sneak
b128da7a85
check / check (push) Failing after 1s
On an unchanged tree docker served every check step of the Dockerfile from its build cache, so a second script/cibuild ran no lint, tests or build and still succeeded. script/cibuild now passes the current time as the CHECK_EPOCH build argument. The lint and build stages each declare it after their module download and before `COPY . .`. A build argument whose value changes makes every RUN step after its declaration miss the cache, so the checks run on each build while the base images, the apk install and the module downloads stay cached. Model: opus-5-5
69 lines
2.2 KiB
Docker
69 lines
2.2 KiB
Docker
# Lint stage — fast feedback on formatting and lint issues
|
|
# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
|
|
FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
|
|
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
# script/cibuild sets CHECK_EPOCH to the current time, so every step below
|
|
# runs again on each build, an unchanged tree included, while the steps
|
|
# above stay cached. ARG is per stage: the build stage declares it too.
|
|
ARG CHECK_EPOCH
|
|
|
|
COPY . .
|
|
|
|
RUN make fmt-check
|
|
# Not make lint: script/lint is a docker build, which cannot run in here.
|
|
RUN golangci-lint run --config .golangci.yml ./...
|
|
|
|
# Build stage — tests and compilation
|
|
# golang 1.24.13-alpine (2026-03-10)
|
|
FROM golang@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191 AS builder
|
|
|
|
# Force BuildKit to run the lint stage
|
|
COPY --from=lint /src/go.sum /dev/null
|
|
|
|
RUN apk add --no-cache gcc musl-dev make git gnupg
|
|
|
|
WORKDIR /build
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
# As in the lint stage: the steps below run again on each script/cibuild.
|
|
ARG CHECK_EPOCH
|
|
|
|
COPY . .
|
|
|
|
RUN make test
|
|
|
|
# The version stamped into the binary: the VERSION build argument when one
|
|
# is given, otherwise `git describe --tags --always` of the .git the build
|
|
# context carries: the tag on a tagged commit, tag-N-gHASH on a commit after
|
|
# one, the short commit when no tag is reachable. A context that carries .git
|
|
# and still yields no version fails the build.
|
|
ARG VERSION
|
|
RUN version="${VERSION:-$(git describe --tags --always)}"; \
|
|
if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \
|
|
[ "$version" = unknown ]; }; then \
|
|
echo "no version could be derived although the build context carries .git" >&2; \
|
|
exit 1; \
|
|
fi; \
|
|
make build VERSION="${version:-dev}"
|
|
|
|
# Runtime stage
|
|
# alpine 3.23 (2026-03-10)
|
|
FROM alpine@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
|
|
|
|
RUN apk add --no-cache ca-certificates gnupg
|
|
|
|
RUN adduser -D -s /bin/sh secret
|
|
|
|
COPY --from=builder /build/secret /usr/local/bin/secret
|
|
RUN chmod +x /usr/local/bin/secret
|
|
|
|
USER secret
|
|
WORKDIR /home/secret
|
|
|
|
ENTRYPOINT ["secret"]
|