sneak/secret
1
0
Fork 0
Code Issues 8 Pull Requests 4 Actions 59 Packages Projects Releases Wiki Activity
200 Commits 5 Branches 0 Tags
62967f28d0fb8a137b73e5053603c6433b10e7b5
Commit Graph
3 Commits
Author SHA1 Message Date
clawbot eb596b8be6 Run the checks again on every script/cibuild (closes #54)
check / check (push) Waiting to run
Details 
On an unchanged tree docker served every check step of the Dockerfile
from its build cache, so a second script/cibuild ran no lint, tests or
build and still succeeded.

script/cibuild now passes the current time as the CHECK_EPOCH build
argument. The lint and build stages each declare it after their module
download and before `COPY . .`. A build argument whose value changes
makes every RUN step after its declaration miss the cache, so the
checks run on each build while the base images, the apk install and the
module downloads stay cached.

Model: opus-5-5
 2026-10-04 13:25:24 +02:00
clawbot d52b4f1240 Let a plain docker build pass and stamp the git version (closes #57)
check / check (push) Successful in 1m1s
Details 
The size tests skip a case whose secret needs more locked memory than
the process can lock, found by locking a buffer of that size: memguard
panics otherwise, and a plain `docker build .` runs under an 8 MiB
RLIMIT_MEMLOCK. script/cibuild, or any process allowed to lock past the
limit, runs every case.

The build stage stamps the VERSION build argument, else
`git describe --tags --always`, and fails when .git is present but
yields no version. `make build` stamps `git describe` too instead of
the fixed 0.1.0. .dockerignore keeps .git/config out; script/docker is
now the canonical copy.

Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>
 2026-10-02 14:16:02 +02:00
sneak e0e5ae68a4 scripts-to-rule-them-all (#26)
check / check (push) Successful in 38s
Details 
Reviewed-on: #26
Co-authored-by: sneak <sneak@sneak.berlin>
Co-committed-by: sneak <sneak@sneak.berlin>
 2026-07-07 02:13:44 +02:00