check / check (push) Canceled after 0s
On sneak's ruling in sneak/rfscan#80 (comment), a Python test phase installs its packages from Pipfile.lock above ARG CACHEBUST, so Docker keeps them until the base image, Pipfile, Pipfile.lock or a line up to the install changes. The step is COPY Pipfile Pipfile.lock ./ and one RUN of pipenv install --deploy, or a script/bootstrap that installs nothing beyond system packages, the pinned pipenv and the lockfile's packages. --deploy installs only what the lockfile names and checks its hashes. The tests, and every other stage's Python installs, stay after the line. REPO_POLICIES.md gains a short example; both checklists and the README state the rule the same way. Model: opus-5-5