GeezerVison

Every release currently rebuilds every layer of the Docker image, so upgrading socketdev/cli downloads nearly the whole image. This PR fixes that and removes about 1.1 GB of payload nothing runs.

Root cause of the per-release re-pull

ARG CLI_VERSION (with the other release ARGs) was declared at the top of the Dockerfile. BuildKit cache-keys every RUN after an ARG on that ARG's value, and CLI_VERSION changes on every release, so every toolchain layer missed the cache on every release build even when nothing in it changed. From the published amd64 manifests:

The base image digest was the same across 2.11.10 → 2.11.11, so the churn didn't come from upstream. The release ARGs are now declared just before the CLI install. tests/unit/test_dockerfile.py lists the ARGs allowed above the toolchain layers (GO_VERSION, JAVA_VERSION, DOTNET_VERSION, TARGETARCH, PIP_NO_CACHE_DIR) and fails on any other, so a new per-release ARG is caught as well. It fails against main's Dockerfile. Dockerfile is added to the Unit Tests push paths, since the suite now reads it.

Release build cache

Moving the ARGs only helps if a release can read the previous release's cache, and it can't today. release.yml caches with type=gha. Actions caches are scoped to the ref that wrote them, and each release builds on its own tag: the repository's BuildKit cache entries all sit under refs/tags/v2.11.x, a full set per release, none ever read by the next one. That is also why the Actions cache is pinned at its 10 GB limit. The release build now uses a registry cache at socketdev/cli:buildcache (mode=max), which any tag can read.

I checked the mechanism with a local registry and a multi-platform push. With the registry cache, two builds with different CLI_VERSION values produced identical layer digests for a RUN step that writes a timestamp, so the step was reused rather than re-run. An inline cache (cache-to: type=inline with cache-from pointing at the published image) did not hit after a multi-platform push, which is why this uses a dedicated cache tag. The cache tag is pushed to the same Docker Hub repository and isn't meant to be pulled.

Reachability inside the image (e2e-image.yml)

e2e-test.yml runs reachability on the runner, so nothing checked that the image's toolchains actually work for Coana. The new workflow builds the image once from the commit (reading the release cache, never writing it) and runs --reach inside it against the existing npm fixture and a new Rust fixture (smallvec 1.6.0, which has a known advisory). Each fixture's result is recorded, so one failure doesn't hide the other. It runs when the Dockerfile, the reachability launcher, or the e2e fixtures change, on push to main, and on demand. It isn't a required check.

Both e2e workflows now share one policy for the backend's intermittent empty results:

• tests/e2e/run-with-retries.sh is the retry loop: up to three attempts while a probe fails, with retries surfaced as warnings. e2e-test.yml now calls it instead of its inline loop.
• tests/e2e/reach_facts.py is the probe, and the one definition of the inconclusive backend result (a manifest uploaded, components orphaned, nothing to analyze). It replaces reach-facts-probe.sh, and validate-reachability.sh calls it instead of its own greps.

The image check asserts only what the image controls: the run completes, and Coana reaches a reachable or unreachable verdict for at least one vulnerability, which needs the ecosystem's toolchain to work. It doesn't assert which verdict.

Dependabot and Node majors

.github/dependabot.yml now ignores major updates to the node image. Dependabot doesn't know Node's release schedule, so it proposes odd-numbered majors, which never become LTS, and it can't check the reachability engine's minimum Node version. The floating node:24-alpine3.24 tag already picks up Node 24 minor and patch releases on every build. A Node major becomes a deliberate change, checked with e2e-image.yml.

Payload removed

• Rust: rustup's minimal profile (rustc, cargo, rust-std) instead of default. Drops about 900 MB of offline HTML docs, plus rustfmt and clippy. Reachability only invokes cargo.
• Caches: npm cache clean --force after the global install, and ARG PIP_NO_CACHE_DIR=1 so no pip install leaves a cache. As an ARG it applies only at build time, and its value never changes, so it doesn't affect layer caching.
• apk update is gone; apk add --no-cache doesn't need it.
• strace is no longer installed (it was referenced nowhere). The changelog notes apk add strace for anyone who relied on it.
• .dockerignore: lists what the build context includes (package source, build metadata, entrypoint, and dist/ for Dockerfile.preview's wheel) instead of what it excludes, so new top-level directories stay out by default.

Verification

CI's dockerfile-smoke job builds this Dockerfile natively on amd64 and arm64 and runs its tool and TLS checks. The measurements below are from local linux/arm64 builds.

• Size: 4,579 MB for socketdev/cli:2.11.11 vs 3,446 MB for this branch (uncompressed, arm64). /root/.rustup went from 1,693 to 753 MB, /root/.npm from 20 to 1 MB, /app from 11 to 2 MB.
• Layer reuse: built with CLI_VERSION=2.11.10, then rebuilt with CLI_VERSION=2.11.11. Steps 2–17, everything through the locked dependency install, were CACHED. Only the CLI install and the small layers after it rebuilt. A real release also changes pyproject.toml/uv.lock, which adds the locked-dependency layer (about 21 MB). So an upgrade is roughly 25 MB uncompressed instead of about 1 GB compressed.
• Toolchains: socketcli, cargo/rustc, go, java, dotnet, node, ruby/bundle, pyenv, uv and socket all run. cargo generate-lockfile, cargo metadata and cargo build work on a crate with a crates.io dependency.
• Tests: 734 unit tests pass.

Rust reachability in the image is covered by e2e-image.yml on this PR. A throwaway run with node:26-alpine3.24 (#444, closed) also passed both fixtures, for when Node 26 is adopted.

Once the registry cache is in use, the old type=gha BuildKit entries (about 10 GB) can be deleted from the repository's Actions caches.

Bumps to 2.12.0, a minor version because the image drops binaries (strace, rustfmt, clippy) and changes how it is built and published. #438 also targets 2.12.0; whichever merges second rides that version, and needs a small merge in the changelog and in release.yml's build step.

Fixes CE-430

🤖 Generated with Claude Code