From fe20340fba74cbc0c4c9394f2a6e8b7eef94b88c Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Sun, 16 Aug 2026 15:23:41 -0700 Subject: [PATCH] =?UTF-8?q?fix(ci-image):=20the=20dependency=20layer=20car?= =?UTF-8?q?ries=20patches/=20=E2=80=94=20bun=20install=20needs=20the=20pat?= =?UTF-8?q?ch=20files=20the=20lock=20declares?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit bun.lock's patchedDependencies (playwright-core windowsHide) made 'bun install --frozen-lockfile' fail inside the image build: the Dockerfile copied package.json + bun.lock but not patches/. The image-tag hash in all three workflows (ci-image, evals, evals-periodic — kept in lockstep) now includes patches/** so editing a patch rebuilds the layer instead of serving a stale cache. Verified: the exact COPY set (package.json + bun.lock + patches) installs clean in a Linux container; without patches it reproduces the CI failure. Co-Authored-By: Claude Fable 5 --- .github/docker/Dockerfile.ci | 5 +++++ .github/workflows/ci-image.yml | 2 +- .github/workflows/evals-periodic.yml | 2 +- .github/workflows/evals.yml | 2 +- 4 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/docker/Dockerfile.ci b/.github/docker/Dockerfile.ci index fed221005..550c90d3a 100644 --- a/.github/docker/Dockerfile.ci +++ b/.github/docker/Dockerfile.ci @@ -104,7 +104,12 @@ RUN for i in 1 2 3; do \ # resolution. Without bun.lock here, bun install resolved transitive deps # differently in CI vs local (observed on v1.28.0.0: socks landed but # smart-buffer + ip-address didn't make it into the cached node_modules). +# patches/ rides along: bun.lock's patchedDependencies (playwright-core +# windowsHide, v1.67) makes install fail without the patch files present — +# and the workflows' image-tag hash includes patches/** so editing a patch +# rebuilds this layer. COPY package.json bun.lock /workspace/ +COPY patches /workspace/patches WORKDIR /workspace RUN bun install --frozen-lockfile && rm -rf /tmp/* diff --git a/.github/workflows/ci-image.yml b/.github/workflows/ci-image.yml index daa87761b..66ed42660 100644 --- a/.github/workflows/ci-image.yml +++ b/.github/workflows/ci-image.yml @@ -29,7 +29,7 @@ jobs: # This is the tag the eval matrix looks up first — without pushing it # here, the weekly/main prebuild never warms the cache that matters. - id: meta - run: echo "tag=ghcr.io/${{ github.repository }}/ci:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock') }}" >> "$GITHUB_OUTPUT" + run: echo "tag=ghcr.io/${{ github.repository }}/ci:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock', 'patches/**') }}" >> "$GITHUB_OUTPUT" - uses: docker/login-action@v4 with: diff --git a/.github/workflows/evals-periodic.yml b/.github/workflows/evals-periodic.yml index 7a08ad02f..3dd672b67 100644 --- a/.github/workflows/evals-periodic.yml +++ b/.github/workflows/evals-periodic.yml @@ -27,7 +27,7 @@ jobs: - id: meta # Keep in sync with evals.yml — key on Dockerfile + lockfile only # (package.json's version field would bust the key on every ship). - run: echo "tag=${{ env.IMAGE }}:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock') }}" >> "$GITHUB_OUTPUT" + run: echo "tag=${{ env.IMAGE }}:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock', 'patches/**') }}" >> "$GITHUB_OUTPUT" - uses: docker/login-action@v4 with: diff --git a/.github/workflows/evals.yml b/.github/workflows/evals.yml index c29a4462b..539b3ed5b 100644 --- a/.github/workflows/evals.yml +++ b/.github/workflows/evals.yml @@ -36,7 +36,7 @@ jobs: # which rebuilt the image each time for a dependency set that only # bun.lock determines. A stale baked package.json is harmless — checkout # overwrites /workspace and node_modules comes from the lockfile. - run: echo "tag=${{ env.IMAGE }}:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock') }}" >> "$GITHUB_OUTPUT" + run: echo "tag=${{ env.IMAGE }}:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock', 'patches/**') }}" >> "$GITHUB_OUTPUT" - uses: docker/login-action@v4 with: