Comments and documentation only; the docker build invocation and its three flags are byte-identical and .dockerignore's effective rules are unchanged. script/lint and Dockerfile.lint stated how the shape was derived — why two stages, why `golangci-lint config verify` was omitted, what earlier drafts of the comments claimed. That is in the history. What survives is the three traps, each of which yields a green run over an unlinted or partly linted tree: --target and --no-cache-filter must both stay with $stage matching the stage name in Dockerfile.lint; --target checks that the stage exists, not that it runs golangci-lint, and halts the build there; and .dockerignore decides what reaches the container, so excluding a self-contained Go file drops it from the lint silently. The TODO.md entry loses its "Hardened" and "Corrected" paragraphs, which argued with earlier versions of themselves, and keeps the flags, the durable property, the three unguarded seams, and the evidence that the gate was verified rather than assumed.
668 B
668 B