964fc29ed3
All checks were successful
check / check (push) Successful in 1m50s
script/cibuild and script/docker were bare docker build invocations with no cache control, and the Dockerfile copies the tree before running its gates. On an unchanged tree Docker served those layers from cache, so the gates never executed and the build still exited 0. A merge commit here has a tree byte-identical to the branch head it merges, so every merge CI run was almost certainly a full cache hit, and PR #31's reviewer caught make docker returning success as a 17-layer cache hit that proved nothing. Declare ARG CHECK_EPOCH in both stages and have the scripts pass --build-arg CHECK_EPOCH="$(date +%s)". ARG is scoped per stage and this Dockerfile has three gates across two of them (make fmt-check and make lint in the lint stage, make check in the build stage), so one declaration would have left a stage silently cacheable. BuildKit hashes the expanded command rather than the declaration, so each gate RUN echoes the epoch: an unreferenced ARG invalidates nothing, and the echo doubles as evidence in the build log that the layer really ran. Both declarations sit below the dependency layers, so the pinned base images, go mod download, apk add and the source copies keep their cache and only the gates go cold. The build-stage declaration sits after USER, so the drop to the unprivileged builder user still happens before make check and the chmod(0) permission tests stay real.
26 lines
815 B
Bash
Executable File
26 lines
815 B
Bash
Executable File
#!/bin/sh
|
|
# script/docker: build the Docker image tagged with the project name.
|
|
# The tag comes from script/projectname.
|
|
#
|
|
# CHECK_EPOCH is passed for the same reason script/cibuild passes it:
|
|
# without it Docker serves the Dockerfile's gate layers from cache on an
|
|
# unchanged tree and this exits 0 having run neither the lint stage nor
|
|
# the builder stage's make check. This is the gate a developer or
|
|
# reviewer runs by hand, so a cached pass here is the most misleading
|
|
# result the repo can produce. Dependency layers sit above the ARG and
|
|
# stay cached.
|
|
set -eu
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
|
ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
|
|
|
main() {
|
|
cd "$ROOT"
|
|
docker build \
|
|
--build-arg CHECK_EPOCH="$(date +%s)" \
|
|
-t "$("$SCRIPT_DIR/projectname")" \
|
|
.
|
|
}
|
|
|
|
main "$@"
|