script/docker is no longer byte-identical to the model script, and CI-built images stamp version "unknown" #265
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Two related consequences of the version stamping in #260, both surfaced by its independent review and neither blocking that PR.
1.
script/dockerdiverges from the model scriptREPO_POLICIES.mdasserts thatscript/dockeris byte-identical across repos. This repo's copy now passes--build-arg VERSION="$(script/version)".The justification is sound and was ruled so in review:
.gitis in.dockerignore, so the image cannot derive a version itself, and the value can only be resolved host-side. The alternatives are worse — shipping.gitinto the build context, or accepting that container builds never carry a version.But the divergence is real, and patching it locally in every repo is the wrong shape. The durable fix is updating the model
script/dockerinsneak/promptsso every repo gets version stamping the same way, then re-syncing here. Needs a decision from the owner on the model script, not a local workaround.2. No green CI run ever exercises a real version stamp
script/cibuildis untouched by #260, so CI-built images stampunknown. Nothing ships wrong today because no publish workflow exists — but it means the stamping path that matters for a release is never exercised by the gate that is supposed to prove the build works. The same class as #119 (CI reporting on checks it never ran) and #175 (a step named for something it does not do).This becomes load-bearing the moment a release workflow exists, because that is the workflow that must stamp the tag.
Also noted, pre-existing
The model Dockerfile in
REPO_POLICIES.mdspecifies-trimpathand-s -w; neither is present here.-trimpathis the one that bears on reproducibility across build directories, which the release gate depends on. Not introduced by #260.Definition of done
script/docker, then this repo re-synced to whatever it becomes — not a local patch.script/cibuildexercises a real stamp, so the gate proves the path a release will use.-trimpathevaluated and either adopted or explicitly declined with the reason recorded.