sneak/webhooker
1
0
Fork 0
Code Issues 67 Pull Requests Actions Packages Projects Releases Wiki Activity

script/docker is no longer byte-identical to the model script, and CI-built images stamp version "unknown" #265

New Issue
Open
opened 2026-08-24 01:48:03 +02:00 by clawbot · 0 comments
clawbot commented 2026-08-24 01:48:03 +02:00
Collaborator
Copy Link
Copy Source

Two related consequences of the version stamping in #260, both surfaced by its independent review and neither blocking that PR.

1. script/docker diverges from the model script

REPO_POLICIES.md asserts that script/docker is byte-identical across repos. This repo's copy now passes --build-arg VERSION="$(script/version)".

The justification is sound and was ruled so in review: .git is in .dockerignore, so the image cannot derive a version itself, and the value can only be resolved host-side. The alternatives are worse — shipping .git into the build context, or accepting that container builds never carry a version.

But the divergence is real, and patching it locally in every repo is the wrong shape. The durable fix is updating the model script/docker in sneak/prompts so every repo gets version stamping the same way, then re-syncing here. Needs a decision from the owner on the model script, not a local workaround.

2. No green CI run ever exercises a real version stamp

script/cibuild is untouched by #260, so CI-built images stamp unknown. Nothing ships wrong today because no publish workflow exists — but it means the stamping path that matters for a release is never exercised by the gate that is supposed to prove the build works. The same class as #119 (CI reporting on checks it never ran) and #175 (a step named for something it does not do).

This becomes load-bearing the moment a release workflow exists, because that is the workflow that must stamp the tag.

Also noted, pre-existing

The model Dockerfile in REPO_POLICIES.md specifies -trimpath and -s -w; neither is present here. -trimpath is the one that bears on reproducibility across build directories, which the release gate depends on. Not introduced by #260.

Definition of done

  • A decision on the model script/docker, then this repo re-synced to whatever it becomes — not a local patch.
  • script/cibuild exercises a real stamp, so the gate proves the path a release will use.
  • -trimpath evaluated and either adopted or explicitly declined with the reason recorded.
Two related consequences of the version stamping in https://git.eeqj.de/sneak/webhooker/pulls/260, both surfaced by its independent review and neither blocking that PR. ## 1. `script/docker` diverges from the model script `REPO_POLICIES.md` asserts that `script/docker` is byte-identical across repos. This repo's copy now passes `--build-arg VERSION="$(script/version)"`. The justification is sound and was ruled so in review: `.git` is in `.dockerignore`, so the image cannot derive a version itself, and the value can only be resolved host-side. The alternatives are worse — shipping `.git` into the build context, or accepting that container builds never carry a version. But the divergence is real, and patching it locally in every repo is the wrong shape. The durable fix is updating the model `script/docker` in `sneak/prompts` so every repo gets version stamping the same way, then re-syncing here. Needs a decision from the owner on the model script, not a local workaround. ## 2. No green CI run ever exercises a real version stamp `script/cibuild` is untouched by #260, so CI-built images stamp `unknown`. Nothing ships wrong today because no publish workflow exists — but it means the stamping path that matters for a release is never exercised by the gate that is supposed to prove the build works. The same class as https://git.eeqj.de/sneak/webhooker/issues/119 (CI reporting on checks it never ran) and https://git.eeqj.de/sneak/webhooker/issues/175 (a step named for something it does not do). This becomes load-bearing the moment a release workflow exists, because that is the workflow that must stamp the tag. ## Also noted, pre-existing The model Dockerfile in `REPO_POLICIES.md` specifies `-trimpath` and `-s -w`; neither is present here. `-trimpath` is the one that bears on reproducibility across build directories, which the release gate depends on. Not introduced by #260. ## Definition of done - A decision on the model `script/docker`, then this repo re-synced to whatever it becomes — not a local patch. - `script/cibuild` exercises a real stamp, so the gate proves the path a release will use. - `-trimpath` evaluated and either adopted or explicitly declined with the reason recorded.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
merge-ready
needs-checks
needs-rebase
needs-review
needs-rework
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/webhooker#265