b101b4e21c
All checks were successful
check / check (pull_request) Successful in 2m13s
Adopt the four remaining upstream CHECK_EPOCH hardening items from sneak/prompts #26, closing the gap #85 left open deliberately. Fail closed on a missing value. Each check stage now asserts `[ -n "$CHECK_EPOCH" ] || exit 1` before running anything. An unset ARG is an empty string and an empty string is a stable cache key, so the second and every later bare `docker build .` on an unchanged tree replayed all three check layers, executed nothing, and still exited 0 -- and `docker build .` is the command REPO_POLICIES.md names verbatim as a thing that must be green, so the documented command was precisely the one that lied. Failed steps are never cached, which is what makes the guard fire on every invocation rather than once. Expand the epoch into each check command rather than leaving it a bare declaration, so the cache miss does not depend on BuildKit's unreferenced-ARG handling staying as it is, and so the value appears in the build log where a reader can see the layer was keyed fresh. Make the epoch unique per invocation rather than per second: `epoch="$(date +%s%N)$$"`. `%N` alone is not enough, since busybox drops it silently and exits 0, handing back second granularity with no warning; `$$` differs between concurrent invocations regardless. The bare-assignment form is kept on purpose -- inlined into an argument, a failing substitution does not abort under `set -eu` and would yield an empty constant epoch, restoring the exact false green this prevents. Pass the same fresh value from script/docker. It is not the CI gate, but local builds are almost always warm, so it was the likelier fooling in practice, and two entrypoints disagreeing about whether the tree is green is worse than either being wrong alone. The ARG placement from #85 is unchanged, below apk add, COPY go.mod go.sum and go mod download, so dependency layers still cache and the build is not cold. Verified by negative control rather than inspection; measurements are recorded once, in the PR verification comment. .golangci.yml, the lint-stage FROM line and its digest, script/lint, REPO_POLICIES.md and .gitea/workflows/check.yml are untouched.
25 lines
932 B
Bash
Executable File
25 lines
932 B
Bash
Executable File
#!/bin/sh
|
|
# script/docker: build the Docker image tagged with the project name.
|
|
# Identical in all repos; the tag comes from script/projectname.
|
|
# Generic: needs no adaptation.
|
|
set -eu
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
|
ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
|
|
|
main() {
|
|
cd "$ROOT"
|
|
# Same CHECK_EPOCH contract as script/cibuild, for the same reason
|
|
# and with the same bare-assignment and `$$` requirements -- see the
|
|
# comments there. This script is not the CI gate, but a local build
|
|
# is almost always warm, so without this it would report a green the
|
|
# tree had not earned and the two entrypoints would disagree about
|
|
# whether the tree is clean. The Dockerfile now refuses to build
|
|
# without a non-empty value, so this is required, not optional.
|
|
epoch="$(date +%s%N)$$"
|
|
docker build --build-arg CHECK_EPOCH="$epoch" \
|
|
-t "$("$SCRIPT_DIR/projectname")" .
|
|
}
|
|
|
|
main "$@"
|