When the base doesn't set PYTHON_VERSION (Chainguard/Wolfi images), fall back to
reading /etc/apko.json from the top-most layer and parsing the python-X.Y
package, so --python validation works for those bases too. Env still takes
precedence. Adds tests for the apko fallback and env precedence.
Co-authored-by: Jason Hall <imjasonh@users.noreply.github.com>
Reads the base image's advertised PYTHON_VERSION (config env, no layer
download) and fails the build when it doesn't match --python, so a base tag
that slides to a new Python version can't silently produce a broken image.
Documents base-pinning tradeoffs in the README. Adds unit + CLI tests.
Co-authored-by: Jason Hall <imjasonh@users.noreply.github.com>
- --platform is now repeatable/comma-separated; >1 platform builds one image
per platform and assembles them into an OCI image index (remote.WriteIndex /
OCI layout). SBOM aggregates wheels across platforms.
- adds TestBuildMultiArchIndex (2-platform index, reproducible) against an
in-process registry; documents multi-arch in the README
Co-authored-by: Jason Hall <imjasonh@users.noreply.github.com>
- add internal/cache content-addressed layer store; build per-wheel layers in
parallel and reuse cached compressed blobs across rebuilds (--cache-dir)
- thread platform/python target into wheel resolution; validate --env
- add common secret patterns to the default source ignore list
- README: copy/paste-safe usage example + new flags; DESIGN status updated
Co-authored-by: Jason Hall <imjasonh@users.noreply.github.com>
