fix(docker): rebuild the pipeline image when its build inputs change

[flamboh]

Problem

Found while testing the container on a real machine. scripts/netflow-db-docker.sh only built the image when it was absent:

if ((force_build)) || ! docker image inspect "$IMAGE" >/dev/null 2>&1; then

So after pulling the tzdata fix from #102, the run still failed with the exact error that fix removes — the wrapper found the stale atlantis-netflow-db:local from a previous build and reused it. Nothing was wrong with the fix; the image simply never got rebuilt. Anyone who has built once and then pulls any pipeline or Dockerfile change hits this, and the failure looks like the fix did not work.

Solution

Fingerprint the inputs that actually change the image, store it as an image label, and compare before each run:

• pinned vendor/nfdump commit
• Dockerfile, .dockerignore
• rust-toolchain.toml, Cargo.toml, Cargo.lock, tools/netflow-db/Cargo.toml
• every file under tools/netflow-db/src
• vendor/scripts/compile-nfdump.sh

Hashing uses git hash-object, which the wrapper already depends on for reading the submodule pin — sha256sum is not present on macOS by default, so this avoids adding a coreutils requirement.

The wrapper now prints why it is building (missing, out of date, or requested) instead of building silently. --build still forces a rebuild.

Images built before this change carry no label, so they read as stale and rebuild once on the next run — which is the desired migration.

Flows to exercise

./scripts/netflow-db-docker.sh contract-version   # builds (missing), prints 4
./scripts/netflow-db-docker.sh contract-version   # no rebuild, prints 4
touch Dockerfile && echo "# x" >> Dockerfile
./scripts/netflow-db-docker.sh contract-version   # rebuilds (out of date)

Verification

The fingerprint function was exercised directly: stable across repeated calls, changes when Dockerfile changes, changes when a file under tools/netflow-db/src changes, and returns to the baseline value when the edits are reverted. bash -n passes; bun run format and bun run typecheck pass.

Not yet verified end to end against a live Docker daemon — a full --build run is in progress on the machine where this was found, and I will confirm the rebuild-detection path there.

---

Authored with Claude Code (Fable 5).