Run the linter only in Docker (closes #20)

script/lint now builds only the lint stage of the Dockerfile, without
the build cache, so every run executes the linter; the image is tagged
simplelog-lint. The lint stage calls golangci-lint directly, since make
lint is itself a docker build of that stage. script/cibuild and
script/docker also build without the cache, so their check steps always
run. script/fmt no longer runs golangci-lint --fix, and script/bootstrap
no longer installs it. golangci-lint config verify is left out, on the
owner's ruling. The README, TODO.md and the script/cibuild comment say
what now runs.

Model: opus-5-5

Dockerfile

@@ -6,7 +6,7 @@ COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 RUN make fmt-check
-# Called directly: make lint is itself a docker build (Dockerfile.lint).
+# Called directly: make lint is itself a docker build of this stage.
 RUN golangci-lint run --config .golangci.yml ./...
 
 # Test stage: run full test suite

Dockerfile.lint

@@ -1,13 +0,0 @@
-# Built by script/lint. The build runs golangci-lint, so a successful build
-# is a clean lint.
-#
-# `golangci-lint config verify` is left out on purpose: it downloads its
-# schema over the network on every run, unpinned.
-#
-# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
-FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240
-WORKDIR /src
-COPY go.mod go.sum ./
-RUN go mod download
-COPY . .
-RUN golangci-lint run --config .golangci.yml ./...

README.md

@@ -121,17 +121,18 @@ alpine. We provide:
 - `script/projectname` — output the project name (our own extension); used by
   `script/docker` for the image tag
 - `script/test` — run the test suite (`go test -v ./...`)
-- `script/lint` — run golangci-lint in Docker by building `Dockerfile.lint`
-  without the build cache, so every run lints; keeps no image
+- `script/lint` — run golangci-lint in Docker by building only the `lint`
+  stage of the `Dockerfile` (which also runs the format check), without the
+  build cache, so every run lints; the image is tagged `simplelog-lint`
 - `script/fmt` — format all files with goimports (writes)
 - `script/fmt-check` — check formatting (read-only); fails if `gofmt -l`
   reports files
 - `script/check` — run all checks: `test`, `lint`, `fmt-check` (our own
   extension)
-- `script/docker` — build the Docker image, tagged via `script/projectname`
-  (byte-identical across repos)
-- `script/cibuild` — cd to the repo root and `docker build .` (what CI runs;
-  the image build runs the checks)
+- `script/docker` — build the Docker image without the build cache, tagged
+  via `script/projectname` (byte-identical across repos)
+- `script/cibuild` — cd to the repo root and `docker build --no-cache .` (what
+  CI runs; the image build runs the checks)
 - `script/precommit` — run by the git pre-commit hook (our own extension);
   runs a `go mod tidy` guard, then `script/check`
 - `script/install-precommit` — installs the git pre-commit hook (our own

TODO.md

@@ -24,9 +24,10 @@ files it depends on: .golangci.yml, REPO_POLICIES.md, .editorconfig,
 
 # Completed Steps
 
-* 2026-10-06: the linter runs only in Docker: `script/lint` builds
-    `Dockerfile.lint` without the build cache, and `script/bootstrap` no
-    longer installs golangci-lint
+* 2026-10-06: the linter runs only in Docker: `script/lint` builds the
+    `lint` stage of the `Dockerfile`, every `docker build` in `script/`
+    runs without the build cache, and `script/bootstrap` no longer
+    installs golangci-lint
 * 2026-08-10: fixed every handler discarding slog attributes: console,
     JSON and webhook handlers now emit record attributes, accumulate
     WithAttrs without mutating the receiver, and honour WithGroup;

script/cibuild

@@ -1,13 +1,14 @@
 #!/bin/sh
 # script/cibuild: run the CI build. The Dockerfile runs the format check,
 # the linter and the tests, so a successful build means they all pass.
+# --no-cache because a cached check step is a check that did not run.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build .
+    docker build --no-cache .
 }
 
 main "$@"

script/docker

@@ -1,6 +1,7 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
 # Identical in all repos; the tag comes from script/projectname.
+# --no-cache because a cached check step is a check that did not run.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -8,7 +9,7 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build -t "$("$SCRIPT_DIR/projectname")" .
+    docker build --no-cache -t "$("$SCRIPT_DIR/projectname")" .
 }
 
 main "$@"

script/lint

@@ -1,15 +1,19 @@
 #!/bin/sh
-# script/lint: run the linter, in docker only, by building Dockerfile.lint;
-# the build fails on any finding. --no-cache makes every run execute the
-# linter: a cached build of an unchanged tree succeeds without linting
-# anything. --output type=cacheonly keeps no image.
+# script/lint: run the linter, in docker only, by building the lint stage
+# of the Dockerfile and nothing else; the build fails on any finding.
+# --no-cache makes every run execute the linter: a cached build of an
+# unchanged tree succeeds without linting anything. The tag makes each
+# build replace the previous image instead of leaving an untagged one.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build --no-cache --output type=cacheonly -f Dockerfile.lint .
+    docker build --no-cache \
+        --target lint \
+        -t "$("$SCRIPT_DIR/projectname")-lint" .
 }
 
 main "$@"