sneak
3a183aa64b
All checks were successful
check / check (push) Successful in 1m16s
Canonical REPO_POLICIES.md:97 requires Dockerfiles to install development prerequisites by running script/bootstrap rather than duplicating installs inline. The build stage did the opposite: an inline `apk add --no-cache make` and its own `go mod download`, so it maintained a second, independent notion of the toolchain — the local-versus-CI divergence #24 exists to close, reintroduced one layer down. The stage now copies script/ plus go.mod/go.sum and runs script/bootstrap, which ends in `go mod download`. COPY --from=lint /usr/bin/golangci-lint is kept and moved above the bootstrap layer. It is the only edge making this stage depend on the lint stage, so removing it as redundant would silently stop the build gating on lint. Copying it first also puts it on PATH before bootstrap runs, so bootstrap's version check compares the lint stage's linter against the pin on every build: the two stages are now provably one toolchain rather than two that happen to agree, and bootstrap does not pay for a from-source build of its own linter. $GOPATH/bin joins PATH so that if the copied binary ever stops matching the pin, bootstrap's reinstall lands somewhere PATH resolves instead of failing its own verification. All of it sits above ARG CHECK_EPOCH, and the chown and USER builder still precede make check.
4.3 KiB
4.3 KiB