torrust · josecelano · Jun 1, 2026 · Jun 1, 2026 · Jun 1, 2026
diff --git a/.dockerignore b/.dockerignore
@@ -1,28 +1,60 @@
-/.coverage/
-/.tmp/
+# .dockerignore — paths excluded from the Docker build context
+#
+# Intentionally INCLUDED (required by one or more Containerfile stages):
+#   .cargo/                    — Cargo config (rustflags, build settings)
+#   Cargo.toml, Cargo.lock     — workspace manifest and dependency lockfile
+#   Containerfile              — read by BuildKit as the build definition
+#   console/                   — workspace member crates
+#   contrib/bencode/           — workspace member crate
+#   contrib/dev-tools/su-exec/ — C source compiled in the gcc stage
+#   packages/                  — workspace member crates
+#   share/                     — app data (COPY ./share/) and container entry script
+#   src/                       — main crate source
+#   tests/                     — integration tests
+
+# ── Git metadata ──────────────────────────────────────────────────────────────
 /.git
 /.git-blame-ignore
-/.github
-/.githooks/
 /.gitignore
+/.githooks/
+
+# ── CI / developer tooling ────────────────────────────────────────────────────
+/.github/
+/.coverage/
+/.tmp/
+/.vscode/
+/codecov.yaml
+/compose.*.yaml
+/cspell.json
 /.markdownlint.json
 /.taplo.toml
-/.vscode
 /.yamllint-ci.yml
+/project-words.txt
+/rustfmt.toml
+
+# ── Documentation and project metadata ───────────────────────────────────────
+/docs/
 /AGENTS.md
+/packages/AGENTS.md
+/src/AGENTS.md
+/README.md
+/NOTICE
+/SECURITY.md
+/LICENSE
+
+# ── Dev tooling (not needed in any build stage) ───────────────────────────────
+# su-exec is compiled in the gcc stage: COPY ./contrib/dev-tools/su-exec/
+/contrib/dev-tools/
+!/contrib/dev-tools/su-exec/
+
+# ── Build artifacts and runtime state ─────────────────────────────────────────
 /bin/
-/codecov.yaml
-/compose.*.yaml
-/cspell.json
-/data.db
-/docs/
 /docker/bin/
 /etc/
-/integration_tests_sqlite3.db
-/NOTICE
-/project-words.txt
-/README.md
-/rustfmt.toml
 /storage/
 /target/
+
+# ── Test and runtime data files ───────────────────────────────────────────────
+/data.db
+/integration_tests_sqlite3.db
 /tracker.*
diff --git a/docs/issues/open/1840-improve-pr-workflow-performance-epic/EPIC.md b/docs/issues/open/1840-improve-pr-workflow-performance-epic/EPIC.md
@@ -119,7 +119,7 @@ For each subissue implementation in this EPIC, the default completion policy is:
 - [x] Epic spec drafted in `docs/issues/drafts/`
 - [x] Epic spec reviewed and approved by user/maintainer
 - [x] GitHub epic issue created and issue number added to this spec
-- [ ] Subissues created and linked in this spec
+- [x] Subissues created and linked in this spec
 - [ ] Subissue statuses kept up to date in the `Subissues` table
 - [ ] For each implemented subissue: automatic checks completed and recorded
 - [ ] For each implemented subissue: manual verification completed and recorded
@@ -140,6 +140,7 @@ Append one line per meaningful update.
 - 2026-06-01 00:00 UTC - GitHub Copilot - Added sub-issues: alternative-linker (p1, row 9), prebuilt-base-images (p3 deferred, row 11)
 - 2026-06-01 00:00 UTC - GitHub Copilot - Added sub-issue: buildkit-cargo-cache-mounts (p2, row 12); local benchmark: cold fetch 6.9 s → warm 0.16 s; CI limitation documented
 - 2026-06-01 00:00 UTC - GitHub Copilot - Promoted rows 2/3/4/6 from drafts to open: #1851 dockerignore-audit, #1852 recipe-manifest-only-copy, #1853 containerfile-target-scope, #1854 container-test-gating
+- 2026-06-01 00:00 UTC - GitHub Copilot - PR #1855 merged; all sub-issue specs (rows 2–12) are now in develop; renamed #1726 folder to match EPIC sub-issue naming convention
 
 ## Acceptance Criteria
 

diff --git a/docs/issues/open/1851-1840-workflow-performance-dockerignore-audit/ISSUE.md b/docs/issues/open/1851-1840-workflow-performance-dockerignore-audit/ISSUE.md
@@ -99,13 +99,13 @@ and appear unlikely to be needed in any Containerfile stage:
 
 Status values: `TODO`, `IN_PROGRESS`, `BLOCKED`, `DONE`.
 
-| ID  | Status | Task                                            | Notes / Expected Output                                                                               |
-| --- | ------ | ----------------------------------------------- | ----------------------------------------------------------------------------------------------------- |
-| T1  | TODO   | Measure current build context size              | Use `docker buildx build --progress=plain` or context dump to get baseline size and file list.        |
-| T2  | TODO   | Cross-reference `.dockerignore` vs `.gitignore` | List all tracked paths absent from `.dockerignore` and classify each as needed / not needed / unsure. |
-| T3  | TODO   | Inspect container stage contents                | Build the image locally and walk the filesystem of each stage to verify no needed file is excluded.   |
-| T4  | TODO   | Add safe exclusions to `.dockerignore`          | Add confirmed-safe paths; document intentionally included paths with inline comments.                 |
-| T5  | TODO   | Measure context size and cache behaviour after  | Re-run baseline script (warm + cold) and record reduction in context transfer time and cache misses.  |
+| ID  | Status | Task                                            | Notes / Expected Output                                                                                                                                                                               |
+| --- | ------ | ----------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| T1  | DONE   | Measure current build context size              | `printf 'FROM scratch\nCOPY . /ctx' \| docker buildx build --progress=plain --no-cache -f - .` → **4.75 MB**                                                                                          |
+| T2  | DONE   | Cross-reference `.dockerignore` vs `.gitignore` | All tracked root-level paths classified; new exclusions: `SECURITY.md`, `LICENSE`, `packages/AGENTS.md`, `src/AGENTS.md`, `contrib/dev-tools/` (minus `su-exec/`).                                    |
+| T3  | DONE   | Inspect container stage contents                | Containerfile reviewed stage-by-stage; `contrib/dev-tools/su-exec/` retained via `!` negation rule; all other `COPY` targets verified included.                                                       |
+| T4  | DONE   | Add safe exclusions to `.dockerignore`          | `.dockerignore` reorganized into labeled sections; intentionally included paths documented in header comment block.                                                                                   |
+| T5  | DONE   | Measure context size and cache behaviour after  | Same command as T1 after clean `docker buildx prune -f` → **4.64 MB** (−110 kB, −2.3%). Cache invalidation surface reduced: `contrib/dev-tools/` changes no longer trigger source-stage cache misses. |
 
 ## Progress Tracking
 
@@ -115,7 +115,7 @@ Status values: `TODO`, `IN_PROGRESS`, `BLOCKED`, `DONE`.
 - [x] Spec reviewed and approved by user/maintainer
 - [x] GitHub issue created and issue number added to this spec
 - [ ] (Optional, recommended for complex issues) Spec-only PR merged into `develop` before implementation
-- [ ] Implementation completed
+- [x] Implementation completed
 - [ ] Automatic verification completed (`linter all`, relevant tests, and any pre-push checks)
 - [ ] Manual verification scenarios executed and recorded (status + evidence)
 - [ ] Acceptance criteria reviewed after implementation and updated with evidence
@@ -129,15 +129,16 @@ Append one line per meaningful update.
 
 - 2026-05-29 00:00 UTC - GitHub Copilot - Drafted .dockerignore audit issue from baseline analysis findings - draft file created
 - 2026-06-01 00:00 UTC - GitHub Copilot - GitHub issue #1851 created; spec moved from drafts/ to open/
+- 2026-06-01 00:00 UTC - GitHub Copilot - Implemented on branch 1851-workflow-performance-dockerignore-audit: reorganized .dockerignore with section comments, added SECURITY.md, LICENSE, packages/AGENTS.md, src/AGENTS.md, contrib/dev-tools/ (su-exec/ retained). Context: 4.75 MB → 4.64 MB (−110 kB).
 
 ## Acceptance Criteria
 
-- [ ] AC1: Current Docker build context size is measured and recorded.
-- [ ] AC2: All tracked repo paths are classified as needed / excluded / intentionally kept with a rationale.
-- [ ] AC3: `.dockerignore` is updated with all confirmed-safe exclusions.
+- [x] AC1: Current Docker build context size is measured and recorded.
+- [x] AC2: All tracked repo paths are classified as needed / excluded / intentionally kept with a rationale.
+- [x] AC3: `.dockerignore` is updated with all confirmed-safe exclusions.
 - [ ] AC4: No Containerfile stage is broken by the new exclusions (all CI checks pass).
-- [ ] AC5: Build context size is re-measured and the reduction is documented.
-- [ ] AC6: Intentionally included paths are documented with inline comments in `.dockerignore`.
+- [x] AC5: Build context size is re-measured and the reduction is documented.
+- [x] AC6: Intentionally included paths are documented with inline comments in `.dockerignore`.
 - [ ] `linter all` exits with code `0`
 - [ ] All CI checks pass for changed files
 - [ ] Manual verification scenarios are executed and documented (status + evidence)
@@ -156,20 +157,20 @@ Define verification before implementation starts and execute it before closing t
 
 Status values: `TODO`, `IN_PROGRESS`, `DONE`, `FAILED`, `BLOCKED`.
 
-| ID  | Scenario               | Command/Steps                                                                                          | Expected Result                                                                                  | Status | Evidence          |
-| --- | ---------------------- | ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------ | ------ | ----------------- |
-| M1  | Measure context before | `docker buildx build --progress=plain . 2>&1 \| grep -E 'transferring context\|sending build context'` | Baseline context size recorded.                                                                  | TODO   | {log/output path} |
-| M2  | Verify no stage breaks | Full cold `docker build --target release .`                                                            | Build completes successfully; all stages produce expected artifacts.                             | TODO   | {log path}        |
-| M3  | Measure context after  | Same command as M1 after `.dockerignore` update                                                        | Context size smaller than baseline; reduction documented.                                        | TODO   | {log/output path} |
-| M4  | Cache stability check  | Run warm baseline twice: `run-container-baseline.sh` without `--cold`                                  | Layer cache hit rates are stable or improved; no unexpected misses due to excluded file changes. | TODO   | {benchmark link}  |
+| ID  | Scenario               | Command/Steps                                                                                  | Expected Result                                                                                  | Status | Evidence                                           |
+| --- | ---------------------- | ---------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | ------ | -------------------------------------------------- |
+| M1  | Measure context before | `printf 'FROM scratch\nCOPY . /ctx' \| docker buildx build --progress=plain --no-cache -f - .` | Baseline context size recorded.                                                                  | DONE   | `#3 transferring context: 4.75MB`                  |
+| M2  | Verify no stage breaks | Full cold `docker build --target release .`                                                    | Build completes successfully; all stages produce expected artifacts.                             | TODO   | pending CI                                         |
+| M3  | Measure context after  | Same command as M1 after `docker buildx prune -f` and `.dockerignore` update                   | Context size smaller than baseline; reduction documented.                                        | DONE   | `#3 transferring context: 4.64MB` (−110 kB, −2.3%) |
+| M4  | Cache stability check  | Run warm baseline twice: `run-container-baseline.sh` without `--cold`                          | Layer cache hit rates are stable or improved; no unexpected misses due to excluded file changes. | TODO   | pending full build                                 |
 
 ### Acceptance Verification
 
-| AC ID | Status (`TODO`/`DONE`) | Evidence             |
-| ----- | ---------------------- | -------------------- |
-| AC1   | TODO                   | {benchmark/log link} |
-| AC2   | TODO                   | {analysis link}      |
-| AC3   | TODO                   | {diff link}          |
-| AC4   | TODO                   | {CI run link}        |
-| AC5   | TODO                   | {benchmark/log link} |
-| AC6   | TODO                   | {diff link}          |
+| AC ID | Status (`TODO`/`DONE`) | Evidence                                                                                                                                               |
+| ----- | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| AC1   | DONE                   | `printf 'FROM scratch\nCOPY . /ctx' \| docker buildx build --progress=plain --no-cache -f - .` → `#3 transferring context: 4.75MB`                     |
+| AC2   | DONE                   | All 32 root-level tracked paths reviewed; classification documented in T2 row above and in `.dockerignore` header block                                |
+| AC3   | DONE                   | `.dockerignore` updated: added `SECURITY.md`, `LICENSE`, `packages/AGENTS.md`, `src/AGENTS.md`, `/contrib/dev-tools/` + `!/contrib/dev-tools/su-exec/` |
+| AC4   | TODO                   | Pending CI run                                                                                                                                         |
+| AC5   | DONE                   | Same command after `docker buildx prune -f` → `#3 transferring context: 4.64MB` (−110 kB, −2.3%)                                                       |
+| AC6   | DONE                   | `.dockerignore` header block lists all intentionally included paths with rationale                                                                     |