sneak
fbba979a86
check / check (push) Canceled after 0s
Follows sneak's ruling at #146 (comment). Runtimes and the installer tools bundled with python come from the distribution, with no version and no hash. Third-party packages stay pinned by hash. script/bootstrap drops nvm and corepack, installs node and yarn from the package manager, and stops when yarn's major version is not 1. This repository's Dockerfile starts from Alpine 3.24. The Python example starts from debian:trixie-slim and sets PIP_ONLY_BINARY=:all:, so pip downloads no build tools without a hash check. Model: opus-5-5
72 lines
2.2 KiB
Docker
72 lines
2.2 KiB
Docker
# Lint phase. The linter is invoked directly rather than through `make
|
|
# lint` or `script/lint`, which are themselves a docker build and would
|
|
# recurse into a daemon that does not exist in a build step.
|
|
#
|
|
# In every stage, ARG CACHEBUST comes right after the step that installs
|
|
# system packages: script/ passes a new value on every build, which
|
|
# reruns every RUN step after it and keeps that step's layer. node and
|
|
# yarn come from the distribution, which is trusted, so they need no
|
|
# version and no hash.
|
|
#
|
|
# alpine 3.24.3, 2026-11-04
|
|
FROM alpine@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a AS lint
|
|
RUN apk add --no-cache git make nodejs yarn
|
|
ARG CACHEBUST
|
|
|
|
WORKDIR /app
|
|
|
|
COPY script/ script/
|
|
COPY package.json yarn.lock ./
|
|
RUN script/bootstrap
|
|
|
|
COPY . .
|
|
|
|
RUN yarn run prettier --check '**/*.md' --tab-width 4 --prose-wrap always
|
|
|
|
# Test phase, same shape and for the same reason.
|
|
#
|
|
# alpine 3.24.3, 2026-11-04
|
|
FROM alpine@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a AS test
|
|
RUN apk add --no-cache git make nodejs yarn
|
|
ARG CACHEBUST
|
|
|
|
WORKDIR /app
|
|
|
|
COPY script/ script/
|
|
COPY package.json yarn.lock ./
|
|
RUN script/bootstrap
|
|
|
|
COPY . .
|
|
|
|
RUN echo "No tests defined."
|
|
|
|
# Development environment, and the last stage: a plain `docker build .`
|
|
# names no target and so builds this one. Nothing is wanted from the two
|
|
# phases above; the copies are what make BuildKit build them first, so
|
|
# this image cannot be produced unless lint and test passed. A stage
|
|
# appended after this one would drop all three out of a plain build.
|
|
#
|
|
# alpine 3.24.3, 2026-11-04
|
|
FROM alpine@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
|
|
RUN apk add --no-cache git make nodejs yarn
|
|
ARG CACHEBUST
|
|
|
|
WORKDIR /app
|
|
|
|
COPY --from=lint /app/package.json /dev/null
|
|
COPY --from=test /app/package.json /dev/null
|
|
|
|
# script/bootstrap finds the system packages above and installs the node
|
|
# packages.
|
|
COPY script/ script/
|
|
COPY package.json yarn.lock ./
|
|
RUN script/bootstrap
|
|
|
|
COPY . .
|
|
|
|
# Nothing here is compiled and a LABEL cannot run git, so the version is
|
|
# the VERSION build argument that script/docker and script/cibuild pass;
|
|
# a plain `docker build .` leaves it empty.
|
|
ARG VERSION
|
|
LABEL org.opencontainers.image.version="${VERSION}"
|