fix(ci-image): the dependency layer carries patches/ — bun install needs the patch files the lock declares

bun.lock's patchedDependencies (playwright-core windowsHide) made
'bun install --frozen-lockfile' fail inside the image build: the Dockerfile
copied package.json + bun.lock but not patches/. The image-tag hash in all
three workflows (ci-image, evals, evals-periodic — kept in lockstep) now
includes patches/** so editing a patch rebuilds the layer instead of
serving a stale cache.

Verified: the exact COPY set (package.json + bun.lock + patches) installs
clean in a Linux container; without patches it reproduces the CI failure.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-08-16 15:23:41 -07:00
co-authored by Claude Fable 5
parent 415beedfea
commit fe20340fba
4 changed files with 8 additions and 3 deletions
+5
View File
@@ -104,7 +104,12 @@ RUN for i in 1 2 3; do \
# resolution. Without bun.lock here, bun install resolved transitive deps
# differently in CI vs local (observed on v1.28.0.0: socks landed but
# smart-buffer + ip-address didn't make it into the cached node_modules).
# patches/ rides along: bun.lock's patchedDependencies (playwright-core
# windowsHide, v1.67) makes install fail without the patch files present —
# and the workflows' image-tag hash includes patches/** so editing a patch
# rebuilds this layer.
COPY package.json bun.lock /workspace/
COPY patches /workspace/patches
WORKDIR /workspace
RUN bun install --frozen-lockfile && rm -rf /tmp/*