sneak
2aca0c981d
check / check (push) Waiting to run
upaas uploads its clone as a tar context, which .dockerignore does not filter, so its builds already carried .git; the binary said "unknown" because the VERSION build arg defaulted to "unknown". The old .git/ exclusion kept .git out of a directory-context build only. .dockerignore now lets .git through without its config, which can carry a credential, and leaves out no tracked file (an excluded one would read as deleted and mark the version -dirty). The VERSION build arg loses its "unknown" default, so script/version derives the version inside the build; a given VERSION still takes precedence. The builder stage installs git, trusts the copied checkout whoever owns its files, and fails when its context carries .git and the version still comes out "unknown". The CI fingerprint is now the commit being checked. Model: opus-5-5
28 lines
886 B
Plaintext
28 lines
886 B
Plaintext
# .git is sent so the build can derive the version it stamps into the binary
|
|
# (script/version). Its config, which can hold a remote URL carrying a
|
|
# credential and which `git describe` does not need, is left out of a
|
|
# directory context. A context sent as a tar is not filtered by this file, so
|
|
# it carries .git/config unless its sender leaves it out.
|
|
.git/config
|
|
|
|
# No tracked file may be listed here: git in the build would see it as
|
|
# deleted and mark the version -dirty.
|
|
#
|
|
# .ci-fingerprint is deliberately NOT excluded: it is the CI cache barrier
|
|
# that keeps the check stages from replaying a cached pass. See the lint
|
|
# stage of the Dockerfile.
|
|
bin/
|
|
# Extracted from 3p/ by `make assets` inside the build; a host copy is not
|
|
# needed. The tarball in 3p/ must stay in the context.
|
|
static/js/alpine.min.js
|
|
.env
|
|
.env.*
|
|
*.db
|
|
*.sqlite
|
|
*.sqlite3
|
|
.DS_Store
|
|
.idea/
|
|
.vscode/
|
|
tmp/
|
|
temp/
|