sneak approved keeping the Python package install between check builds, the way Go's downloaded modules are kept: sneak/rfscan#80 (comment), answering the question at sneak/rfscan#80 (comment). The canonical policy changes here first; rfscan re-vendors from next afterwards.
The rule to write down
A test phase may install the Python packages from the lockfile above ARG CACHEBUST, in a layer of its own: COPY Pipfile Pipfile.lock ./, then one RUN that runs pipenv install --deploy (with --dev when the tests need the development packages). Docker keeps that layer until the base image, its own lines, or Pipfile or Pipfile.lock change. If the step runs script/bootstrap instead, it also copies script/, so the layer is rebuilt when script/ changes too, and that bootstrap may install nothing beyond system packages, the pinned pipenv and the lockfile install.
Why it is safe, in the policy's own words where it can be: --deploy installs only what Pipfile.lock names, checks every package against the lockfile's hashes, and fails when the lockfile is out of date with Pipfile, so a kept layer is the same install a new one would be. The packages are kept as a layer, not a cache mount, for the reason Go's modules are: a cache mount is shared by every build on the host and nothing checks its files again.
The tests still run below ARG CACHEBUST, on every check build. Nothing else moves above the line. No hash check is weakened. No --no-cache or pruning is added.
prompts/REPO_POLICIES.md (the root REPO_POLICIES.md is a link to it): the CACHEBUST rule, the list of what check builds keep, and a short Python test phase example showing the order (system packages, COPY Pipfile Pipfile.lock ./, the install, ARG CACHEBUST, COPY . ., pytest). The policy has no Python Dockerfile guidance yet; this example is it. Keep it short.
prompts/NEW_REPO_CHECKLIST.md and prompts/EXISTING_REPO_CHECKLIST.md: the ARG CACHEBUST item, and a Python item beside the Go one.
README.md: the paragraph that restates the rule.
TODO.md: a dated Completed Steps entry.
script/ comments only if they state something this makes untrue.
Unchanged: this repo's own Dockerfile, the Go style guide, the lint phase and every other stage.
Definition of done
Every place above states the rule the same way, and every sentence matches what a Python Dockerfile written from it would do.
Markdown formatted with make fmt; script/cibuild passes from a fresh clone.
One PR against next, passed by an independent reviewer.
Model: opus-5-5
sneak approved keeping the Python package install between check builds, the way Go's downloaded modules are kept: https://git.eeqj.de/sneak/rfscan/issues/80#issuecomment-153437, answering the question at https://git.eeqj.de/sneak/rfscan/issues/80#issuecomment-153166. The canonical policy changes here first; rfscan re-vendors from `next` afterwards.
## The rule to write down
A `test` phase may install the Python packages from the lockfile above `ARG CACHEBUST`, in a layer of its own: `COPY Pipfile Pipfile.lock ./`, then one `RUN` that runs `pipenv install --deploy` (with `--dev` when the tests need the development packages). Docker keeps that layer until the base image, its own lines, or `Pipfile` or `Pipfile.lock` change. If the step runs `script/bootstrap` instead, it also copies `script/`, so the layer is rebuilt when `script/` changes too, and that bootstrap may install nothing beyond system packages, the pinned pipenv and the lockfile install.
Why it is safe, in the policy's own words where it can be: `--deploy` installs only what `Pipfile.lock` names, checks every package against the lockfile's hashes, and fails when the lockfile is out of date with `Pipfile`, so a kept layer is the same install a new one would be. The packages are kept as a layer, not a cache mount, for the reason Go's modules are: a cache mount is shared by every build on the host and nothing checks its files again.
The tests still run below `ARG CACHEBUST`, on every check build. Nothing else moves above the line. No hash check is weakened. No `--no-cache` or pruning is added.
## Where it goes (the change for https://git.eeqj.de/sneak/prompts/issues/130 is the model)
- `prompts/REPO_POLICIES.md` (the root `REPO_POLICIES.md` is a link to it): the `CACHEBUST` rule, the list of what check builds keep, and a short Python `test` phase example showing the order (system packages, `COPY Pipfile Pipfile.lock ./`, the install, `ARG CACHEBUST`, `COPY . .`, pytest). The policy has no Python `Dockerfile` guidance yet; this example is it. Keep it short.
- `prompts/NEW_REPO_CHECKLIST.md` and `prompts/EXISTING_REPO_CHECKLIST.md`: the `ARG CACHEBUST` item, and a Python item beside the Go one.
- `README.md`: the paragraph that restates the rule.
- `TODO.md`: a dated Completed Steps entry.
- `script/` comments only if they state something this makes untrue.
- Unchanged: this repo's own `Dockerfile`, the Go style guide, the lint phase and every other stage.
## Definition of done
1. Every place above states the rule the same way, and every sentence matches what a Python `Dockerfile` written from it would do.
2. Markdown formatted with `make fmt`; `script/cibuild` passes from a fresh clone.
3. One PR against `next`, passed by an independent reviewer.
Model: opus-5-5
clawbot
self-assigned this 2026-10-21 16:02:59 +02:00
Built in #135: the policy, both checklists and the README now place a Python test phase's install from Pipfile.lock above ARG CACHEBUST, and REPO_POLICIES.md has a short example. The example installs through script/bootstrap, so it never shows pipenv pinned by version alone.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/prompts/pulls/135: the policy, both checklists and the README now place a Python `test` phase's install from `Pipfile.lock` above `ARG CACHEBUST`, and `REPO_POLICIES.md` has a short example. The example installs through `script/bootstrap`, so it never shows pipenv pinned by version alone.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
sneak approved keeping the Python package install between check builds, the way Go's downloaded modules are kept: sneak/rfscan#80 (comment), answering the question at sneak/rfscan#80 (comment). The canonical policy changes here first; rfscan re-vendors from
nextafterwards.The rule to write down
A
testphase may install the Python packages from the lockfile aboveARG CACHEBUST, in a layer of its own:COPY Pipfile Pipfile.lock ./, then oneRUNthat runspipenv install --deploy(with--devwhen the tests need the development packages). Docker keeps that layer until the base image, its own lines, orPipfileorPipfile.lockchange. If the step runsscript/bootstrapinstead, it also copiesscript/, so the layer is rebuilt whenscript/changes too, and that bootstrap may install nothing beyond system packages, the pinned pipenv and the lockfile install.Why it is safe, in the policy's own words where it can be:
--deployinstalls only whatPipfile.locknames, checks every package against the lockfile's hashes, and fails when the lockfile is out of date withPipfile, so a kept layer is the same install a new one would be. The packages are kept as a layer, not a cache mount, for the reason Go's modules are: a cache mount is shared by every build on the host and nothing checks its files again.The tests still run below
ARG CACHEBUST, on every check build. Nothing else moves above the line. No hash check is weakened. No--no-cacheor pruning is added.Where it goes (the change for #130 is the model)
prompts/REPO_POLICIES.md(the rootREPO_POLICIES.mdis a link to it): theCACHEBUSTrule, the list of what check builds keep, and a short Pythontestphase example showing the order (system packages,COPY Pipfile Pipfile.lock ./, the install,ARG CACHEBUST,COPY . ., pytest). The policy has no PythonDockerfileguidance yet; this example is it. Keep it short.prompts/NEW_REPO_CHECKLIST.mdandprompts/EXISTING_REPO_CHECKLIST.md: theARG CACHEBUSTitem, and a Python item beside the Go one.README.md: the paragraph that restates the rule.TODO.md: a dated Completed Steps entry.script/comments only if they state something this makes untrue.Dockerfile, the Go style guide, the lint phase and every other stage.Definition of done
Dockerfilewritten from it would do.make fmt;script/cibuildpasses from a fresh clone.next, passed by an independent reviewer.Model: opus-5-5
Built in #135: the policy, both checklists and the README now place a Python
testphase's install fromPipfile.lockaboveARG CACHEBUST, andREPO_POLICIES.mdhas a short example. The example installs throughscript/bootstrap, so it never shows pipenv pinned by version alone.Model: opus-5-5