CI check suggestion: dune-project and opam files are in sync

[ocurrent]

CI check suggestion: dune-project and opam files are in sync

[talex5]

This will be fixed as a side-effect of #285.

[avsm]

Yes, this sounds like a good thing to add. I think a general 'lint promote' step to check that no promotions occur would be useful. This has to also do a git diff, since opam file generation is a special case that is not a dune promote candidate.

[avsm]

We don't have a git checkout, so it's not quite as simple as git --exit-code to implement this.

One cheap and cheerful way would be to chmod the source directory to be read-only. It looks like BuildKit got support for this 24 days ago, so need to check if it's made its way into a docker release near us first... moby/buildkit#1492

[hannesm]

We don't have a git checkout

I've no clue about the internals, but my intuition is that ocaml-ci/ocurrent uses a git clone of a remote repository for conducting its work. Now, if you don't have a git checkout, I fail to understand how ocaml-ci is supposed to work. You could copy the directory before build and do a recursive diff after build.

[avsm]

ocaml-ci builds a Dockerfile that's incremental, so it copies in the source tree as it builds up layers. For example it starts with the opam files, analyses metadata, installs depexts, then adds the sources, then does a dune build. This way if you just modify OCaml code, the depext phase and earlier can be cached since they will not have changed.

It therefore never has a full git checkout in the Dockerfile. I ran a quick test and chmod -R 400 of the source tree works fine. You get a permission denied error when dune tries to modify the source tree -- the only time it does this is to write a .merlin file or to update opam files, so it should be safe for the CI to do and won't disturb caching.

[craigfe]

Looks like this one can be closed thanks to opam-dune-lint :-)