Stop the lint and test builds writing an image (closes #123)

script/lint and script/test build their Dockerfile phase with
--output type=cacheonly in place of a tag. The phase still runs
uncached and a failing step still fails the build, but no image is
written: nothing used those images, and writing one out took about 16
seconds of a Go repository's test build. script/cibuild and
script/docker keep their tags. REPO_POLICIES.md, both checklists and
the README now say the gate builds write no image.

Model: opus-5-5

.gitea/workflows/check.yml

@@ -7,8 +7,6 @@ concurrency:
 jobs:
     check:
         runs-on: ubuntu-latest
-        # Free the shared runner from a hung build.
-        timeout-minutes: 20
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

TODO.md

@@ -29,14 +29,6 @@ fmt-check, and commit.
   `REPO_POLICIES.md`, both checklists and the README no longer say the gate
   builds are tagged. Not yet tried on the shared runner. Repositories pick this
   up on their next re-vendor.
-- 2026-10-07: The canonical `.gitea/workflows/check.yml` now sets
-  `timeout-minutes: 20` on its `check` job (issue 120), so a hung build frees
-  the shared runner instead of holding it until the runner's own limit.
-  `script/cibuild` runs three Docker builds, each held to the 5-minute Docker
-  build limit, plus the bootstrap; if that limit changes (issue 113), the value
-  follows it. `REPO_POLICIES.md` and both checklists name the limit among what
-  the workflow sets. Not yet tried on the shared runner. Repositories pick this
-  up on their next re-vendor.
 - 2026-10-07: The canonical `package.json` now has `"private": true` in place of
   `"license": "MIT"` (issue 119), so a repository that copies it no longer
   declares MIT whatever its own licence is. yarn does not print "No license

prompts/EXISTING_REPO_CHECKLIST.md

@@ -102,10 +102,9 @@ with your task.
       build finds the tag too.
 - [ ] Gitea Actions workflow in `.gitea/workflows/` runs `script/cibuild` on
       push, checks out with `persist-credentials: false` and with
-      `fetch-depth: 0` (which fetches the tags `git describe` needs), carries
+      `fetch-depth: 0` (which fetches the tags `git describe` needs), and
-      the `concurrency` block that lets a new push cancel only the same branch's
+      carries the `concurrency` block that lets a new push cancel only the same
-      older run, and sets `timeout-minutes: 20` on the `check` job so a hung
+      branch's older run — reference
-      build frees the shared runner — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`
 - [ ] Language-specific config:
     - [ ] Go: `go.mod`, `go.sum`, `.golangci.yml` (fetch from

prompts/NEW_REPO_CHECKLIST.md

@@ -113,10 +113,9 @@ Template files can be fetched from:
     - Image pinned by sha256 hash with version/date comment
 - [ ] Gitea Actions workflow at `.gitea/workflows/check.yml` that runs
       `script/cibuild` on push, checks out with `persist-credentials: false` and
-      with `fetch-depth: 0` (which fetches the tags `git describe` needs),
+      with `fetch-depth: 0` (which fetches the tags `git describe` needs), and
       carries the `concurrency` block that lets a new push cancel only the same
-      branch's older run, and sets `timeout-minutes: 20` on the `check` job so a
+      branch's older run — reference
-      hung build frees the shared runner — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`
 - [ ] Language-specific:
     - [ ] Go: `go mod init sneak.berlin/go/<name>`, `.golangci.yml` (fetch from

prompts/REPO_POLICIES.md

@@ -306,16 +306,12 @@ style conventions are in separate documents:
   carry the same guarantee, because its gate phases may come from the cache. The
   image build is uncached and so runs the gate phases a second time. That is the
   price of the rule above, and it is worth paying: the image that ships is built
-  from a run of its own gates rather than from a cache entry. The `check` job
+  from a run of its own gates rather than from a cache entry. A separate
-  sets `timeout-minutes: 20`, so a hung build frees the shared runner after 20
+  workflow limited to `main` by a `branches` list under `on: push` cannot be
-  minutes. That allows for the three Docker builds described above (the test
+  checked by review: to try a change to it, add the feature branch to that list
-  phase, the lint phase, then the image), each held to the 5-minute Docker build
+  and push, then remove the branch from the list again before merging. Keep any
-  limit below, plus the bootstrap. A separate workflow limited to `main` by a
+  job in it that publishes behind `if: github.ref_name == 'main'`, so the run
-  `branches` list under `on: push` cannot be checked by review: to try a change
+  from the feature branch publishes nothing.
-  to it, add the feature branch to that list and push, then remove the branch
-  from the list again before merging. Keep any job in it that publishes behind
-  `if: github.ref_name == 'main'`, so the run from the feature branch publishes
-  nothing.
 
 - Use platform-standard formatters: `black` for Python, `prettier` for
   JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with