From 60d7b97a8ddc3ae87fd326825c95a9b49ff4081d Mon Sep 17 00:00:00 2001
From: sneak <sneak@sneak.berlin>
Date: Sun, 4 Oct 2026 14:21:37 +0000
Subject: [PATCH] Stop script/lint writing an image it never uses (closes #48)

script/lint builds Dockerfile.lint only for the exit status, but every
run exported the result as an image: seconds spent exporting, and one
untagged image left behind each time. It now builds with
--output=type=cacheonly, so nothing is exported. CHECK_EPOCH still
changes on every run, so the gate steps still run each time; the build
cache is kept as before.

Model: opus-5-5
---
 README.md   | 4 +++-
 TODO.md     | 3 +++
 script/lint | 5 +++++
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 98d7024..824bef5 100644
--- a/README.md
+++ b/README.md
@@ -831,7 +831,9 @@ and may be invoked directly. The provided entrypoints are:
     copies the repository into the digest-pinned
     `golangci/golangci-lint` image and runs
     `golangci-lint config verify` and `golangci-lint run` as build
-    steps, so a successful build is a clean lint. The linter is never
+    steps, so a successful build is a clean lint. That exit status is
+    all it produces, so it runs with `--output=type=cacheonly` and
+    writes no image; a run leaves only build cache. The linter is never
     run on the host, which makes a working `docker` the one
     prerequisite for linting — and therefore for `make check` and the
     pre-commit hook. Offline machines: the gate steps themselves make
diff --git a/TODO.md b/TODO.md
index 2e1fa6b..06d931a 100644
--- a/TODO.md
+++ b/TODO.md
@@ -29,6 +29,9 @@
 
 # Completed Steps
 
+- `script/lint` writes no image, so a run no longer leaves an untagged
+  one behind (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/48)
+
 - tests cover a missing database, `scan` keeping stdout empty, its skip
   warning, the `report` and `trees` summary lines, and every subcommand
   going through `runE` (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/16)
diff --git a/script/lint b/script/lint
index d402d8a..20b021a 100755
--- a/script/lint
+++ b/script/lint
@@ -14,6 +14,10 @@
 # 0 in well under a second having run no linter. The PID is in the value
 # as well as the epoch because two lint runs land inside the same second
 # easily, and `date +%s` alone would cache the second one.
+#
+# The result is the build's exit status and the image is never used, so
+# --output=type=cacheonly writes none. Without it every run spends
+# seconds exporting an image and leaves it behind untagged.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -22,6 +26,7 @@ main() {
     cd "$ROOT"
     docker build \
         --build-arg CHECK_EPOCH="$(date +%s)-$$" \
+        --output=type=cacheonly \
         -f Dockerfile.lint \
         .
 }
-- 
2.54.0