ci: build the image on every pull request

[sajonaro]

Follow-up to #5. That bug — Library "writ_sql" not found — was invisible until the publish, because nothing builds the image before one.

Why it was invisible

Dockerfile stage 1 copies a hand-written list of directories, one COPY per library, and that list is deliberately the check that writ and writ-mcp are a small closed set. The cost of that design is a failure mode: a library added to a dune file and not to the list builds everywhere except in the image. image.yml fires only on a v* tag or by hand, so the release was the first thing to look.

The job

image-check.yml builds on every pull request and pushes nothing.

A second workflow, not a job in image.yml — that one holds packages: write so it can reach GHCR, and nothing triggered by a pull request should be able to publish. Two files, two permission sets.

No paths: filter, on purpose. A paths filter is the same kind of object as the COPY list it guards — a hand-kept enumeration of what matters — and this drift arrived in tooling/cli/dune, not in the Dockerfile. A filter naming the obvious files would have skipped the very commit that broke the image. So every PR builds, and the buildx cache is what keeps that cheap enough that nobody is tempted to add the filter back.

It builds and stops. Every check worth running is already a RUN in the Dockerfile's second stage, so producing the image is the test — no registry, no login, no load.

One check moved

git presence was checked in image.yml as a post-push step. It is a property of the image, not of the registry, so it moves into the Dockerfile's smoke RUN, where make image and this new job check it too — not just the publish.

What stays in image.yml is the one check only a publish can make: the tag pulls back down and runs.

Verification

Built locally three ways:

build	result
as committed	image builds, all smoke checks pass, writ 0.1.0
git install deleted	fails: no git: writ compare --git would not run
tooling/sql COPY removed	fails: Error: Library "writ_sql" not found.

The third is the regression this job exists to catch, reproduced on demand.

This PR is its own first test — the image-check run below is the job doing its job.

🤖 Generated with Claude Code