the `PATH` of the shell that called it,
+      so a bare `yarn` exits 127 on a runner carrying nothing but docker and
+      git, or runs under another node.
+- [ ] No `docker build` in `script/` leaves a dangling image behind:
+      `script/lint` and `script/test` write no image, and `script/docker` and
+      `script/cibuild` tag theirs
 - [ ] `script/precommit` — called by the pre-commit hook; runs `script/check`
 - [ ] `script/install-precommit` — installs the pre-commit hook that runs
       `script/precommit`
@@ -174,10 +192,11 @@ are thin shims calling them. Model scripts:
 
 - [ ] `make check` passes
 - [ ] `make docker` succeeds
-- [ ] `script/cibuild` succeeds in a fresh clone on a host carrying nothing but
+- [ ] `script/cibuild` succeeds in a fresh clone on a host carrying what CI has
-      docker and git, with no node or yarn on `PATH`, which is what CI has, and
+      (the runner image `docker.gitea.com/runner-images:ubuntu-latest`: docker,
-      demonstrably executed the checks — a sub-second build, or `CACHED` on a
+      git and node 24, with no yarn on `PATH`), and demonstrably executed the
-      gate layer, means nothing ran
+      checks — a sub-second build, or `CACHED` on a gate layer, means nothing
+      ran
 - [ ] Plant a lint violation and confirm both `make lint` and a plain
       `docker build .` fail on it; revert. A plain build that passes proves the
       final stage is missing its `COPY --from=` edge to the gate phases.

prompts/REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-10-06
+last_modified: 2026-10-08
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -54,34 +54,39 @@ style conventions are in separate documents:
   `cibuild`. `script/bootstrap` installs all dependencies idempotently and
   assumes nothing is present: base tools come from nix, apt, brew, or apk
   (detected in that order; apt runs noninteractive). For node it uses the
-  installed node if present; otherwise it installs a PINNED node version via
+  installed node only when its major version is the pinned one; otherwise (node
-  nvm, first installing nvm itself if missing — from a hash-verified GitHub
+  missing, or another major, such as the node 24 the CI runner image ships) it
-  release archive (never `curl | sh`), with bash installed as an explicit
+  installs the PINNED node version via nvm and installs yarn and the packages
-  prerequisite since nvm requires bash. yarn is then pinned via
+  under it. nvm itself is installed first if missing, from a hash-verified
-  `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
+  GitHub release archive (never `curl | sh`), with bash installed as an explicit
-  always exact versions. `script/cibuild` runs the CI build: it changes to the
+  prerequisite since nvm requires bash. Only the major version is compared
-  repo root, runs `script/bootstrap`, runs `script/check`, and builds the image
+  because the `Dockerfile` stages start from a node image whose exact version is
-  with the version; the Gitea workflow calls it. **`script/cibuild` runs
+  not the pin, and nvm cannot install a prebuilt node on alpine. yarn is pinned
+  via `corepack prepare yarn@<version> --activate`. Never install "latest" or
+  "lts"; always exact versions. `script/cibuild` runs the CI build: it changes
+  to the repo root, runs `script/bootstrap`, runs `script/check`, and builds the
+  image with the version; the Gitea workflow calls it. **`script/cibuild` runs
   `script/bootstrap` first**, because the workflow checks out the repo and runs
   nothing else, while `script/fmt-check` runs the formatter on the host: on a
   pristine checkout with nothing installed the run dies there, after the
-  containerised gates have passed. **The bootstrap alone is not enough**:
+  containerised gates have passed. **The bootstrap alone is not enough**: when
-  `script/bootstrap` installs node and yarn under nvm and leaves neither on the
+  `script/bootstrap` installs node and yarn under nvm it leaves neither on the
-  `PATH` of the shell that called it, so a bare `yarn` still exits 127. The host
+  `PATH` of the shell that called it, so a bare `yarn` either exits 127 or runs
-  entrypoints that need yarn — `script/fmt` and `script/fmt-check` — therefore
+  under another node. The host entrypoints that need yarn — `script/fmt` and
-  source nvm for the pinned node version before invoking it, exactly as
+  `script/fmt-check` — therefore use the same test as `script/bootstrap`: when
-  `script/bootstrap`'s own install step does. A runner carrying nothing but
+  the node on `PATH` has the pinned major version they run the `yarn` on `PATH`,
-  docker and git then gets through `script/check`. Four further scripts are our
+  and otherwise they load nvm through `$HOME/.nvm/nvm.sh` and run yarn under the
-  own extensions to the standard: `script/check` runs `script/test`,
+  pinned node. A runner carrying nothing but docker and git then gets through
-  `script/lint` and `script/fmt-check`; `script/precommit` is what the git
+  `script/check`. Four further scripts are our own extensions to the standard:
-  pre-commit hook runs, and it calls `script/check`; `script/install-precommit`
+  `script/check` runs `script/test`, `script/lint` and `script/fmt-check`;
-  installs the git pre-commit hook (the `make hooks` target shims to it); and
+  `script/precommit` is what the git pre-commit hook runs, and it calls
-  `script/projectname` (literally that filename) simply outputs the project's
+  `script/check`; `script/install-precommit` installs the git pre-commit hook
-  name. Scripts that need the name call `script/projectname` — e.g.
+  (the `make hooks` target shims to it); and `script/projectname` (literally
-  `script/docker` assembles its image tag from it — so those scripts stay
+  that filename) simply outputs the project's name. Scripts that need the name
-  byte-identical across all repos. Repo-type-specific pre-commit extras (e.g.
+  call `script/projectname` — e.g. `script/docker` assembles its image tag from
-  `go mod tidy` verification in Go repos) belong in `script/precommit`, not in
+  it — so those scripts stay byte-identical across all repos. Repo-type-specific
-  the hook itself. Model scripts are at
+  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
+  `script/precommit`, not in the hook itself. Model scripts are at
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
   must document the provided scripts in an **Entrypoints** section (see the
   README requirements below).
@@ -118,9 +123,8 @@ style conventions are in separate documents:
   and nothing else:
 
     ```sh
-    tag="$(script/projectname)"
+    docker build --no-cache --target lint --output type=cacheonly .
-    docker build --no-cache --target lint -t "$tag-lint" .
+    docker build --no-cache --target test --output type=cacheonly .
-    docker build --no-cache --target test -t "$tag-test" .
     ```
 
     **A stage that is not the last one in the file is built only when the final
@@ -130,12 +134,15 @@ style conventions are in separate documents:
     plain `docker build .` builds the last stage alone and exits 0 having linted
     and tested nothing.
 
-    **Every `docker build` in `script/` is tagged**, here and in
+    **The gate builds write no image.** With `--output type=cacheonly` the phase
-    `script/cibuild` and `script/docker`. An untagged build leaves a dangling
+    runs and a failing step fails the build, but the result is not exported.
-    image behind on every invocation, on every developer host and every CI
+    Nothing uses those images, and writing one out is slow: a Go test phase's
-    runner; a tagged one replaces the previous image. Each script assigns the
+    image holds the toolchain and every compiled package. A build given neither
-    tag on its own line before the build, so `set -e` stops it where
+    `--output` nor `-t` writes an untagged image and leaves it dangling, on
-    `script/projectname` fails.
+    every developer host and every CI runner. `script/cibuild` and
+    `script/docker` build the image that ships and tag it, so each build
+    replaces the previous image; each assigns the tag on its own line before the
+    build, so `set -e` stops it where `script/projectname` fails.
 
     Inside a phase the tool is invoked directly — `golangci-lint`, `go test`,
     `eslint`, `prettier` — never through `make lint` or `script/test`, which are
@@ -281,12 +288,21 @@ style conventions are in separate documents:
       `.git` and the version still comes out empty, `dev` or `unknown`. A plain
       `docker build .` with no build arguments must succeed; a Dockerfile that
       refuses an empty build argument drops that refusal and keeps the argument.
+      A checkout whose `.git` is a file (a linked worktree, or a repository
+      checked out as a submodule) is the exception: that file points to a git
+      directory outside the build context, so the build cannot read the version
+      and a plain `docker build .` fails; pass the version with
+      `--build-arg VERSION=...`, as `script/docker` and `script/cibuild` already
+      do.
 
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
   runs `script/cibuild` on push, and checks out the repo as its only other step,
   with `persist-credentials: false`: `script/cibuild` needs no token, and
   without it the checkout leaves the job's token in `.git/config` for every
-  later step. Its `concurrency` block groups runs by workflow and branch
+  later step. The checkout step also sets `fetch-depth: 0`, which fetches the
+  tags `git describe` needs: by default it clones shallow with no tags, and a
+  tagged repository's CI build would stamp a bare short commit id. The
+  workflow's `concurrency` block groups runs by workflow and branch
   (`${{ github.workflow }}-${{ github.ref }}`) with `cancel-in-progress: true`,
   so a new push cancels the older run on the same branch, queued or running, and
   no other: runs for replaced commits do not hold up the shared runner.
@@ -295,12 +311,16 @@ style conventions are in separate documents:
   carry the same guarantee, because its gate phases may come from the cache. The
   image build is uncached and so runs the gate phases a second time. That is the
   price of the rule above, and it is worth paying: the image that ships is built
-  from a run of its own gates rather than from a cache entry. A separate
+  from a run of its own gates rather than from a cache entry. The `check` job
-  workflow limited to `main` by a `branches` list under `on: push` cannot be
+  sets `timeout-minutes: 20`, so a hung build frees the shared runner after 20
-  checked by review: to try a change to it, add the feature branch to that list
+  minutes. That allows for the three Docker builds described above (the test
-  and push, then remove the branch from the list again before merging. Keep any
+  phase, the lint phase, then the image), each held to the 5-minute Docker build
-  job in it that publishes behind `if: github.ref_name == 'main'`, so the run
+  limit below, plus the bootstrap. A separate workflow limited to `main` by a
-  from the feature branch publishes nothing.
+  `branches` list under `on: push` cannot be checked by review: to try a change
+  to it, add the feature branch to that list and push, then remove the branch
+  from the list again before merging. Keep any job in it that publishes behind
+  `if: github.ref_name == 'main'`, so the run from the feature branch publishes
+  nothing.
 
 - Use platform-standard formatters: `black` for Python, `prettier` for
   JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -466,8 +486,8 @@ style conventions are in separate documents:
     there because `ARG` is stage-scoped; passing `VERSION` to a repo whose
     Dockerfile declares no such `ARG` is ignored and costs nothing, which is why
     the scripts stay byte-identical. One consequence for CI: the standard
-    checkout action clones shallow and fetches no tags, so a repo that embeds a
+    checkout action clones shallow and fetches no tags, so the canonical
-    tag-derived version must set `fetch-depth: 0` on its checkout step.
+    `.gitea/workflows/check.yml` sets `fetch-depth: 0` on its checkout step.
 
 - **Verify `.dockerignore` by enumerating the image, not by reading the
   patterns.** Plant files at the root _and_ at least two directories deep, build
@@ -534,6 +554,11 @@ style conventions are in separate documents:
       function defined and never invoked has the same exit status and the same
       empty output as one that worked.
 
+    Node is the exception to the whole-token comparison: the canonical
+    `script/bootstrap` compares only its major version, because the node 22
+    alpine image the `Dockerfile` stages start from is not the exact pin, and
+    nvm cannot install a prebuilt node on alpine.
+
     Keep it POSIX sh: no arrays, no `[[`, no `grep -P`.
 
     A Go tool a repo needs on the host is installed with `go install` pinned to

script/bootstrap

@@ -2,10 +2,12 @@
 # script/bootstrap: install all dependencies needed to build and develop
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
-# or apk (detected in that order); assumes nothing is present. Node is
+# or apk (detected in that order); assumes nothing is present. The
-# used directly if installed; otherwise it is installed at a pinned
+# installed node is used only when its major version is the pinned one;
-# version via nvm (installing nvm itself first, from a hash-verified
+# otherwise (node missing, or another major) the pinned version is
-# release archive, never curl | sh).
+# installed via nvm (installing nvm itself first, from a hash-verified
+# release archive, never curl | sh), and yarn and the packages are
+# installed under it.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -19,6 +21,7 @@ YARN_VERSION="1.22.22"
 
 PKGMGR=""
 SUDO=""
+APT_UPDATED=""
 
 detect_pkgmgr() {
     [ -n "$PKGMGR" ] && return 0
@@ -47,7 +50,14 @@ pkg_install() {
     detect_pkgmgr
     case "$PKGMGR" in
         nix) nix-env -iA "nixpkgs.$1" ;;
-        apt) $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2" ;;
+        apt)
+            # Package lists may be empty (fresh images); refresh once per run.
+            if [ -z "$APT_UPDATED" ]; then
+                $SUDO env DEBIAN_FRONTEND=noninteractive apt-get update
+                APT_UPDATED=1
+            fi
+            $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2"
+            ;;
         brew) brew install "$3" ;;
         apk) apk add --no-cache "$4" ;;
     esac
@@ -92,31 +102,52 @@ ensure_nvm() {
     rm -rf "$tmp"
 }
 
+# True when the node on PATH has the pinned major version. Only the
+# major is compared: the Dockerfile stages start from a node 22 alpine
+# image whose exact version is not the pin, and nvm cannot install a
+# prebuilt node on alpine. Another major is not used: the pinned yarn 1
+# prints a deprecation warning under node 24. script/fmt and
+# script/fmt-check carry this function unchanged, to run the yarn
+# installed here.
+node_is_pinned_major() {
+    if ! command -v node >/dev/null 2>&1; then return 1; fi
+    installed="$(node --version)"
+    installed="${installed#v}"
+    [ "${installed%%.*}" = "${NODE_VERSION%%.*}" ]
+}
+
 ensure_node() {
-    if ! missing node; then return 0; fi
+    if node_is_pinned_major; then
+        echo "bootstrap: using node $(node --version)"
+        return 0
+    fi
     ensure_nvm
     nvm_sh "nvm install $NODE_VERSION"
+    nvm_sh "nvm use $NODE_VERSION >/dev/null && \
+        echo \"bootstrap: using node \$(node --version)\""
 }
 
 ensure_yarn() {
+    if ! node_is_pinned_major; then
+        nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
+            corepack prepare yarn@$YARN_VERSION --activate"
+        return 0
+    fi
     if ! missing yarn; then return 0; fi
     if ! missing corepack; then
         corepack enable
         corepack prepare "yarn@$YARN_VERSION" --activate
-    elif [ -s "$HOME/.nvm/nvm.sh" ]; then
-        nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
-            corepack prepare yarn@$YARN_VERSION --activate"
     else
         npm install -g "yarn@$YARN_VERSION"
     fi
 }
 
 install_js_deps() {
-    if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
+    if node_is_pinned_major; then
+        yarn install --frozen-lockfile
+    else
         nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
             yarn install --frozen-lockfile"
-    else
-        yarn install --frozen-lockfile
     fi
 }
 

script/fmt

@@ -7,15 +7,25 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 # Must match the pin in script/bootstrap.
 NODE_VERSION="22.17.0"
 
-# script/bootstrap installs node and yarn under nvm and leaves neither
+# True when the node on PATH has the pinned major version: the same
-# on the PATH of the shell that called it, so resolve the pinned
+# function as in script/bootstrap, which uses it to decide where it
-# toolchain here the way bootstrap's own install step does. nvm is a
+# installs yarn.
-# bash script, hence the subshell.
+node_is_pinned_major() {
+    if ! command -v node >/dev/null 2>&1; then return 1; fi
+    installed="$(node --version)"
+    installed="${installed#v}"
+    [ "${installed%%.*}" = "${NODE_VERSION%%.*}" ]
+}
+
+# Run the yarn script/bootstrap installed: the yarn on PATH when the
+# node on PATH has the pinned major version, and otherwise yarn under
+# the pinned node in nvm, which bootstrap leaves off the PATH of the
+# shell that called it. nvm is a bash script, hence the subshell.
 run_yarn() {
-    if command -v yarn >/dev/null 2>&1; then
+    if node_is_pinned_major && command -v yarn >/dev/null 2>&1; then
         exec yarn "$@"
     fi
-    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
+    if node_is_pinned_major || [ ! -s "$HOME/.nvm/nvm.sh" ]; then
         echo "fmt: no yarn; run script/bootstrap first" >&2
         exit 1
     fi

script/fmt-check

@@ -7,15 +7,25 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 # Must match the pin in script/bootstrap.
 NODE_VERSION="22.17.0"
 
-# script/bootstrap installs node and yarn under nvm and leaves neither
+# True when the node on PATH has the pinned major version: the same
-# on the PATH of the shell that called it, so resolve the pinned
+# function as in script/bootstrap, which uses it to decide where it
-# toolchain here the way bootstrap's own install step does. nvm is a
+# installs yarn.
-# bash script, hence the subshell.
+node_is_pinned_major() {
+    if ! command -v node >/dev/null 2>&1; then return 1; fi
+    installed="$(node --version)"
+    installed="${installed#v}"
+    [ "${installed%%.*}" = "${NODE_VERSION%%.*}" ]
+}
+
+# Run the yarn script/bootstrap installed: the yarn on PATH when the
+# node on PATH has the pinned major version, and otherwise yarn under
+# the pinned node in nvm, which bootstrap leaves off the PATH of the
+# shell that called it. nvm is a bash script, hence the subshell.
 run_yarn() {
-    if command -v yarn >/dev/null 2>&1; then
+    if node_is_pinned_major && command -v yarn >/dev/null 2>&1; then
         exec yarn "$@"
     fi
-    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
+    if node_is_pinned_major || [ ! -s "$HOME/.nvm/nvm.sh" ]; then
         echo "fmt-check: no yarn; run script/bootstrap first" >&2
         exit 1
     fi

script/lint

@@ -6,8 +6,8 @@
 #
 # The phase is not the last stage in the file, so it is built only when
 # --target names it. --no-cache because a cached lint layer is a lint
-# that did not run. The tag makes each build replace the previous image
+# that did not run. --output type=cacheonly writes no image, since
-# instead of leaving a dangling one behind.
+# nothing uses one.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -15,13 +15,9 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    # The tag gets its own line: a failing command substitution inside
-    # an argument does not trip `set -e`, so the inline form degrades
-    # silently to an empty constant.
-    tag="$("$SCRIPT_DIR/projectname")"
     docker build --no-cache \
         --target lint \
-        -t "$tag-lint" .
+        --output type=cacheonly .
 }
 
 main "$@"

script/test

@@ -2,8 +2,8 @@
 # script/test: run the test suite. Testing is a phase of the Dockerfile
 # and this builds that phase alone, on the same terms as script/lint:
 # --target because a phase that is not the last stage is built only when
-# named, --no-cache because a cached test layer is a test that did not
+# named, and --no-cache because a cached test layer is a test that did
-# run, and a tag so each build replaces the previous image.
+# not run. --output type=cacheonly writes no image, since nothing uses one.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -11,13 +11,9 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    # The tag gets its own line: a failing command substitution inside
-    # an argument does not trip `set -e`, so the inline form degrades
-    # silently to an empty constant.
-    tag="$("$SCRIPT_DIR/projectname")"
     docker build --no-cache \
         --target test \
-        -t "$tag-test" .
+        --output type=cacheonly .
 }
 
 main "$@"