fix(ci-image): the dependency layer carries patches/ — bun install needs the patch files the lock declares

bun.lock's patchedDependencies (playwright-core windowsHide) made
'bun install --frozen-lockfile' fail inside the image build: the Dockerfile
copied package.json + bun.lock but not patches/. The image-tag hash in all
three workflows (ci-image, evals, evals-periodic — kept in lockstep) now
includes patches/** so editing a patch rebuilds the layer instead of
serving a stale cache.

Verified: the exact COPY set (package.json + bun.lock + patches) installs
clean in a Linux container; without patches it reproduces the CI failure.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-08-16 15:23:41 -07:00
co-authored by Claude Fable 5
parent 415beedfea
commit fe20340fba
4 changed files with 8 additions and 3 deletions
+1 -1
View File
@@ -29,7 +29,7 @@ jobs:
# This is the tag the eval matrix looks up first — without pushing it
# here, the weekly/main prebuild never warms the cache that matters.
- id: meta
run: echo "tag=ghcr.io/${{ github.repository }}/ci:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock') }}" >> "$GITHUB_OUTPUT"
run: echo "tag=ghcr.io/${{ github.repository }}/ci:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock', 'patches/**') }}" >> "$GITHUB_OUTPUT"
- uses: docker/login-action@v4
with:
+1 -1
View File
@@ -27,7 +27,7 @@ jobs:
- id: meta
# Keep in sync with evals.yml — key on Dockerfile + lockfile only
# (package.json's version field would bust the key on every ship).
run: echo "tag=${{ env.IMAGE }}:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock') }}" >> "$GITHUB_OUTPUT"
run: echo "tag=${{ env.IMAGE }}:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock', 'patches/**') }}" >> "$GITHUB_OUTPUT"
- uses: docker/login-action@v4
with:
+1 -1
View File
@@ -36,7 +36,7 @@ jobs:
# which rebuilt the image each time for a dependency set that only
# bun.lock determines. A stale baked package.json is harmless — checkout
# overwrites /workspace and node_modules comes from the lockfile.
run: echo "tag=${{ env.IMAGE }}:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock') }}" >> "$GITHUB_OUTPUT"
run: echo "tag=${{ env.IMAGE }}:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock', 'patches/**') }}" >> "$GITHUB_OUTPUT"
- uses: docker/login-action@v4
with: