Check builds keep Go's build cache between runs, per sneak's ruling on #113: the compile cache may survive, every step still reruns, no test result is reused.
script/lint, script/test, script/cibuild and script/docker pass --build-arg CACHEBUST="$(date +%s)-$$" in place of --no-cache, which empties every cache mount. The value differs on every build, including the three in one script/cibuild.
Every stage of this repo's Dockerfile and of the canonical Go Dockerfile declares ARG CACHEBUST first. A new value reruns every RUN step after it; COPY steps are compared by content and may still show CACHED.
The canonical Go Dockerfile mounts Go's build cache (/root/.cache/go-build) on golangci-lint run, both go test runs and go build, nothing else. Both go test runs gain -count=1, since that directory also holds test results.
REPO_POLICIES.md, both checklists, the Go styleguide and the README say this in the same words.
Watch for: a stage without the ARG line is served from cache on an unchanged tree, with no warning, so a repository re-vendors the scripts and adds the ARG lines in one commit. A plain docker build . can still come from cache, as before.
Judgement call: the policy says a container has "its own golangci-lint cache", not "its own cache", since the lint step shares Go's build cache.
Judgement call: the checklists' final item names CACHED on a gate's RUN step as the sign nothing ran.
Unverified: not yet tried on the shared CI runner.
Model: opus-5-5
Check builds keep Go's build cache between runs, per sneak's ruling on https://git.eeqj.de/sneak/prompts/issues/113: the compile cache may survive, every step still reruns, no test result is reused.
- `script/lint`, `script/test`, `script/cibuild` and `script/docker` pass `--build-arg CACHEBUST="$(date +%s)-$$"` in place of `--no-cache`, which empties every cache mount. The value differs on every build, including the three in one `script/cibuild`.
- Every stage of this repo's `Dockerfile` and of the canonical Go `Dockerfile` declares `ARG CACHEBUST` first. A new value reruns every `RUN` step after it; `COPY` steps are compared by content and may still show `CACHED`.
- The canonical Go `Dockerfile` mounts Go's build cache (`/root/.cache/go-build`) on `golangci-lint run`, both `go test` runs and `go build`, nothing else. Both `go test` runs gain `-count=1`, since that directory also holds test results.
- `REPO_POLICIES.md`, both checklists, the Go styleguide and the README say this in the same words.
Watch for: a stage without the `ARG` line is served from cache on an unchanged tree, with no warning, so a repository re-vendors the scripts and adds the `ARG` lines in one commit. A plain `docker build .` can still come from cache, as before.
Judgement call: the policy says a container has "its own golangci-lint cache", not "its own cache", since the lint step shares Go's build cache.
Judgement call: the checklists' final item names `CACHED` on a gate's `RUN` step as the sign nothing ran.
Unverified: not yet tried on the shared CI runner.
Model: opus-5-5
clawbot
self-assigned this 2026-10-15 12:58:13 +02:00
script/lint, script/test, script/cibuild and script/docker pass a new
CACHEBUST build argument on every build in place of --no-cache, which
empties every cache mount. Every Dockerfile stage declares ARG
CACHEBUST first, so every RUN step still runs on every check build.
The canonical Go Dockerfile mounts Go's build cache on the steps that
compile and runs both go test runs with -count=1, so no test result is
reused. REPO_POLICIES.md, both checklists, the Go styleguide and the
README say so. A stage without the ARG line is served from cache, so a
repository re-vendors the scripts and the ARG lines in one commit.
Model: opus-5-5
prompts/REPO_POLICIES.md, the paragraph "The gate builds write no image" (lines 141-142): it still says a Go test phase's image "holds the toolchain and every compiled package". With Go's build cache mounted, the compiled packages go into the mount and are no longer part of the phase's image, so the sentence is now wrong. Acceptable: drop "and every compiled package", or say the compiled packages stay in the mounted cache.
The comments in script/lint, script/test, script/cibuild and script/docker say a new CACHEBUST value reruns every RUN step. That holds only in a stage that declares ARG CACHEBUST; with a Dockerfile that lacks the line, the RUN steps come from cache and Docker prints no warning. These scripts are copied unchanged into every repository, so their comments are where a re-vendor learns how they work. Acceptable: each comment says it relies on every stage of the Dockerfile declaring ARG CACHEBUST first.
Open point for the owner (reading taken: allowed by the ruling): the cache mount sets no id, so every repository and branch built on the same host shares one Go build cache, and the image build's go build, which produces the shipped binary, reads from it.
Unverified: behaviour on the shared CI runner.
Model: opus-5-5
Review: needs rework.
1. `prompts/REPO_POLICIES.md`, the paragraph "The gate builds write no image" (lines 141-142): it still says a Go test phase's image "holds the toolchain and every compiled package". With Go's build cache mounted, the compiled packages go into the mount and are no longer part of the phase's image, so the sentence is now wrong. Acceptable: drop "and every compiled package", or say the compiled packages stay in the mounted cache.
2. The comments in `script/lint`, `script/test`, `script/cibuild` and `script/docker` say a new `CACHEBUST` value reruns every `RUN` step. That holds only in a stage that declares `ARG CACHEBUST`; with a `Dockerfile` that lacks the line, the `RUN` steps come from cache and Docker prints no warning. These scripts are copied unchanged into every repository, so their comments are where a re-vendor learns how they work. Acceptable: each comment says it relies on every stage of the `Dockerfile` declaring `ARG CACHEBUST` first.
Open point for the owner (reading taken: allowed by the ruling): the cache mount sets no `id`, so every repository and branch built on the same host shares one Go build cache, and the image build's `go build`, which produces the shipped binary, reads from it.
Unverified: behaviour on the shared CI runner.
Model: opus-5-5
REPO_POLICIES.md no longer says a Go test phase's image holds every
compiled package; with Go's build cache mounted, those stay in the
mount. The comments in script/lint, script/test, script/cibuild and
script/docker now say that a new CACHEBUST value reruns the RUN steps
only because every stage of the Dockerfile declares ARG CACHEBUST
first, and that a stage without the line is served from cache with no
warning. NEW_REPO_CHECKLIST.md tells a new repository to add the
scripts and every stage's ARG CACHEBUST line in the same commit, in
place of re-vendoring them.
Model: opus-5-5
Dropped "and every compiled package" from the paragraph "The gate builds write no image".
Each of the four scripts' comments now says it relies on every stage of the Dockerfile declaring ARG CACHEBUST first, and that a stage without that line is served from cache with no warning.
The new-repository checklist item now says the scripts and every stage's ARG CACHEBUST line are added in the same commit.
PR body trimmed to under 250 words.
Model: opus-5-5
Rework of https://git.eeqj.de/sneak/prompts/pulls/129#issuecomment-142727:
1. Dropped "and every compiled package" from the paragraph "The gate builds write no image".
2. Each of the four scripts' comments now says it relies on every stage of the `Dockerfile` declaring `ARG CACHEBUST` first, and that a stage without that line is served from cache with no warning.
3. The new-repository checklist item now says the scripts and every stage's `ARG CACHEBUST` line are added in the same commit.
4. PR body trimmed to under 250 words.
Model: opus-5-5
prompts/REPO_POLICIES.md, the key point under the canonical Go Dockerfile that begins "Only Go's build cache is mounted" (lines 282-284): it says a kept module cache "would skip downloading the modules and checking them against go.sum". The second half is wrong. Go checks every module it takes from the module cache against go.sum, using the hash it recorded when it downloaded the module, so a kept module cache skips the download but not the go.sum check. This text is vendored into every repository as the reason for a rule. Acceptable: drop "and checking them against go.sum", or give a reason that holds, such as the ruling on #113 that only Go's compile cache may survive.
Unverified: behaviour on the shared CI runner.
Model: opus-5-5
Review: needs rework.
1. `prompts/REPO_POLICIES.md`, the key point under the canonical Go `Dockerfile` that begins "Only Go's build cache is mounted" (lines 282-284): it says a kept module cache "would skip downloading the modules and checking them against `go.sum`". The second half is wrong. Go checks every module it takes from the module cache against `go.sum`, using the hash it recorded when it downloaded the module, so a kept module cache skips the download but not the `go.sum` check. This text is vendored into every repository as the reason for a rule. Acceptable: drop "and checking them against `go.sum`", or give a reason that holds, such as the ruling on https://git.eeqj.de/sneak/prompts/issues/113 that only Go's compile cache may survive.
Unverified: behaviour on the shared CI runner.
Model: opus-5-5
The key point under the canonical Go Dockerfile said a kept module
cache would skip checking modules against go.sum. Go checks every
module it takes from the module cache against go.sum, so a kept
module cache skips only the download. The sentence now says that.
Model: opus-5-5
Rework of #129 (comment): dropped "and checking them against go.sum" from the module cache reason in prompts/REPO_POLICIES.md; the claim appears nowhere else in the tree.
Model: opus-5-5
Rework of https://git.eeqj.de/sneak/prompts/pulls/129#issuecomment-142861: dropped "and checking them against `go.sum`" from the module cache reason in `prompts/REPO_POLICIES.md`; the claim appears nowhere else in the tree.
Model: opus-5-5
prompts/REPO_POLICIES.md, the key point under the canonical Go Dockerfile that begins "Only Go's build cache is mounted" (line 283): the reason it now gives for not keeping the module cache, that it "would skip downloading the modules", does not explain anything. The same key point keeps Go's build cache because it saves work without skipping a check, and skipping a download skips no check, so as written the sentence reads as a reason to keep the module cache too. This text is copied into every repository as the reason for the rule. Acceptable: a reason that holds, such as the ruling on #113 that only Go's compile cache may survive, or that Go builds whatever files a kept module cache holds without checking them again (only go mod verify does), so a file changed in the cache would go unnoticed.
Model: opus-5-5
1. `prompts/REPO_POLICIES.md`, the key point under the canonical Go `Dockerfile` that begins "Only Go's build cache is mounted" (line 283): the reason it now gives for not keeping the module cache, that it "would skip downloading the modules", does not explain anything. The same key point keeps Go's build cache because it saves work without skipping a check, and skipping a download skips no check, so as written the sentence reads as a reason to keep the module cache too. This text is copied into every repository as the reason for the rule. Acceptable: a reason that holds, such as the ruling on https://git.eeqj.de/sneak/prompts/issues/113 that only Go's compile cache may survive, or that Go builds whatever files a kept module cache holds without checking them again (only `go mod verify` does), so a file changed in the cache would go unnoticed.
Model: opus-5-5
Go builds from whatever files a kept module cache holds without
checking them again, so a changed file would go unnoticed; skipping a
download skipped no check and was no reason.
Model: opus-5-5
Finding 1 (#129 (comment)): the module-cache clause now says Go builds from whatever files a kept module cache holds without checking them again (only go mod verify does), so a changed file would go unnoticed; the paragraph is rewrapped by make fmt.
Model: opus-5-5
Finding 1 (https://git.eeqj.de/sneak/prompts/pulls/129#issuecomment-142992): the module-cache clause now says Go builds from whatever files a kept module cache holds without checking them again (only `go mod verify` does), so a changed file would go unnoticed; the paragraph is rewrapped by `make fmt`.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Check builds keep Go's build cache between runs, per sneak's ruling on #113: the compile cache may survive, every step still reruns, no test result is reused.
script/lint,script/test,script/cibuildandscript/dockerpass--build-arg CACHEBUST="$(date +%s)-$$"in place of--no-cache, which empties every cache mount. The value differs on every build, including the three in onescript/cibuild.Dockerfileand of the canonical GoDockerfiledeclaresARG CACHEBUSTfirst. A new value reruns everyRUNstep after it;COPYsteps are compared by content and may still showCACHED.Dockerfilemounts Go's build cache (/root/.cache/go-build) ongolangci-lint run, bothgo testruns andgo build, nothing else. Bothgo testruns gain-count=1, since that directory also holds test results.REPO_POLICIES.md, both checklists, the Go styleguide and the README say this in the same words.Watch for: a stage without the
ARGline is served from cache on an unchanged tree, with no warning, so a repository re-vendors the scripts and adds theARGlines in one commit. A plaindocker build .can still come from cache, as before.Judgement call: the policy says a container has "its own golangci-lint cache", not "its own cache", since the lint step shares Go's build cache.
Judgement call: the checklists' final item names
CACHEDon a gate'sRUNstep as the sign nothing ran.Unverified: not yet tried on the shared CI runner.
Model: opus-5-5
Review: needs rework.
prompts/REPO_POLICIES.md, the paragraph "The gate builds write no image" (lines 141-142): it still says a Go test phase's image "holds the toolchain and every compiled package". With Go's build cache mounted, the compiled packages go into the mount and are no longer part of the phase's image, so the sentence is now wrong. Acceptable: drop "and every compiled package", or say the compiled packages stay in the mounted cache.The comments in
script/lint,script/test,script/cibuildandscript/dockersay a newCACHEBUSTvalue reruns everyRUNstep. That holds only in a stage that declaresARG CACHEBUST; with aDockerfilethat lacks the line, theRUNsteps come from cache and Docker prints no warning. These scripts are copied unchanged into every repository, so their comments are where a re-vendor learns how they work. Acceptable: each comment says it relies on every stage of theDockerfiledeclaringARG CACHEBUSTfirst.Open point for the owner (reading taken: allowed by the ruling): the cache mount sets no
id, so every repository and branch built on the same host shares one Go build cache, and the image build'sgo build, which produces the shipped binary, reads from it.Unverified: behaviour on the shared CI runner.
Model: opus-5-5
Rework of #129 (comment):
DockerfiledeclaringARG CACHEBUSTfirst, and that a stage without that line is served from cache with no warning.ARG CACHEBUSTline are added in the same commit.Model: opus-5-5
Review: needs rework.
prompts/REPO_POLICIES.md, the key point under the canonical GoDockerfilethat begins "Only Go's build cache is mounted" (lines 282-284): it says a kept module cache "would skip downloading the modules and checking them againstgo.sum". The second half is wrong. Go checks every module it takes from the module cache againstgo.sum, using the hash it recorded when it downloaded the module, so a kept module cache skips the download but not thego.sumcheck. This text is vendored into every repository as the reason for a rule. Acceptable: drop "and checking them againstgo.sum", or give a reason that holds, such as the ruling on #113 that only Go's compile cache may survive.Unverified: behaviour on the shared CI runner.
Model: opus-5-5
Rework of #129 (comment): dropped "and checking them against
go.sum" from the module cache reason inprompts/REPO_POLICIES.md; the claim appears nowhere else in the tree.Model: opus-5-5
prompts/REPO_POLICIES.md, the key point under the canonical GoDockerfilethat begins "Only Go's build cache is mounted" (line 283): the reason it now gives for not keeping the module cache, that it "would skip downloading the modules", does not explain anything. The same key point keeps Go's build cache because it saves work without skipping a check, and skipping a download skips no check, so as written the sentence reads as a reason to keep the module cache too. This text is copied into every repository as the reason for the rule. Acceptable: a reason that holds, such as the ruling on #113 that only Go's compile cache may survive, or that Go builds whatever files a kept module cache holds without checking them again (onlygo mod verifydoes), so a file changed in the cache would go unnoticed.Model: opus-5-5
Finding 1 (#129 (comment)): the module-cache clause now says Go builds from whatever files a kept module cache holds without checking them again (only
go mod verifydoes), so a changed file would go unnoticed; the paragraph is rewrapped bymake fmt.Model: opus-5-5
Review passed: the finding of #129 (comment) is fixed.
Model: opus-5-5