Set a time limit on the canonical check job (closes #120)

The canonical check workflow gave its job no time limit, so a hung
script/cibuild held the shared runner until the runner's own default.
The check job now sets timeout-minutes: 20. script/cibuild runs three
Docker builds (the lint phase, the test phase, then the image, which
runs both again), each held to the 5-minute build limit, plus the
bootstrap. REPO_POLICIES.md and both checklists name the limit among
what the workflow sets.

Model: opus-5-5

README.md

@@ -116,14 +116,10 @@ alpine. We provide:
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (our own extension); used by
   `script/docker` for the image tag
-- `script/test` —
+- `script/test` — `docker build --no-cache --target test -t prompts-test .`,
-  `docker build --no-cache --target test --output type=cacheonly .`, building
+  building the `test` phase of the `Dockerfile` (no tests defined here)
-  the `test` phase of the `Dockerfile` without writing an image (no tests
+- `script/lint` — `docker build --no-cache --target lint -t prompts-lint .`,
-  defined here)
+  building the `lint` phase, which runs prettier over the markdown files
-- `script/lint` —
-  `docker build --no-cache --target lint --output type=cacheonly .`, building
-  the `lint` phase, which runs prettier over the markdown files, without writing
-  an image
 - `script/fmt` — format all markdown files with prettier (writes; native, not in
   a container)
 - `script/fmt-check` — check formatting (read-only; native)

TODO.md

@@ -21,38 +21,6 @@ fmt-check, and commit.
 
 # Completed Steps
 
-- 2026-10-08: The canonical `script/bootstrap` now uses the installed node only
-  when its major version is the pinned one (issue 118). Otherwise, as when node
-  is missing, it installs the pinned node under nvm and installs yarn and the
-  packages under it. It prints the version of the node it uses either way. The
-  CI runner image ships node 24, under which the pinned yarn 1.22.22 printed the
-  deprecation warning DEP0169 on every bootstrap. Only the major is compared
-  because the `Dockerfile` stages start from a node 22 alpine image whose exact
-  version is not the pin, and nvm cannot install a prebuilt node on alpine; the
-  version-comparison rule in `REPO_POLICIES.md` names node as its exception.
-  `script/fmt` and `script/fmt-check` pick their yarn with the same test: the
-  `yarn` on `PATH` when the installed node is the pinned major, and otherwise
-  yarn under the pinned node through nvm. `REPO_POLICIES.md` and both checklists
-  say so, and the checklists' final `script/cibuild` check names what the CI
-  runner image has: node 24 and no yarn. Not yet tried on the shared runner.
-  Repositories pick this up on their next re-vendor.
-- 2026-10-07: The `script/cibuild` item in `NEW_REPO_CHECKLIST.md` now matches
-  the canonical `script/cibuild` (issue 125). Its image build carries the tag,
-  `-t "$tag"`, and the item says that `$version` comes from
-  `git describe --tags --always --dirty` (`unknown` if empty) and `$tag` from
-  `script/projectname`, each assigned on its own line before the build. A
-  repository written from the checklist got an untagged build, which leaves a
-  dangling image behind on every run, and was never told where `$version` comes
-  from. The other `docker build` commands the checklists and `REPO_POLICIES.md`
-  give for `script/` already matched their scripts.
-- 2026-10-07: `script/lint` and `script/test` now build with
-  `--output type=cacheonly` in place of a tag (issue 123), so they still run
-  their phase uncached and fail on a failing step but write no image. Nothing
-  used those images, and writing one out cost about 16 seconds of a Go
-  repository's test build. `script/cibuild` and `script/docker` keep their tags.
-  `REPO_POLICIES.md`, both checklists and the README no longer say the gate
-  builds are tagged. Not yet tried on the shared runner. Repositories pick this
-  up on their next re-vendor.
 - 2026-10-07: The canonical `.gitea/workflows/check.yml` now sets
   `timeout-minutes: 20` on its `check` job (issue 120), so a hung build frees
   the shared runner instead of holding it until the runner's own limit.
@@ -61,10 +29,6 @@ fmt-check, and commit.
   follows it. `REPO_POLICIES.md` and both checklists name the limit among what
   the workflow sets. Not yet tried on the shared runner. Repositories pick this
   up on their next re-vendor.
-- 2026-10-07: The canonical `package.json` now has `"private": true` in place of
-  `"license": "MIT"` (issue 119), so a repository that copies it no longer
-  declares MIT whatever its own licence is. yarn does not print "No license
-  field" for a private package. This repository's own licence is unchanged.
 - 2026-10-06: The canonical `.gitea/workflows/check.yml` now sets
   `fetch-depth: 0` on its checkout step (issue 110), so CI fetches the history
   and tags that `git describe --tags --always` needs, and a tagged repository

package.json

@@ -1,5 +1,5 @@
 {
-  "private": true,
+  "license": "MIT",
   "devDependencies": {
     "prettier": "3.8.1"
   }

prompts/EXISTING_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: Existing Repo Checklist
-last_modified: 2026-10-08
+last_modified: 2026-10-07
 ---
 
 Use this checklist when beginning work in a repo that may not yet conform to our
@@ -132,30 +132,25 @@ with your task.
       `script/install-precommit`, shimmed by `make hooks`) runs it
 - [ ] README has an **Entrypoints** section documenting the `script/`
       entrypoints and linking the standard
-- [ ] `script/lint` and `script/test` each run
+- [ ] `script/lint` and `script/test` build their phase by name
-      `docker build --no-cache --target <phase> --output type=cacheonly .`,
+      (`docker build --no-cache --target <phase> -t <name>-<phase> .`), and no
-      which builds their phase by name and writes no image, and no host
+      host invocation anywhere in the repo can produce a lint verdict — grep for
-      invocation anywhere in the repo can produce a lint verdict — grep for the
+      the linter's own name across `script/`, the `Makefile` and CI config, not
-      linter's own name across `script/`, the `Makefile` and CI config, not just
+      just `script/lint`. A second path is likeliest here: a `make lint-fast`,
-      `script/lint`. A second path is likeliest here: a `make lint-fast`, an
+      an older host-versus-container branch, or a CI step calling the binary
-      older host-versus-container branch, or a CI step calling the binary
       directly. `script/fmt` and `script/fmt-check` are expected hits and stay
       on the host.
-- [ ] No `docker build` in `script/` leaves a dangling image behind:
+- [ ] Every `docker build` in `script/` is tagged — an untagged one leaves a
-      `script/lint` and `script/test` write no image, and `script/docker` and
+      dangling image behind on every run, on every host and CI runner
-      `script/cibuild` tag theirs. A build that writes an untagged image leaves
-      one behind on every run, on every host and CI runner.
 - [ ] `script/cibuild` runs `script/bootstrap` before `script/check`, and builds
       the image with `--no-cache`. Without the bootstrap the CI run dies in
       `script/fmt-check`, which runs the formatter on the host and finds nothing
       installed.
-- [ ] `script/fmt` and `script/fmt-check` pick their `yarn` with the same test
+- [ ] `script/fmt` and `script/fmt-check` source nvm for the pinned node version
-      as `script/bootstrap`: the `yarn` on `PATH` when the node on `PATH` has
+      before invoking `yarn`, as `script/bootstrap`'s own install step does.
-      the pinned major version, and otherwise yarn under the pinned node, with
+      `script/bootstrap` leaves the node and yarn it installs off the `PATH` of
-      nvm loaded through `$HOME/.nvm/nvm.sh`. `script/bootstrap` leaves the node
+      the shell that called it, so a bare `yarn` exits 127 on a runner carrying
-      and yarn it installs under nvm off the `PATH` of the shell that called it,
+      nothing but docker and git.
-      so a bare `yarn` exits 127 on a runner carrying nothing but docker and
-      git, or runs under another node.
 - [ ] `script/bootstrap` installs no linter of its own — delete the block, its
       version variables and its call site. A JS repo's `yarn install` stays; it
       brings a linter along with every other dependency, and no verdict is taken
@@ -208,11 +203,10 @@ with your task.
 # Final
 
 - [ ] `make check` passes
-- [ ] `script/cibuild` succeeds in a fresh clone on a host carrying what CI has
+- [ ] `script/cibuild` succeeds in a fresh clone on a host carrying nothing but
-      (the runner image `docker.gitea.com/runner-images:ubuntu-latest`: docker,
+      docker and git, with no node or yarn on `PATH`, which is what CI has, and
-      git and node 24, with no yarn on `PATH`), and demonstrably executed the
+      demonstrably executed the checks — a sub-second build, or `CACHED` on a
-      checks — a sub-second build, or `CACHED` on a gate layer, means nothing
+      gate layer, means nothing ran
-      ran
 - [ ] A planted lint violation fails both `make lint` and a plain
       `docker build .`; revert it afterwards
 - [ ] Commit and merge fixes before starting your actual task

prompts/NEW_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: New Repo Checklist
-last_modified: 2026-10-08
+last_modified: 2026-10-07
 ---
 
 Use this checklist when creating a new repository from scratch. Follow the steps
@@ -136,22 +136,18 @@ are thin shims calling them. Model scripts:
       alpine images without bash
 - [ ] `script/bootstrap` / `make bootstrap` — installs all dependencies,
       idempotently, assuming nothing (pkg manager detection nix/apt/brew/apk;
-      node used if its major version is the pinned one, else pinned version via
+      node used if present, else pinned version via nvm from a hash-verified
-      nvm from a hash-verified archive, with yarn and the packages installed
+      archive; pinned yarn via corepack); a non-server repo's development
-      under it; pinned yarn via corepack); a non-server repo's development
       environment stage runs it instead of inline installs; a gate phase or the
       build stage installs what its base image lacks either inline or by running
       it
 - [ ] `script/setup` / `make setup` — readies a fresh clone: runs `bootstrap`,
       then `install-precommit`, plus repo-specific init
-- [ ] `script/test` / `make test` —
+- [ ] `script/test` / `make test` — `docker build --no-cache --target test .`,
-      `docker build --no-cache --target test --output type=cacheonly .`, which
+      tagged; the phase runs real tests, not a no-op (90-second timeout,
-      writes no image; the phase runs real tests, not a no-op (90-second
+      60-second hard cap on wall time)
-      timeout, 60-second hard cap on wall time)
+- [ ] `script/lint` / `make lint` — `docker build --no-cache --target lint .`,
-- [ ] `script/lint` / `make lint` —
+      tagged. No lint verdict may come from a host invocation of the linter.
-      `docker build --no-cache --target lint --output type=cacheonly .`, which
-      writes no image. No lint verdict may come from a host invocation of the
-      linter.
 - [ ] `script/fmt` / `make fmt` — formats code (writes; native, never in a
       container)
 - [ ] `script/fmt-check` / `make fmt-check` — checks formatting (read-only;
@@ -165,22 +161,16 @@ are thin shims calling them. Model scripts:
       version as a build arg
 - [ ] `script/cibuild` — cd to repo root, run `script/bootstrap`, run
       `script/check`, then
-      `docker build --no-cache --build-arg VERSION="$version" -t "$tag" .` (what
+      `docker build --no-cache --build-arg VERSION="$version" .` (what CI runs).
-      CI runs), with `$version` from `git describe --tags --always --dirty`
+      The bootstrap is required: CI checks out and runs this alone, and
-      (`unknown` if empty) and `$tag` from `script/projectname`, each assigned
+      `script/fmt-check` runs the formatter on the host.
-      on its own line before the build. The bootstrap is required: CI checks out
+- [ ] `script/fmt` and `script/fmt-check` source nvm for the pinned node version
-      and runs this alone, and `script/fmt-check` runs the formatter on the
+      before invoking `yarn`, as `script/bootstrap`'s own install step does.
-      host.
+      `script/bootstrap` leaves the node and yarn it installs off the `PATH` of
-- [ ] `script/fmt` and `script/fmt-check` pick their `yarn` with the same test
+      the shell that called it, so a bare `yarn` exits 127 on a runner carrying
-      as `script/bootstrap`: the `yarn` on `PATH` when the node on `PATH` has
+      nothing but docker and git.
-      the pinned major version, and otherwise yarn under the pinned node, with
+- [ ] Every `docker build` in `script/` is tagged, so no invocation leaves a
-      nvm loaded through `$HOME/.nvm/nvm.sh`. `script/bootstrap` leaves the node
+      dangling image behind
-      and yarn it installs under nvm off the `PATH` of the shell that called it,
-      so a bare `yarn` exits 127 on a runner carrying nothing but docker and
-      git, or runs under another node.
-- [ ] No `docker build` in `script/` leaves a dangling image behind:
-      `script/lint` and `script/test` write no image, and `script/docker` and
-      `script/cibuild` tag theirs
 - [ ] `script/precommit` — called by the pre-commit hook; runs `script/check`
 - [ ] `script/install-precommit` — installs the pre-commit hook that runs
       `script/precommit`
@@ -192,11 +182,10 @@ are thin shims calling them. Model scripts:
 
 - [ ] `make check` passes
 - [ ] `make docker` succeeds
-- [ ] `script/cibuild` succeeds in a fresh clone on a host carrying what CI has
+- [ ] `script/cibuild` succeeds in a fresh clone on a host carrying nothing but
-      (the runner image `docker.gitea.com/runner-images:ubuntu-latest`: docker,
+      docker and git, with no node or yarn on `PATH`, which is what CI has, and
-      git and node 24, with no yarn on `PATH`), and demonstrably executed the
+      demonstrably executed the checks — a sub-second build, or `CACHED` on a
-      checks — a sub-second build, or `CACHED` on a gate layer, means nothing
+      gate layer, means nothing ran
-      ran
 - [ ] Plant a lint violation and confirm both `make lint` and a plain
       `docker build .` fail on it; revert. A plain build that passes proves the
       final stage is missing its `COPY --from=` edge to the gate phases.

prompts/REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-10-08
+last_modified: 2026-10-07
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -54,39 +54,34 @@ style conventions are in separate documents:
   `cibuild`. `script/bootstrap` installs all dependencies idempotently and
   assumes nothing is present: base tools come from nix, apt, brew, or apk
   (detected in that order; apt runs noninteractive). For node it uses the
-  installed node only when its major version is the pinned one; otherwise (node
+  installed node if present; otherwise it installs a PINNED node version via
-  missing, or another major, such as the node 24 the CI runner image ships) it
+  nvm, first installing nvm itself if missing — from a hash-verified GitHub
-  installs the PINNED node version via nvm and installs yarn and the packages
+  release archive (never `curl | sh`), with bash installed as an explicit
-  under it. nvm itself is installed first if missing, from a hash-verified
+  prerequisite since nvm requires bash. yarn is then pinned via
-  GitHub release archive (never `curl | sh`), with bash installed as an explicit
+  `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
-  prerequisite since nvm requires bash. Only the major version is compared
+  always exact versions. `script/cibuild` runs the CI build: it changes to the
-  because the `Dockerfile` stages start from a node image whose exact version is
+  repo root, runs `script/bootstrap`, runs `script/check`, and builds the image
-  not the pin, and nvm cannot install a prebuilt node on alpine. yarn is pinned
+  with the version; the Gitea workflow calls it. **`script/cibuild` runs
-  via `corepack prepare yarn@<version> --activate`. Never install "latest" or
-  "lts"; always exact versions. `script/cibuild` runs the CI build: it changes
-  to the repo root, runs `script/bootstrap`, runs `script/check`, and builds the
-  image with the version; the Gitea workflow calls it. **`script/cibuild` runs
   `script/bootstrap` first**, because the workflow checks out the repo and runs
   nothing else, while `script/fmt-check` runs the formatter on the host: on a
   pristine checkout with nothing installed the run dies there, after the
-  containerised gates have passed. **The bootstrap alone is not enough**: when
+  containerised gates have passed. **The bootstrap alone is not enough**:
-  `script/bootstrap` installs node and yarn under nvm it leaves neither on the
+  `script/bootstrap` installs node and yarn under nvm and leaves neither on the
-  `PATH` of the shell that called it, so a bare `yarn` either exits 127 or runs
+  `PATH` of the shell that called it, so a bare `yarn` still exits 127. The host
-  under another node. The host entrypoints that need yarn — `script/fmt` and
+  entrypoints that need yarn — `script/fmt` and `script/fmt-check` — therefore
-  `script/fmt-check` — therefore use the same test as `script/bootstrap`: when
+  source nvm for the pinned node version before invoking it, exactly as
-  the node on `PATH` has the pinned major version they run the `yarn` on `PATH`,
+  `script/bootstrap`'s own install step does. A runner carrying nothing but
-  and otherwise they load nvm through `$HOME/.nvm/nvm.sh` and run yarn under the
+  docker and git then gets through `script/check`. Four further scripts are our
-  pinned node. A runner carrying nothing but docker and git then gets through
+  own extensions to the standard: `script/check` runs `script/test`,
-  `script/check`. Four further scripts are our own extensions to the standard:
+  `script/lint` and `script/fmt-check`; `script/precommit` is what the git
-  `script/check` runs `script/test`, `script/lint` and `script/fmt-check`;
+  pre-commit hook runs, and it calls `script/check`; `script/install-precommit`
-  `script/precommit` is what the git pre-commit hook runs, and it calls
+  installs the git pre-commit hook (the `make hooks` target shims to it); and
-  `script/check`; `script/install-precommit` installs the git pre-commit hook
+  `script/projectname` (literally that filename) simply outputs the project's
-  (the `make hooks` target shims to it); and `script/projectname` (literally
+  name. Scripts that need the name call `script/projectname` — e.g.
-  that filename) simply outputs the project's name. Scripts that need the name
+  `script/docker` assembles its image tag from it — so those scripts stay
-  call `script/projectname` — e.g. `script/docker` assembles its image tag from
+  byte-identical across all repos. Repo-type-specific pre-commit extras (e.g.
-  it — so those scripts stay byte-identical across all repos. Repo-type-specific
+  `go mod tidy` verification in Go repos) belong in `script/precommit`, not in
-  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
+  the hook itself. Model scripts are at
-  `script/precommit`, not in the hook itself. Model scripts are at
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
   must document the provided scripts in an **Entrypoints** section (see the
   README requirements below).
@@ -123,8 +118,9 @@ style conventions are in separate documents:
   and nothing else:
 
     ```sh
-    docker build --no-cache --target lint --output type=cacheonly .
+    tag="$(script/projectname)"
-    docker build --no-cache --target test --output type=cacheonly .
+    docker build --no-cache --target lint -t "$tag-lint" .
+    docker build --no-cache --target test -t "$tag-test" .
     ```
 
     **A stage that is not the last one in the file is built only when the final
@@ -134,15 +130,12 @@ style conventions are in separate documents:
     plain `docker build .` builds the last stage alone and exits 0 having linted
     and tested nothing.
 
-    **The gate builds write no image.** With `--output type=cacheonly` the phase
+    **Every `docker build` in `script/` is tagged**, here and in
-    runs and a failing step fails the build, but the result is not exported.
+    `script/cibuild` and `script/docker`. An untagged build leaves a dangling
-    Nothing uses those images, and writing one out is slow: a Go test phase's
+    image behind on every invocation, on every developer host and every CI
-    image holds the toolchain and every compiled package. A build given neither
+    runner; a tagged one replaces the previous image. Each script assigns the
-    `--output` nor `-t` writes an untagged image and leaves it dangling, on
+    tag on its own line before the build, so `set -e` stops it where
-    every developer host and every CI runner. `script/cibuild` and
+    `script/projectname` fails.
-    `script/docker` build the image that ships and tag it, so each build
-    replaces the previous image; each assigns the tag on its own line before the
-    build, so `set -e` stops it where `script/projectname` fails.
 
     Inside a phase the tool is invoked directly — `golangci-lint`, `go test`,
     `eslint`, `prettier` — never through `make lint` or `script/test`, which are
@@ -305,20 +298,21 @@ style conventions are in separate documents:
   workflow's `concurrency` block groups runs by workflow and branch
   (`${{ github.workflow }}-${{ github.ref }}`) with `cancel-in-progress: true`,
   so a new push cancels the older run on the same branch, queued or running, and
-  no other: runs for replaced commits do not hold up the shared runner.
+  no other: runs for replaced commits do not hold up the shared runner. The
-  `script/cibuild` bootstraps, runs the gate phases, and then builds the image,
+  `check` job sets `timeout-minutes: 20`, so a hung build frees the shared
-  so a successful run means every check passed; a bare `docker build .` does not
+  runner after 20 minutes. That allows for the three Docker builds
-  carry the same guarantee, because its gate phases may come from the cache. The
+  `script/cibuild` runs (the lint phase, the test phase, then the image, which
-  image build is uncached and so runs the gate phases a second time. That is the
+  runs both again), each held to the 5-minute Docker build limit below, plus the
-  price of the rule above, and it is worth paying: the image that ships is built
+  bootstrap. `script/cibuild` bootstraps, runs the gate phases, and then builds
-  from a run of its own gates rather than from a cache entry. The `check` job
+  the image, so a successful run means every check passed; a bare
-  sets `timeout-minutes: 20`, so a hung build frees the shared runner after 20
+  `docker build .` does not carry the same guarantee, because its gate phases
-  minutes. That allows for the three Docker builds described above (the test
+  may come from the cache. The image build is uncached and so runs the gate
-  phase, the lint phase, then the image), each held to the 5-minute Docker build
+  phases a second time. That is the price of the rule above, and it is worth
-  limit below, plus the bootstrap. A separate workflow limited to `main` by a
+  paying: the image that ships is built from a run of its own gates rather than
-  `branches` list under `on: push` cannot be checked by review: to try a change
+  from a cache entry. A separate workflow limited to `main` by a `branches` list
-  to it, add the feature branch to that list and push, then remove the branch
+  under `on: push` cannot be checked by review: to try a change to it, add the
-  from the list again before merging. Keep any job in it that publishes behind
+  feature branch to that list and push, then remove the branch from the list
+  again before merging. Keep any job in it that publishes behind
   `if: github.ref_name == 'main'`, so the run from the feature branch publishes
   nothing.
 
@@ -554,11 +548,6 @@ style conventions are in separate documents:
       function defined and never invoked has the same exit status and the same
       empty output as one that worked.
 
-    Node is the exception to the whole-token comparison: the canonical
-    `script/bootstrap` compares only its major version, because the node 22
-    alpine image the `Dockerfile` stages start from is not the exact pin, and
-    nvm cannot install a prebuilt node on alpine.
-
     Keep it POSIX sh: no arrays, no `[[`, no `grep -P`.
 
     A Go tool a repo needs on the host is installed with `go install` pinned to

script/bootstrap

@@ -2,12 +2,10 @@
 # script/bootstrap: install all dependencies needed to build and develop
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
-# or apk (detected in that order); assumes nothing is present. The
+# or apk (detected in that order); assumes nothing is present. Node is
-# installed node is used only when its major version is the pinned one;
+# used directly if installed; otherwise it is installed at a pinned
-# otherwise (node missing, or another major) the pinned version is
+# version via nvm (installing nvm itself first, from a hash-verified
-# installed via nvm (installing nvm itself first, from a hash-verified
+# release archive, never curl | sh).
-# release archive, never curl | sh), and yarn and the packages are
-# installed under it.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -102,52 +100,31 @@ ensure_nvm() {
     rm -rf "$tmp"
 }
 
-# True when the node on PATH has the pinned major version. Only the
-# major is compared: the Dockerfile stages start from a node 22 alpine
-# image whose exact version is not the pin, and nvm cannot install a
-# prebuilt node on alpine. Another major is not used: the pinned yarn 1
-# prints a deprecation warning under node 24. script/fmt and
-# script/fmt-check carry this function unchanged, to run the yarn
-# installed here.
-node_is_pinned_major() {
-    if ! command -v node >/dev/null 2>&1; then return 1; fi
-    installed="$(node --version)"
-    installed="${installed#v}"
-    [ "${installed%%.*}" = "${NODE_VERSION%%.*}" ]
-}
-
 ensure_node() {
-    if node_is_pinned_major; then
+    if ! missing node; then return 0; fi
-        echo "bootstrap: using node $(node --version)"
-        return 0
-    fi
     ensure_nvm
     nvm_sh "nvm install $NODE_VERSION"
-    nvm_sh "nvm use $NODE_VERSION >/dev/null && \
-        echo \"bootstrap: using node \$(node --version)\""
 }
 
 ensure_yarn() {
-    if ! node_is_pinned_major; then
-        nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
-            corepack prepare yarn@$YARN_VERSION --activate"
-        return 0
-    fi
     if ! missing yarn; then return 0; fi
     if ! missing corepack; then
         corepack enable
         corepack prepare "yarn@$YARN_VERSION" --activate
+    elif [ -s "$HOME/.nvm/nvm.sh" ]; then
+        nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
+            corepack prepare yarn@$YARN_VERSION --activate"
     else
         npm install -g "yarn@$YARN_VERSION"
     fi
 }
 
 install_js_deps() {
-    if node_is_pinned_major; then
+    if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
-        yarn install --frozen-lockfile
-    else
         nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
             yarn install --frozen-lockfile"
+    else
+        yarn install --frozen-lockfile
     fi
 }
 

script/fmt

@@ -7,25 +7,15 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 # Must match the pin in script/bootstrap.
 NODE_VERSION="22.17.0"
 
-# True when the node on PATH has the pinned major version: the same
+# script/bootstrap installs node and yarn under nvm and leaves neither
-# function as in script/bootstrap, which uses it to decide where it
+# on the PATH of the shell that called it, so resolve the pinned
-# installs yarn.
+# toolchain here the way bootstrap's own install step does. nvm is a
-node_is_pinned_major() {
+# bash script, hence the subshell.
-    if ! command -v node >/dev/null 2>&1; then return 1; fi
-    installed="$(node --version)"
-    installed="${installed#v}"
-    [ "${installed%%.*}" = "${NODE_VERSION%%.*}" ]
-}
-
-# Run the yarn script/bootstrap installed: the yarn on PATH when the
-# node on PATH has the pinned major version, and otherwise yarn under
-# the pinned node in nvm, which bootstrap leaves off the PATH of the
-# shell that called it. nvm is a bash script, hence the subshell.
 run_yarn() {
-    if node_is_pinned_major && command -v yarn >/dev/null 2>&1; then
+    if command -v yarn >/dev/null 2>&1; then
         exec yarn "$@"
     fi
-    if node_is_pinned_major || [ ! -s "$HOME/.nvm/nvm.sh" ]; then
+    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
         echo "fmt: no yarn; run script/bootstrap first" >&2
         exit 1
     fi

script/fmt-check

@@ -7,25 +7,15 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 # Must match the pin in script/bootstrap.
 NODE_VERSION="22.17.0"
 
-# True when the node on PATH has the pinned major version: the same
+# script/bootstrap installs node and yarn under nvm and leaves neither
-# function as in script/bootstrap, which uses it to decide where it
+# on the PATH of the shell that called it, so resolve the pinned
-# installs yarn.
+# toolchain here the way bootstrap's own install step does. nvm is a
-node_is_pinned_major() {
+# bash script, hence the subshell.
-    if ! command -v node >/dev/null 2>&1; then return 1; fi
-    installed="$(node --version)"
-    installed="${installed#v}"
-    [ "${installed%%.*}" = "${NODE_VERSION%%.*}" ]
-}
-
-# Run the yarn script/bootstrap installed: the yarn on PATH when the
-# node on PATH has the pinned major version, and otherwise yarn under
-# the pinned node in nvm, which bootstrap leaves off the PATH of the
-# shell that called it. nvm is a bash script, hence the subshell.
 run_yarn() {
-    if node_is_pinned_major && command -v yarn >/dev/null 2>&1; then
+    if command -v yarn >/dev/null 2>&1; then
         exec yarn "$@"
     fi
-    if node_is_pinned_major || [ ! -s "$HOME/.nvm/nvm.sh" ]; then
+    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
         echo "fmt-check: no yarn; run script/bootstrap first" >&2
         exit 1
     fi

script/lint

@@ -6,8 +6,8 @@
 #
 # The phase is not the last stage in the file, so it is built only when
 # --target names it. --no-cache because a cached lint layer is a lint
-# that did not run. --output type=cacheonly writes no image, since
+# that did not run. The tag makes each build replace the previous image
-# nothing uses one.
+# instead of leaving a dangling one behind.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -15,9 +15,13 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
+    # The tag gets its own line: a failing command substitution inside
+    # an argument does not trip `set -e`, so the inline form degrades
+    # silently to an empty constant.
+    tag="$("$SCRIPT_DIR/projectname")"
     docker build --no-cache \
         --target lint \
-        --output type=cacheonly .
+        -t "$tag-lint" .
 }
 
 main "$@"

script/test

@@ -2,8 +2,8 @@
 # script/test: run the test suite. Testing is a phase of the Dockerfile
 # and this builds that phase alone, on the same terms as script/lint:
 # --target because a phase that is not the last stage is built only when
-# named, and --no-cache because a cached test layer is a test that did
+# named, --no-cache because a cached test layer is a test that did not
-# not run. --output type=cacheonly writes no image, since nothing uses one.
+# run, and a tag so each build replaces the previous image.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -11,9 +11,13 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
+    # The tag gets its own line: a failing command substitution inside
+    # an argument does not trip `set -e`, so the inline form degrades
+    # silently to an empty constant.
+    tag="$("$SCRIPT_DIR/projectname")"
     docker build --no-cache \
         --target test \
-        --output type=cacheonly .
+        -t "$tag-test" .
 }
 
 main "$@"