From bb00d57720b405171a1bc4963e30696f3d3a3d38 Mon Sep 17 00:00:00 2001
From: sneak <sneak@sneak.berlin>
Date: Wed, 7 Oct 2026 10:03:41 +0000
Subject: [PATCH] Tag the image build in the checklist's script/cibuild item
 (closes #125)

The new-repository checklist gave script/cibuild's image build without a
tag, so a repository written from it left a dangling image behind on
every run, and it used $version without saying where it comes from. The
item now gives the build as the canonical script/cibuild runs it, with
-t "$tag", and names the two steps the script runs before it, each on
its own line: the version from git describe --tags --always --dirty
(unknown if empty) and the tag from script/projectname. The other docker
build commands the checklists and REPO_POLICIES.md give for script/
already matched their scripts.

Model: opus-5-5
---
 TODO.md                       | 9 +++++++++
 prompts/NEW_REPO_CHECKLIST.md | 9 ++++++---
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/TODO.md b/TODO.md
index 7265754..1960ac5 100644
--- a/TODO.md
+++ b/TODO.md
@@ -21,6 +21,15 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-07: The `script/cibuild` item in `NEW_REPO_CHECKLIST.md` now matches
+  the canonical `script/cibuild` (issue 125). Its image build carries the tag,
+  `-t "$tag"`, and the item says that `$version` comes from
+  `git describe --tags --always --dirty` (`unknown` if empty) and `$tag` from
+  `script/projectname`, each assigned on its own line before the build. A
+  repository written from the checklist got an untagged build, which leaves a
+  dangling image behind on every run, and was never told where `$version` comes
+  from. The other `docker build` commands the checklists and `REPO_POLICIES.md`
+  give for `script/` already matched their scripts.
 - 2026-10-07: `script/lint` and `script/test` now build with
   `--output type=cacheonly` in place of a tag (issue 123), so they still run
   their phase uncached and fail on a failing step but write no image. Nothing
diff --git a/prompts/NEW_REPO_CHECKLIST.md b/prompts/NEW_REPO_CHECKLIST.md
index 6a2e471..2f3dd49 100644
--- a/prompts/NEW_REPO_CHECKLIST.md
+++ b/prompts/NEW_REPO_CHECKLIST.md
@@ -164,9 +164,12 @@ are thin shims calling them. Model scripts:
       version as a build arg
 - [ ] `script/cibuild` — cd to repo root, run `script/bootstrap`, run
       `script/check`, then
-      `docker build --no-cache --build-arg VERSION="$version" .` (what CI runs).
-      The bootstrap is required: CI checks out and runs this alone, and
-      `script/fmt-check` runs the formatter on the host.
+      `docker build --no-cache --build-arg VERSION="$version" -t "$tag" .` (what
+      CI runs), with `$version` from `git describe --tags --always --dirty`
+      (`unknown` if empty) and `$tag` from `script/projectname`, each assigned
+      on its own line before the build. The bootstrap is required: CI checks out
+      and runs this alone, and `script/fmt-check` runs the formatter on the
+      host.
 - [ ] `script/fmt` and `script/fmt-check` source nvm for the pinned node version
       before invoking `yarn`, as `script/bootstrap`'s own install step does.
       `script/bootstrap` leaves the node and yarn it installs off the `PATH` of
-- 
2.54.0