Dockerfile is pinned by manifest-list digest, dependabot bumps it, and no gate
ever builds it. A bump can land that does not compile and nothing would say so
until somebody tried the image by hand.
$ grep -rl 'Dockerfile' tests/ scripts/ .github/workflows/
$ echo "exit $?"
exit 1
Nothing matches. The one job that sounds like it would is not a gate and says so
in its own comment:
$ sed -n '9,12p' .github/workflows/e2e.yml
# 2. `container-smoke`: developer guidance only — NOT a CI gate. Runs
# on workflow_dispatch only. Boots Ollama and the daemon directly in
# the runner, pulls llama3.2:3b, and runs the 14 read-only user stories.
container-smoke boots the daemon in the runner rather than building the image,
so even on a manual dispatch it does not exercise the Dockerfile.
Why it matters
The file carries a build of the whole workspace and a non-root runtime user, and
both are load-bearing:
$ sed -n '9,12p' Dockerfile
FROM docker.io/library/rust:1-bookworm@sha256:82150a52... AS builder
I built it by hand while reviewing #437, which bumps that digest from rust
1.98.0 to 1.98.1. It builds and the result is correct:
$ podman build --network=host -t sk-probe -f Dockerfile .
Successfully tagged localhost/sk-probe:1
$ podman run --rm --entrypoint sysknife sk-probe --version
sysknife 0.16.0
$ podman run --rm --entrypoint sh sk-probe -c id
uid=10001(sysknife) gid=10001(sysknife) groups=10001(sysknife)
That took one command. Nothing in CI runs it.
Scope
- Add a job that builds
Dockerfile and runs the produced binary. Building it
is most of the value; asserting sysknife --version and the non-root uid
costs two more lines and catches the cases where the build succeeds and the
image is wrong.
- Decide what triggers it. A full workspace build in CI is not free, so
paths: [Dockerfile, Cargo.lock, 'crates/**', 'apps/sysknife-cli/**'] is the
honest set, and say in the PR why anything you leave out cannot break it.
- Decide whether it is a required check. A dependabot digest bump is the case
this exists for, and those land without a human reading them, so I lean
toward required. Argue the other way if the build time makes that painful.
- The job must fail when the image is wrong, not only when the build errors.
Assert on the version string and the uid, and show both failing.
Tests first
Prove the job can go red before you make it green. Point the FROM at a digest
that cannot build (an older Debian without the toolchain the workspace needs, or
a deliberately wrong one in a scratch branch), show CI red, then restore it.
Paste both runs. A job whose red path was never seen is a job nobody has tested.
Difficulty
medium. The workflow is short; the judgement about triggers and required
status is the work, and a full Rust build in a new job wants a cache to be
tolerable.
Getting started
CONTRIBUTING.md
has the build and test commands. No CLA and no copyright waiver. The project is MIT.
Dockerfileis pinned by manifest-list digest, dependabot bumps it, and no gateever builds it. A bump can land that does not compile and nothing would say so
until somebody tried the image by hand.
Nothing matches. The one job that sounds like it would is not a gate and says so
in its own comment:
container-smokeboots the daemon in the runner rather than building the image,so even on a manual dispatch it does not exercise the Dockerfile.
Why it matters
The file carries a build of the whole workspace and a non-root runtime user, and
both are load-bearing:
I built it by hand while reviewing #437, which bumps that digest from rust
1.98.0 to 1.98.1. It builds and the result is correct:
That took one command. Nothing in CI runs it.
Scope
Dockerfileand runs the produced binary. Building itis most of the value; asserting
sysknife --versionand the non-root uidcosts two more lines and catches the cases where the build succeeds and the
image is wrong.
paths: [Dockerfile, Cargo.lock, 'crates/**', 'apps/sysknife-cli/**']is thehonest set, and say in the PR why anything you leave out cannot break it.
this exists for, and those land without a human reading them, so I lean
toward required. Argue the other way if the build time makes that painful.
Assert on the version string and the uid, and show both failing.
Tests first
Prove the job can go red before you make it green. Point the
FROMat a digestthat cannot build (an older Debian without the toolchain the workspace needs, or
a deliberately wrong one in a scratch branch), show CI red, then restore it.
Paste both runs. A job whose red path was never seen is a job nobody has tested.
Difficulty
medium. The workflow is short; the judgement about triggers and requiredstatus is the work, and a full Rust build in a new job wants a cache to be
tolerable.
Getting started
CONTRIBUTING.md
has the build and test commands. No CLA and no copyright waiver. The project is MIT.