Leave out of the build context what the app's .dockerignore names (closes #274)

Docker does not apply an app's `.dockerignore` to a build context sent as a tar, which is how upaas sends it, so every file in the clone, `.git/config` included, reached the build.

upaas now reads the ignore file as `docker build` does, with the `ignorefile` reader of `github.com/moby/patternmatcher`, and leaves those files out of the tar: an ignore file named after the Dockerfile and next to it, such as `Dockerfile.dockerignore`, otherwise `.dockerignore` at the root of the clone. The Dockerfile path is read as a path inside the clone, and the Dockerfile (or the lowercase `dockerfile` Docker builds when `Dockerfile` is missing) and the ignore file always stay in. An app without an ignore file builds as before.

Not handled: a Dockerfile that is a symlink to an ignored file fails the build.

Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>

internal/docker/buildcontext_test.go

@@ -68,32 +68,6 @@ func TestPerformBuildFollowsDockerignore(t *testing.T) {
 			},
 			want: []string{defaultDockerignoreName, defaultDockerfileName, testMainGo},
 		},
-		{
-			name:       "keeps a lowercase dockerfile built in place of a missing Dockerfile",
-			dockerfile: defaultDockerfileName,
-			files: map[string]string{
-				defaultDockerignoreName: "*\n",
-				testLowercaseDockerfile: "",
-			},
-			want: []string{defaultDockerignoreName, testLowercaseDockerfile},
-		},
-		{
-			name:       "reads a lowercase dockerfile's own ignore file",
-			dockerfile: defaultDockerfileName,
-			files: map[string]string{
-				defaultDockerignoreName:   "main.go\n",
-				testLowercaseDockerfile:   "",
-				"dockerfile.dockerignore": "secret.txt\n",
-				testMainGo:                "",
-				testSecretFile:            "",
-			},
-			want: []string{
-				defaultDockerignoreName,
-				testLowercaseDockerfile,
-				"dockerfile.dockerignore",
-				testMainGo,
-			},
-		},
 		{
 			name:       "an ignore file next to the Dockerfile wins over .dockerignore",
 			dockerfile: testDeployDockerfile,
@@ -132,6 +106,62 @@ func TestPerformBuildFollowsDockerignore(t *testing.T) {
 	}
 }
 
+// TestPerformBuildKeepsLowercaseDockerfile checks that when the Dockerfile
+// named Dockerfile is missing, the lowercase dockerfile Docker builds instead
+// stays in the build context, and its own ignore file is read.
+func TestPerformBuildKeepsLowercaseDockerfile(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name  string
+		files map[string]string // path in the context: contents
+		want  []string          // files sent in the build context
+	}{
+		{
+			name: "kept when the ignore file names it",
+			files: map[string]string{
+				defaultDockerignoreName: "*\n",
+				testLowercaseDockerfile: "",
+			},
+			want: []string{defaultDockerignoreName, testLowercaseDockerfile},
+		},
+		{
+			name: "its own ignore file wins over .dockerignore",
+			files: map[string]string{
+				defaultDockerignoreName:   "main.go\n",
+				testLowercaseDockerfile:   "",
+				"dockerfile.dockerignore": "secret.txt\n",
+				testMainGo:                "",
+				testSecretFile:            "",
+			},
+			want: []string{
+				defaultDockerignoreName,
+				testLowercaseDockerfile,
+				"dockerfile.dockerignore",
+				testMainGo,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			contextDir := t.TempDir()
+			writeFiles(t, contextDir, tt.files)
+
+			got, err := buildContextFiles(t, contextDir, defaultDockerfileName)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if !slices.Equal(got, tt.want) {
+				t.Errorf("build context holds %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
 // TestPerformBuildReadsDockerfilePathInsideContext checks that ./Dockerfile
 // and /Dockerfile name the Dockerfile at the root of the context, as Docker
 // reads them, so an ignore file that names the Dockerfile does not leave it