kevinveenbirkenbach f45df04bf1 test(docker): forbid ARG defaults in every Dockerfile ...

A defaulted build argument answers a question the caller failed to answer. The
build then succeeds against a base image, version or path nobody chose, and the
mistake surfaces as wrong behaviour at runtime instead of a failed build.

web-app-bridgy-fed shows the cost: its metadata declared python 3.14 while the
Dockerfile default silently built against 3.12. Both look plausible, so nothing
pointed at the drift. It and web-app-postmarks now take the base image from the
same services declaration the rest of the role reads.

The lint walks every tracked Dockerfile, template variants and paths outside
roles/ included, which the existing ARG-scope check does not. A second
assertion fails when the scan finds no Dockerfile at all, so the rule cannot
pass vacuously if the walk ever breaks.

Touching the two Dockerfiles brought their pre-existing narration under the
comment lint; what carried substance moved into the file header.

2026-08-25 00:25:00 +02:00

..

compose.yml.j2

test(docker): forbid ARG defaults in every Dockerfile

2026-08-25 00:25:00 +02:00

env.j2

…

playwright.env.j2

feat(playwright): make a blocked persona state why

2026-08-06 20:36:39 +02:00