Two related consequences of the version stamping in #260, both surfaced by its independent review and neither blocking that PR.
1. script/docker diverges from the model script
REPO_POLICIES.md asserts that script/docker is byte-identical across repos. This repo's copy now passes --build-arg VERSION="$(script/version)".
The justification is sound and was ruled so in review: .git is in .dockerignore, so the image cannot derive a version itself, and the value can only be resolved host-side. The alternatives are worse — shipping .git into the build context, or accepting that container builds never carry a version.
But the divergence is real, and patching it locally in every repo is the wrong shape. The durable fix is updating the model script/docker in sneak/prompts so every repo gets version stamping the same way, then re-syncing here. Needs a decision from the owner on the model script, not a local workaround.
2. No green CI run ever exercises a real version stamp
script/cibuild is untouched by #260, so CI-built images stamp unknown. Nothing ships wrong today because no publish workflow exists — but it means the stamping path that matters for a release is never exercised by the gate that is supposed to prove the build works. The same class as #119 (CI reporting on checks it never ran) and #175 (a step named for something it does not do).
This becomes load-bearing the moment a release workflow exists, because that is the workflow that must stamp the tag.
Also noted, pre-existing
The model Dockerfile in REPO_POLICIES.md specifies -trimpath and -s -w; neither is present here. -trimpath is the one that bears on reproducibility across build directories, which the release gate depends on. Not introduced by #260.
Definition of done
A decision on the model script/docker, then this repo re-synced to whatever it becomes — not a local patch.
script/cibuild exercises a real stamp, so the gate proves the path a release will use.
-trimpath evaluated and either adopted or explicitly declined with the reason recorded.
Two related consequences of the version stamping in https://git.eeqj.de/sneak/webhooker/pulls/260, both surfaced by its independent review and neither blocking that PR.
## 1. `script/docker` diverges from the model script
`REPO_POLICIES.md` asserts that `script/docker` is byte-identical across repos. This repo's copy now passes `--build-arg VERSION="$(script/version)"`.
The justification is sound and was ruled so in review: `.git` is in `.dockerignore`, so the image cannot derive a version itself, and the value can only be resolved host-side. The alternatives are worse — shipping `.git` into the build context, or accepting that container builds never carry a version.
But the divergence is real, and patching it locally in every repo is the wrong shape. The durable fix is updating the model `script/docker` in `sneak/prompts` so every repo gets version stamping the same way, then re-syncing here. Needs a decision from the owner on the model script, not a local workaround.
## 2. No green CI run ever exercises a real version stamp
`script/cibuild` is untouched by #260, so CI-built images stamp `unknown`. Nothing ships wrong today because no publish workflow exists — but it means the stamping path that matters for a release is never exercised by the gate that is supposed to prove the build works. The same class as https://git.eeqj.de/sneak/webhooker/issues/119 (CI reporting on checks it never ran) and https://git.eeqj.de/sneak/webhooker/issues/175 (a step named for something it does not do).
This becomes load-bearing the moment a release workflow exists, because that is the workflow that must stamp the tag.
## Also noted, pre-existing
The model Dockerfile in `REPO_POLICIES.md` specifies `-trimpath` and `-s -w`; neither is present here. `-trimpath` is the one that bears on reproducibility across build directories, which the release gate depends on. Not introduced by #260.
## Definition of done
- A decision on the model `script/docker`, then this repo re-synced to whatever it becomes — not a local patch.
- `script/cibuild` exercises a real stamp, so the gate proves the path a release will use.
- `-trimpath` evaluated and either adopted or explicitly declined with the reason recorded.
Plan. The decision this issue waited on has been made upstream: the shared model script/docker and script/cibuild in sneak/prompts now compute the version on the host and pass it as the VERSION build arg, and build with --no-cache (prompts commits of 2026-09-08).
Re-sync script/docker and script/cibuild with the model scripts at https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>, byte for byte, so they are identical across repos again. script/cibuild then stamps a real version, which is the second point here.
Check the version a build stamps is still right with this repo's Dockerfile, which also derives one from the .git in its context since #366; the build arg takes precedence.
-trimpath and -s -w, from the model Dockerfile: adopt them in the binary build through the Makefile, or record here why not.
The README's Entrypoints section describes the two scripts as they now are.
Model: opus-5-5
Plan. The decision this issue waited on has been made upstream: the shared model `script/docker` and `script/cibuild` in `sneak/prompts` now compute the version on the host and pass it as the `VERSION` build arg, and build with `--no-cache` (prompts commits of 2026-09-08).
- Re-sync `script/docker` and `script/cibuild` with the model scripts at `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`, byte for byte, so they are identical across repos again. `script/cibuild` then stamps a real version, which is the second point here.
- Check the version a build stamps is still right with this repo's Dockerfile, which also derives one from the `.git` in its context since https://git.eeqj.de/sneak/webhooker/issues/366; the build arg takes precedence.
- `-trimpath` and `-s -w`, from the model Dockerfile: adopt them in the binary build through the Makefile, or record here why not.
- The README's Entrypoints section describes the two scripts as they now are.
Model: opus-5-5
clawbot
self-assigned this 2026-10-06 01:22:53 +02:00
Covered by #504, which re-vendors the shared files from the newer sneak/prompts commit dd4027b.
Model: opus-5-5
Covered by https://git.eeqj.de/sneak/webhooker/issues/504, which re-vendors the shared files from the newer `sneak/prompts` commit `dd4027b`.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Two related consequences of the version stamping in #260, both surfaced by its independent review and neither blocking that PR.
1.
script/dockerdiverges from the model scriptREPO_POLICIES.mdasserts thatscript/dockeris byte-identical across repos. This repo's copy now passes--build-arg VERSION="$(script/version)".The justification is sound and was ruled so in review:
.gitis in.dockerignore, so the image cannot derive a version itself, and the value can only be resolved host-side. The alternatives are worse — shipping.gitinto the build context, or accepting that container builds never carry a version.But the divergence is real, and patching it locally in every repo is the wrong shape. The durable fix is updating the model
script/dockerinsneak/promptsso every repo gets version stamping the same way, then re-syncing here. Needs a decision from the owner on the model script, not a local workaround.2. No green CI run ever exercises a real version stamp
script/cibuildis untouched by #260, so CI-built images stampunknown. Nothing ships wrong today because no publish workflow exists — but it means the stamping path that matters for a release is never exercised by the gate that is supposed to prove the build works. The same class as #119 (CI reporting on checks it never ran) and #175 (a step named for something it does not do).This becomes load-bearing the moment a release workflow exists, because that is the workflow that must stamp the tag.
Also noted, pre-existing
The model Dockerfile in
REPO_POLICIES.mdspecifies-trimpathand-s -w; neither is present here.-trimpathis the one that bears on reproducibility across build directories, which the release gate depends on. Not introduced by #260.Definition of done
script/docker, then this repo re-synced to whatever it becomes — not a local patch.script/cibuildexercises a real stamp, so the gate proves the path a release will use.-trimpathevaluated and either adopted or explicitly declined with the reason recorded.Plan. The decision this issue waited on has been made upstream: the shared model
script/dockerandscript/cibuildinsneak/promptsnow compute the version on the host and pass it as theVERSIONbuild arg, and build with--no-cache(prompts commits of 2026-09-08).script/dockerandscript/cibuildwith the model scripts athttps://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>, byte for byte, so they are identical across repos again.script/cibuildthen stamps a real version, which is the second point here..gitin its context since #366; the build arg takes precedence.-trimpathand-s -w, from the model Dockerfile: adopt them in the binary build through the Makefile, or record here why not.Model: opus-5-5
Covered by #504, which re-vendors the shared files from the newer
sneak/promptscommitdd4027b.Model: opus-5-5