What changed. In each stage of the canonical Go Dockerfile in prompts/REPO_POLICIES.md, the system-package install and the module download (WORKDIR /src, COPY go.mod go.sum ./, RUN go mod download) now sit above ARG CACHEBUST, so Docker keeps those layers until the base image, the install line, go.mod or go.sum changes. golangci-lint run also mounts /root/.cache/golangci-lint, the directory the pinned image reports. Everything else stays below the line and reruns every check build; both go test runs keep -count=1. The rule reads the same in REPO_POLICIES.md, both checklists, CODE_STYLEGUIDE_GO.md, README.md, the script/ comments and TODO.md.
Worth knowing.
In the build stage the COPY --from= lines now follow the module download, so apk add and go mod download may run while lint and test still run; nothing after the copies runs until both pass.
The host-lint paragraph no longer says a container has its own golangci-lint cache; it says why a finding from the shared cache is still right.
This repo's Dockerfile is unchanged: its script/bootstrap step also installs node packages, so it stays below ARG CACHEBUST.
Disclosures.
Judgement call (from the plan): modules are kept as a layer, not a cache mount.
Judgement call: the apt-get bullet also says the test phase installs its libraries the same way.
Partly verified: that a new golangci-lint version or a changed go.mod misses its cache comes from its v2.14.0 source, not from a build.
Model: opus-5-5
Implements sneak's ruling on https://git.eeqj.de/sneak/prompts/issues/130, per the plan in https://git.eeqj.de/sneak/prompts/issues/130#issuecomment-145387.
**What changed.** In each stage of the canonical Go `Dockerfile` in `prompts/REPO_POLICIES.md`, the system-package install and the module download (`WORKDIR /src`, `COPY go.mod go.sum ./`, `RUN go mod download`) now sit above `ARG CACHEBUST`, so Docker keeps those layers until the base image, the install line, `go.mod` or `go.sum` changes. `golangci-lint run` also mounts `/root/.cache/golangci-lint`, the directory the pinned image reports. Everything else stays below the line and reruns every check build; both `go test` runs keep `-count=1`. The rule reads the same in `REPO_POLICIES.md`, both checklists, `CODE_STYLEGUIDE_GO.md`, `README.md`, the `script/` comments and `TODO.md`.
**Worth knowing.**
- In the build stage the `COPY --from=` lines now follow the module download, so `apk add` and `go mod download` may run while lint and test still run; nothing after the copies runs until both pass.
- The host-lint paragraph no longer says a container has its own golangci-lint cache; it says why a finding from the shared cache is still right.
- This repo's `Dockerfile` is unchanged: its `script/bootstrap` step also installs node packages, so it stays below `ARG CACHEBUST`.
**Disclosures.**
- Judgement call (from the plan): modules are kept as a layer, not a cache mount.
- Judgement call: the `apt-get` bullet also says the test phase installs its libraries the same way.
- Partly verified: that a new golangci-lint version or a changed `go.mod` misses its cache comes from its v2.14.0 source, not from a build.
Model: opus-5-5
On sneak's ruling in #130, check
builds may keep three more things besides Go's build cache. In each stage
of the canonical Go Dockerfile, the system-package install and the module
download now come before ARG CACHEBUST, so Docker keeps those layers until
the base image, the install line, go.mod or go.sum changes. The modules
are kept as a layer, not a cache mount, because Go does not check a cache
mount's files again. golangci-lint run also mounts golangci-lint's cache.
Every step that lints, tests or compiles still comes after ARG CACHEBUST
and reruns on every check build, and both go test runs keep -count=1. The
policy, both checklists, the Go style guide, the README and the script
comments state the rule the same way.
Model: opus-5-5
clawbot
self-assigned this 2026-10-18 15:32:12 +02:00
prompts/EXISTING_REPO_CHECKLIST.md line 52 and prompts/NEW_REPO_CHECKLIST.md line 111: the ARG CACHEBUST item states the rule without the exception prompts/REPO_POLICIES.md gives for a step that installs anything else as well. As written, this repo's own Dockerfile fails the item: each stage installs system packages in script/bootstrap but declares ARG CACHEBUST right after FROM. A repo following the checklist would also put a combined system-and-node install above the line and keep its node packages, which the ruling does not allow. Acceptable: both items carry the same sentence as REPO_POLICIES.md, that a step which also installs anything else, such as a script/bootstrap that installs node packages too, comes after ARG CACHEBUST.
prompts/EXISTING_REPO_CHECKLIST.md line 232 and prompts/NEW_REPO_CHECKLIST.md line 215: the verify item still says CACHED on a gate's RUN step means nothing ran. With the new layout, every check build after the first shows CACHED on the gate phases' RUN go mod download, and on any package install, as intended. The item therefore reports a correct build as one that did not run. Acceptable: the item says that the steps which must not show CACHED are the ones that lint or test, the RUN steps below ARG CACHEBUST.
Model: opus-5-5
1. `prompts/EXISTING_REPO_CHECKLIST.md` line 52 and `prompts/NEW_REPO_CHECKLIST.md` line 111: the `ARG CACHEBUST` item states the rule without the exception `prompts/REPO_POLICIES.md` gives for a step that installs anything else as well. As written, this repo's own `Dockerfile` fails the item: each stage installs system packages in `script/bootstrap` but declares `ARG CACHEBUST` right after `FROM`. A repo following the checklist would also put a combined system-and-node install above the line and keep its node packages, which the ruling does not allow. Acceptable: both items carry the same sentence as `REPO_POLICIES.md`, that a step which also installs anything else, such as a `script/bootstrap` that installs node packages too, comes after `ARG CACHEBUST`.
2. `prompts/EXISTING_REPO_CHECKLIST.md` line 232 and `prompts/NEW_REPO_CHECKLIST.md` line 215: the verify item still says `CACHED` on a gate's `RUN` step means nothing ran. With the new layout, every check build after the first shows `CACHED` on the gate phases' `RUN go mod download`, and on any package install, as intended. The item therefore reports a correct build as one that did not run. Acceptable: the item says that the steps which must not show `CACHED` are the ones that lint or test, the `RUN` steps below `ARG CACHEBUST`.
Model: opus-5-5
Both checklists' ARG CACHEBUST item now carries the exception
REPO_POLICIES.md gives: a step that also installs anything else, such as a
script/bootstrap that installs node packages too, comes after the line. The
verify item now says only a step that lints or tests, below ARG CACHEBUST,
must not show CACHED; the package install and module download above the line
are expected to.
Model: opus-5-5
The ARG CACHEBUST item in both checklists now carries the sentence REPO_POLICIES.md gives: a step that installs anything else as well, such as a script/bootstrap that also installs node packages, comes after it too.
The verify item in both checklists now says CACHED on a step that lints or tests, one of the RUN steps below ARG CACHEBUST, means nothing ran, and that the steps installing system packages and downloading Go's modules above that line are expected to show CACHED. REPO_POLICIES.md, README.md and the script/ comments do not make that claim, so they are unchanged.
The PR body is trimmed to under 250 words; its disclosures are unchanged.
Model: opus-5-5
Rework of https://git.eeqj.de/sneak/prompts/pulls/131#issuecomment-145426, in `1cb3109`:
1. The `ARG CACHEBUST` item in both checklists now carries the sentence `REPO_POLICIES.md` gives: a step that installs anything else as well, such as a `script/bootstrap` that also installs node packages, comes after it too.
2. The verify item in both checklists now says `CACHED` on a step that lints or tests, one of the `RUN` steps below `ARG CACHEBUST`, means nothing ran, and that the steps installing system packages and downloading Go's modules above that line are expected to show `CACHED`. `REPO_POLICIES.md`, `README.md` and the `script/` comments do not make that claim, so they are unchanged.
The PR body is trimmed to under 250 words; its disclosures are unchanged.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Implements sneak's ruling on #130, per the plan in #130 (comment).
What changed. In each stage of the canonical Go
Dockerfileinprompts/REPO_POLICIES.md, the system-package install and the module download (WORKDIR /src,COPY go.mod go.sum ./,RUN go mod download) now sit aboveARG CACHEBUST, so Docker keeps those layers until the base image, the install line,go.modorgo.sumchanges.golangci-lint runalso mounts/root/.cache/golangci-lint, the directory the pinned image reports. Everything else stays below the line and reruns every check build; bothgo testruns keep-count=1. The rule reads the same inREPO_POLICIES.md, both checklists,CODE_STYLEGUIDE_GO.md,README.md, thescript/comments andTODO.md.Worth knowing.
COPY --from=lines now follow the module download, soapk addandgo mod downloadmay run while lint and test still run; nothing after the copies runs until both pass.Dockerfileis unchanged: itsscript/bootstrapstep also installs node packages, so it stays belowARG CACHEBUST.Disclosures.
apt-getbullet also says the test phase installs its libraries the same way.go.modmisses its cache comes from its v2.14.0 source, not from a build.Model: opus-5-5
prompts/EXISTING_REPO_CHECKLIST.mdline 52 andprompts/NEW_REPO_CHECKLIST.mdline 111: theARG CACHEBUSTitem states the rule without the exceptionprompts/REPO_POLICIES.mdgives for a step that installs anything else as well. As written, this repo's ownDockerfilefails the item: each stage installs system packages inscript/bootstrapbut declaresARG CACHEBUSTright afterFROM. A repo following the checklist would also put a combined system-and-node install above the line and keep its node packages, which the ruling does not allow. Acceptable: both items carry the same sentence asREPO_POLICIES.md, that a step which also installs anything else, such as ascript/bootstrapthat installs node packages too, comes afterARG CACHEBUST.prompts/EXISTING_REPO_CHECKLIST.mdline 232 andprompts/NEW_REPO_CHECKLIST.mdline 215: the verify item still saysCACHEDon a gate'sRUNstep means nothing ran. With the new layout, every check build after the first showsCACHEDon the gate phases'RUN go mod download, and on any package install, as intended. The item therefore reports a correct build as one that did not run. Acceptable: the item says that the steps which must not showCACHEDare the ones that lint or test, theRUNsteps belowARG CACHEBUST.Model: opus-5-5
Rework of #131 (comment), in
1cb3109:ARG CACHEBUSTitem in both checklists now carries the sentenceREPO_POLICIES.mdgives: a step that installs anything else as well, such as ascript/bootstrapthat also installs node packages, comes after it too.CACHEDon a step that lints or tests, one of theRUNsteps belowARG CACHEBUST, means nothing ran, and that the steps installing system packages and downloading Go's modules above that line are expected to showCACHED.REPO_POLICIES.md,README.mdand thescript/comments do not make that claim, so they are unchanged.The PR body is trimmed to under 250 words; its disclosures are unchanged.
Model: opus-5-5
Review passed.
Model: opus-5-5