Dockerfile

@@ -20,7 +20,7 @@ RUN golangci-lint run --config .golangci.yml --build-tags recorded ./...
 # needs the C compiler it carries.
 #
 # golang 1.27.1-trixie, 2026-09-19
-FROM golang@sha256:3b77fc618ec235a1ab412de7737f120dd507c57e8d87de4cbb7994fb94275ed5 AS test
+FROM golang@sha256:3b77fc618ec235a1ab412de7737f120dd507c57e8d87de4cbb7994fb94275ed5 AS test-setup
 
 WORKDIR /src
 
@@ -35,20 +35,36 @@ COPY . .
 RUN go mod tidy -diff || \
     { echo "go.mod or go.sum is not tidy: run make tidy" >&2; exit 1; }
 
+# The two passes below are separate stages so that BuildKit runs them at
+# the same time; they share no compiled code, because -race changes every
+# package's build.
+#
 # Go's build cache is kept on a tmpfs, out of the image: nothing uses it
 # after this step, and writing it into the image takes seconds. The tests
 # are built with the no_fs_access tag, as the binary is in the build stage.
+FROM test-setup AS test-race
+
 RUN --mount=type=tmpfs,target=/root/.cache/go-build \
     go test -tags no_fs_access -timeout 90s -race -cover ./... || \
     { echo "--- Rerunning with -v for details ---"; \
       go test -tags no_fs_access -timeout 90s -race -v ./...; exit 1; }
 
 # Second pass: the recorded requests, too slow for make test under -race.
+FROM test-setup AS test-recorded
+
 RUN --mount=type=tmpfs,target=/root/.cache/go-build \
     go test -tags no_fs_access,recorded -timeout 90s -cover -run '^TestOrdinary' ./internal/coreruleset/... || \
     { echo "--- Rerunning with -v for details ---"; \
       go test -tags no_fs_access,recorded -timeout 90s -run '^TestOrdinary' -v ./internal/coreruleset/...; exit 1; }
 
+# The test phase that script/test and the build stage name. Nothing is
+# wanted from the two passes; the copies are what make BuildKit run them.
+# It holds nothing else, so script/test's image takes no time to write.
+FROM scratch AS test
+
+COPY --from=test-race /src/go.sum /src/go.sum
+COPY --from=test-recorded /src/go.sum /src/go.sum
+
 # Tidy stage: `go mod tidy` in the test phase's Go, so that the files it
 # writes pass the test phase's check. Nothing else depends on it, so only
 # script/tidy, which names the stage after it, builds it.