Rename LINT_EPOCH to CHECK_EPOCH in Dockerfile.lint (blocked on a policy ruling) #32

New Issue

2026-08-10T15:01:43+02:00

clawbot commented

2026-08-10 15:01:43 +02:00

Problem

Dockerfile.lint (landed by #30) names its cache-busting build arg LINT_EPOCH, while the main Dockerfile uses CHECK_EPOCH.

Functionally this is fine — both are fail-closed guards and both provably bust their layers. The cost is not correctness, it is verifiability across repos: the canonical policy fixes the name at CHECK_EPOCH precisely so that a single grep can prove every image in every repo busts its cache, and a second name is invisible to that grep.

Blocked

Do not implement this yet. The proposed policy wording is in sneak/prompts#43 and the question — whether the epoch arg name is uniform across files or per-file — is open on sneak/prompts#40. If the ruling is per-file, this issue closes as wontfix.

Definition of done, if the ruling is "uniform"

Dockerfile.lint and script/lint use CHECK_EPOCH.
script/lint with no build arg still fails closed — an unset ARG is the empty string, which is a perfectly stable cache key, so the guard must reject it rather than serve a cached green.
The existing test asserting the guard still passes, and still fails if the guard is removed.
make check green; script/cibuild green and shown to have actually executed rather than been served from cache.

Not a 1.0.0 blocker.

## Problem `Dockerfile.lint` (landed by https://git.eeqj.de/sneak/quak/issues/30) names its cache-busting build arg `LINT_EPOCH`, while the main `Dockerfile` uses `CHECK_EPOCH`. Functionally this is fine — both are fail-closed guards and both provably bust their layers. The cost is not correctness, it is verifiability across repos: the canonical policy fixes the name at `CHECK_EPOCH` precisely so that a single grep can prove every image in every repo busts its cache, and a second name is invisible to that grep. ## Blocked Do not implement this yet. The proposed policy wording is in https://git.eeqj.de/sneak/prompts/pulls/43 and the question — whether the epoch arg name is uniform across files or per-file — is open on https://git.eeqj.de/sneak/prompts/issues/40. If the ruling is per-file, this issue closes as wontfix. ## Definition of done, if the ruling is "uniform" - `Dockerfile.lint` and `script/lint` use `CHECK_EPOCH`. - `script/lint` with no build arg still fails closed — an unset `ARG` is the empty string, which is a perfectly stable cache key, so the guard must reject it rather than serve a cached green. - The existing test asserting the guard still passes, and still fails if the guard is removed. - `make check` green; `script/cibuild` green and shown to have actually executed rather than been served from cache. Not a 1.0.0 blocker.

clawbot referenced this issue

2026-08-10 15:20:50 +02:00

Run all linting in Docker via Dockerfile.lint (closes #30) #31

clawbot referenced this issue

2026-08-10 15:23:38 +02:00

`lint-once.test.ts` misses the path CI actually runs, and its lockfile assertion checks the wrong branch #33

clawbot referenced this issue

2026-08-10 15:42:11 +02:00

Run all linting in Docker via Dockerfile.lint (closes #30) #31

clawbot referenced this issue

2026-08-10 15:59:34 +02:00

Run all linting in Docker via Dockerfile.lint (closes #30) #31