From b128da7a85c6be3700bd0fa6ab5b8969494230da Mon Sep 17 00:00:00 2001
From: sneak <sneak@sneak.berlin>
Date: Sun, 4 Oct 2026 09:33:49 +0000
Subject: [PATCH] Run the checks again on every script/cibuild (closes #54)

On an unchanged tree docker served every check step of the Dockerfile
from its build cache, so a second script/cibuild ran no lint, tests or
build and still succeeded.

script/cibuild now passes the current time as the CHECK_EPOCH build
argument. The lint and build stages each declare it after their module
download and before `COPY . .`. A build argument whose value changes
makes every RUN step after its declaration miss the cache, so the
checks run on each build while the base images, the apk install and the
module downloads stay cached.

Model: opus-5-5
---
 Dockerfile     | 8 ++++++++
 README.md      | 3 ++-
 TODO.md        | 8 ++++++++
 script/cibuild | 6 +++++-
 4 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index df5ea97..99f5bc5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,6 +6,11 @@ WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 
+# script/cibuild sets CHECK_EPOCH to the current time, so every step below
+# runs again on each build, an unchanged tree included, while the steps
+# above stay cached. ARG is per stage: the build stage declares it too.
+ARG CHECK_EPOCH
+
 COPY . .
 
 RUN make fmt-check
@@ -25,6 +30,9 @@ WORKDIR /build
 COPY go.mod go.sum ./
 RUN go mod download
 
+# As in the lint stage: the steps below run again on each script/cibuild.
+ARG CHECK_EPOCH
+
 COPY . .
 
 RUN make test
diff --git a/README.md b/README.md
index 2c2bfaa..2ef45c3 100644
--- a/README.md
+++ b/README.md
@@ -521,7 +521,8 @@ them. We provide:
 - `script/docker` — build the Docker image tagged with the project name
 - `script/cibuild` — CI entrypoint: `docker build --ulimit
   memlock=-1:-1 .` (memguard needs mlock; the Dockerfile runs the
-  checks)
+  checks), with a new `CHECK_EPOCH` build argument on every run so the
+  checks run again on an unchanged tree
 - `script/precommit` — pre-commit checks: `go mod tidy` verification,
   then `script/check`
 - `script/install-precommit` — install the git pre-commit hook that
diff --git a/TODO.md b/TODO.md
index 3612f96..b8dd593 100644
--- a/TODO.md
+++ b/TODO.md
@@ -25,6 +25,14 @@ Bring the repo into policy compliance in one commit:
 
 # Completed Steps
 
+- 2026-10-04: `script/cibuild` runs the checks again on an unchanged
+  tree (https://git.eeqj.de/sneak/secret/issues/54). It passes the
+  current time as the `CHECK_EPOCH` build argument, which both the lint
+  and the build stage of the `Dockerfile` declare after their module
+  download, so every step from `COPY . .` on runs on each build while
+  the base images and module downloads stay cached. Before, a second run
+  on the same tree took every check from the build cache and reported
+  success having run nothing.
 - 2026-10-04: `secret get` keeps the secret in locked memory until it
   writes it out (https://git.eeqj.de/sneak/secret/issues/37):
   `Vault.GetSecret` and `Vault.GetSecretVersion` return a
diff --git a/script/cibuild b/script/cibuild
index 3316194..58bf15f 100755
--- a/script/cibuild
+++ b/script/cibuild
@@ -4,13 +4,17 @@
 # The Gitea workflow runs this on push. The memlock ulimit lets the tests
 # that lock large secrets in memory (memguard mlocks them) run; under the
 # lower limit of a plain `docker build .` they are skipped.
+# A cached build checks nothing: a new CHECK_EPOCH on every run makes the
+# Dockerfile's check steps run again on an unchanged tree, while its base
+# images and module downloads stay cached.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build --ulimit memlock=-1:-1 .
+    docker build --ulimit memlock=-1:-1 \
+        --build-arg CHECK_EPOCH="$(date +%s)" .
 }
 
 main "$@"