Let a plain docker build pass and stamp the git version (closes #57)

The size tests skip a case whose secret needs more locked memory than the process can lock, found by locking a buffer of that size: memguard panics otherwise, and a plain `docker build .` runs under an 8 MiB RLIMIT_MEMLOCK. script/cibuild, or any process allowed to lock past the limit, runs every case. The build stage stamps the VERSION build argument, else `git describe --tags --always`, and fails when .git is present but yields no version. `make build` stamps `git describe` too instead of the fixed 0.1.0. .dockerignore keeps .git/config out; script/docker is now the canonical copy. Model: opus-5-5 Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>
2026-10-02 14:16:02 +02:00
parent 41cea400a7
commit d52b4f1240
8 changed files with 88 additions and 7 deletions
@@ -1,8 +1,9 @@
 #!/bin/sh
 # script/cibuild: run the CI build. The Dockerfile runs script/check
 # (via make check), so a successful build implies all checks pass.
-# The Gitea workflow runs this on push. The memlock ulimit is required
-# because the test suite uses memguard, which mlocks memory.
+# The Gitea workflow runs this on push. The memlock ulimit lets the tests
+# that lock large secrets in memory (memguard mlocks them) run; under the
+# lower limit of a plain `docker build .` they are skipped.
 set -eu

 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"