script/lint exports an image it never uses, leaving a dangling image per run #48

New Issue

clawbot · 2026-08-10T15:21:22+02:00

clawbot commented

2026-08-10 15:21:22 +02:00

Found during the review of
#47, non-blocking there.

script/lint runs docker build -f Dockerfile.lint . with neither
-t nor --output=type=cacheonly. The lint result is the build's exit
status; the image itself is never used. Two costs, measured on this
host:

15-21 seconds of every run is image export — pure waste, on a script
that script/check and the pre-commit hook both invoke.
Each run leaves a dangling untagged image. On a shared build host
that accumulates indefinitely.

Definition of done

script/lint stops materialising an image it does not use, e.g.
--output=type=cacheonly, or tagging so each run replaces the last
rather than orphaning it. State which and why.
The lint gates must still demonstrably execute — whatever is chosen
must not reintroduce a cached sub-second success. Prove it the way
the PR did: two consecutive runs on an untouched tree with the
linter executing in both under BUILDKIT_PROGRESS=plain, plus the
control that holding the cache-buster constant brings the false green
back.
Report the before/after timings.
Negative control still works: a planted lint finding fails
script/lint with that specific finding.
Do not prune anything global while testing; this host's build cache
is shared.

Found during the review of https://git.eeqj.de/sneak/sfdupes/pulls/47, non-blocking there. `script/lint` runs `docker build -f Dockerfile.lint .` with neither `-t` nor `--output=type=cacheonly`. The lint result is the build's exit status; the image itself is never used. Two costs, measured on this host: - 15-21 seconds of every run is image export — pure waste, on a script that `script/check` and the pre-commit hook both invoke. - Each run leaves a dangling untagged image. On a shared build host that accumulates indefinitely. ## Definition of done - `script/lint` stops materialising an image it does not use, e.g. `--output=type=cacheonly`, or tagging so each run replaces the last rather than orphaning it. State which and why. - The lint gates must still demonstrably execute — whatever is chosen must not reintroduce a cached sub-second success. Prove it the way the PR did: two consecutive runs on an untouched tree with the linter executing in both under `BUILDKIT_PROGRESS=plain`, plus the control that holding the cache-buster constant brings the false green back. - Report the before/after timings. - Negative control still works: a planted lint finding fails `script/lint` with that specific finding. - Do not prune anything global while testing; this host's build cache is shared.

clawbot added this to the 1.0.0 milestone 2026-08-10 15:21:26 +02:00

clawbot referenced this issue

2026-08-10 15:45:04 +02:00

next #47

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/sfdupes#48