fix: multi-stage rebuild for 3 protonmail tasks with corrupted sweap-images

All 76 protonmail sweap-images on Docker Hub have corrupted system binaries
(exec /bin/bash: input/output error). The /app directory (repo, node_modules,
build artifacts) is intact. Multi-stage build copies /app from the broken
image into a fresh node:16.20.2-bullseye (base/artifact) or node:18-bullseye
(sg_only, for Claude Code compat).

- Dockerfile: multi-stage FROM broken AS source -> FROM node, COPY /app
- Dockerfile.artifact_only: same + cp -al /app /repo_full (hardlink backup)
- Dockerfile.sg_only: same + node:18 + truncate + recommit

Verified: conv-testhooks base image builds, executes (echo hello, node -v,
jq --version), artifact_only backup and mode flags work. sg-benchmarks
mirrors confirmed for all 3 tasks (protonmail--c6f65d20, --8be4f6cb,
--369fd37d).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: sjarmak

benchmarks/ccb_fix/protonmail-conv-testhooks-fix-001/environment/Dockerfile

@@ -1,8 +1,20 @@
 # SWE-bench Pro Task Environment
 # Instance: instance_protonmail__webclients-c6f65d205c401350a226bb005f42fac1754b0b5b
 # Repo: protonmail/webclients
+#
+# Multi-stage rebuild: the sweap-images for protonmail have corrupted system
+# binaries (exec format / I/O error). We copy the pre-built /app directory
+# (repo + node_modules + build artifacts) into a fresh Node.js base image.
 
-FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-c6f65d205c401350a226bb005f42fac1754b0b5b
+FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-c6f65d205c401350a226bb005f42fac1754b0b5b AS source
+
+FROM node:16.20.2-bullseye
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git jq python3 curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=source /app /app
 
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
@@ -13,6 +25,7 @@ RUN mkdir -p /logs /workspace
 # SWE-bench Pro images have the repository at /app, not /testbed
 WORKDIR /app
 
-# Override the default entrypoint to work with Harbor's docker-compose
-# (The base image has ENTRYPOINT ["/bin/bash"] which doesn't work with Harbor's command format)
+RUN git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+
 ENTRYPOINT []

benchmarks/ccb_fix/protonmail-conv-testhooks-fix-001/environment/Dockerfile.artifact_only

@@ -6,8 +6,20 @@
 # SWE-bench Pro Task Environment
 # Instance: instance_protonmail__webclients-c6f65d205c401350a226bb005f42fac1754b0b5b
 # Repo: protonmail/webclients
+#
+# Multi-stage rebuild: the sweap-images for protonmail have corrupted system
+# binaries (exec format / I/O error). We copy the pre-built /app directory
+# (repo + node_modules + build artifacts) into a fresh Node.js base image.
 
-FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-c6f65d205c401350a226bb005f42fac1754b0b5b
+FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-c6f65d205c401350a226bb005f42fac1754b0b5b AS source
+
+FROM node:16.20.2-bullseye
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git jq python3 curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=source /app /app
 
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
@@ -18,12 +30,14 @@ RUN mkdir -p /logs /workspace
 # SWE-bench Pro images have the repository at /app, not /testbed
 WORKDIR /app
 
-# Override the default entrypoint to work with Harbor's docker-compose
-# (The base image has ENTRYPOINT ["/bin/bash"] which doesn't work with Harbor's command format)
+RUN git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+
 # --- artifact_only: backup full repo for verifier scoring ---
 # Source stays in /app (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+# Use hardlinks (cp -al) to avoid copying 9GB of data — nearly instant
+RUN cp -al /app /repo_full
 RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []

benchmarks/ccb_fix/protonmail-conv-testhooks-fix-001/environment/Dockerfile.sg_only

@@ -1,18 +1,23 @@
 # protonmail-conv-testhooks-fix-001 — sg_only_env variant
 # Source files truncated so agent must use Sourcegraph MCP for code access.
 # Verifier wrapper restores full repo before running tests.
+#
+# Multi-stage rebuild: sweap-images for protonmail have corrupted system
+# binaries. We copy /app into a fresh Node.js 18 base (Claude Code compat).
 
 # SWE-bench Pro Task Environment
 # Instance: instance_protonmail__webclients-c6f65d205c401350a226bb005f42fac1754b0b5b
 # Repo: protonmail/webclients
 
-FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-c6f65d205c401350a226bb005f42fac1754b0b5b
+FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-c6f65d205c401350a226bb005f42fac1754b0b5b AS source
 
-# Upgrade Node.js from v16 (base image) to v18 (required by Claude Code >= 2.1.37)
-# Remove old Node, then install from Alpine 3.18+ repos (ships Node 18.x)
-RUN apk del nodejs nodejs-current npm 2>/dev/null || true; \
-    rm -f /usr/local/bin/node /usr/local/bin/npm /usr/local/bin/npx 2>/dev/null || true; \
-    apk add --no-cache nodejs npm
+FROM node:18-bullseye
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git jq python3 curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=source /app /app
 
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
@@ -23,15 +28,13 @@ RUN mkdir -p /logs /workspace
 # SWE-bench Pro images have the repository at /app, not /testbed
 WORKDIR /app
 
-# Override the default entrypoint to work with Harbor's docker-compose
-# (The base image has ENTRYPOINT ["/bin/bash"] which doesn't work with Harbor's command format)
+RUN git config user.email "agent@example.com" && \
+    git config user.name "Agent"
 
 # --- sg_only_env: back up full repo, then truncate source ---
-RUN cp -a /app /repo_full
+RUN cp -al /app /repo_full
 RUN find /app -type f \( -name "*.py" -o -name "*.pyx" -o -name "*.pyi" -o -name "*.js" -o -name "*.ts" -o -name "*.jsx" -o -name "*.tsx" -o -name "*.mjs" -o -name "*.cjs" -o -name "*.mts" -o -name "*.cts" -o -name "*.go" -o -name "*.java" -o -name "*.kt" -o -name "*.scala" -o -name "*.groovy" -o -name "*.clj" -o -name "*.c" -o -name "*.cc" -o -name "*.cpp" -o -name "*.cxx" -o -name "*.h" -o -name "*.hh" -o -name "*.hpp" -o -name "*.hxx" -o -name "*.rs" -o -name "*.rb" -o -name "*.cs" -o -name "*.fs" -o -name "*.swift" -o -name "*.m" -o -name "*.mm" -o -name "*.vue" -o -name "*.svelte" -o -name "*.sh" -o -name "*.bash" -o -name "*.zsh" -o -name "*.lua" -o -name "*.proto" -o -name "*.thrift" -o -name "*.avsc" -o -name "*.fbs" -o -name "*.yaml" -o -name "*.yml" -o -name "*.toml" -o -name "*.json" -o -name "*.xml" -o -name "*.ini" -o -name "*.cfg" -o -name "*.md" -o -name "*.rst" -o -name "*.txt" -o -name "*.adoc" -o -name "*.cmake" -o -name "*.bzl" -o -name "*.bazel" -o -name "*.sql" -o -name "*.erl" -o -name "*.ex" -o -name "*.exs" -o -name "*.php" -o -name "*.pl" -o -name "*.pm" -o -name "*.r" -o -name "*.R" \) ! -path "*/.git/*" -exec truncate -s 0 {} \;
 # Recommit truncated state so git history cannot recover full files.
-# Without this, `git show HEAD:<file>` or `git checkout HEAD -- <file>`
-# would bypass truncation by reading from the pre-truncation commit.
 RUN cd /app && git add -A && git commit -m "sg_only truncation" --allow-empty --quiet
 RUN touch /tmp/.sg_only_mode && echo '/app' > /tmp/.sg_only_workdir
 ENTRYPOINT []

benchmarks/ccb_fix/protonmail-dropdown-sizing-fix-001/environment/Dockerfile

@@ -1,8 +1,20 @@
 # SWE-bench Pro Task Environment
 # Instance: instance_protonmail__webclients-8be4f6cb9380fcd2e67bcb18cef931ae0d4b869c
 # Repo: protonmail/webclients
+#
+# Multi-stage rebuild: the sweap-images for protonmail have corrupted system
+# binaries (exec format / I/O error). We copy the pre-built /app directory
+# (repo + node_modules + build artifacts) into a fresh Node.js base image.
 
-FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-8be4f6cb9380fcd2e67bcb18cef931ae0d4b869c
+FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-8be4f6cb9380fcd2e67bcb18cef931ae0d4b869c AS source
+
+FROM node:16.20.2-bullseye
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git jq python3 curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=source /app /app
 
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
@@ -13,6 +25,7 @@ RUN mkdir -p /logs /workspace
 # SWE-bench Pro images have the repository at /app, not /testbed
 WORKDIR /app
 
-# Override the default entrypoint to work with Harbor's docker-compose
-# (The base image has ENTRYPOINT ["/bin/bash"] which doesn't work with Harbor's command format)
+RUN git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+
 ENTRYPOINT []

benchmarks/ccb_fix/protonmail-dropdown-sizing-fix-001/environment/Dockerfile.artifact_only

@@ -6,8 +6,20 @@
 # SWE-bench Pro Task Environment
 # Instance: instance_protonmail__webclients-8be4f6cb9380fcd2e67bcb18cef931ae0d4b869c
 # Repo: protonmail/webclients
+#
+# Multi-stage rebuild: the sweap-images for protonmail have corrupted system
+# binaries (exec format / I/O error). We copy the pre-built /app directory
+# (repo + node_modules + build artifacts) into a fresh Node.js base image.
 
-FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-8be4f6cb9380fcd2e67bcb18cef931ae0d4b869c
+FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-8be4f6cb9380fcd2e67bcb18cef931ae0d4b869c AS source
+
+FROM node:16.20.2-bullseye
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git jq python3 curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=source /app /app
 
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
@@ -18,12 +30,14 @@ RUN mkdir -p /logs /workspace
 # SWE-bench Pro images have the repository at /app, not /testbed
 WORKDIR /app
 
-# Override the default entrypoint to work with Harbor's docker-compose
-# (The base image has ENTRYPOINT ["/bin/bash"] which doesn't work with Harbor's command format)
+RUN git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+
 # --- artifact_only: backup full repo for verifier scoring ---
 # Source stays in /app (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+# Use hardlinks (cp -al) to avoid copying 9GB of data — nearly instant
+RUN cp -al /app /repo_full
 RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []

benchmarks/ccb_fix/protonmail-dropdown-sizing-fix-001/environment/Dockerfile.sg_only

@@ -1,18 +1,23 @@
 # protonmail-dropdown-sizing-fix-001 — sg_only_env variant
 # Source files truncated so agent must use Sourcegraph MCP for code access.
 # Verifier wrapper restores full repo before running tests.
+#
+# Multi-stage rebuild: sweap-images for protonmail have corrupted system
+# binaries. We copy /app into a fresh Node.js 18 base (Claude Code compat).
 
 # SWE-bench Pro Task Environment
 # Instance: instance_protonmail__webclients-8be4f6cb9380fcd2e67bcb18cef931ae0d4b869c
 # Repo: protonmail/webclients
 
-FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-8be4f6cb9380fcd2e67bcb18cef931ae0d4b869c
+FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-8be4f6cb9380fcd2e67bcb18cef931ae0d4b869c AS source
 
-# Upgrade Node.js from v16 (base image) to v18 (required by Claude Code >= 2.1.37)
-# Remove old Node, then install from Alpine 3.18+ repos (ships Node 18.x)
-RUN apk del nodejs nodejs-current npm 2>/dev/null || true; \
-    rm -f /usr/local/bin/node /usr/local/bin/npm /usr/local/bin/npx 2>/dev/null || true; \
-    apk add --no-cache nodejs npm
+FROM node:18-bullseye
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git jq python3 curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=source /app /app
 
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
@@ -23,15 +28,13 @@ RUN mkdir -p /logs /workspace
 # SWE-bench Pro images have the repository at /app, not /testbed
 WORKDIR /app
 
-# Override the default entrypoint to work with Harbor's docker-compose
-# (The base image has ENTRYPOINT ["/bin/bash"] which doesn't work with Harbor's command format)
+RUN git config user.email "agent@example.com" && \
+    git config user.name "Agent"
 
 # --- sg_only_env: back up full repo, then truncate source ---
-RUN cp -a /app /repo_full
+RUN cp -al /app /repo_full
 RUN find /app -type f \( -name "*.py" -o -name "*.pyx" -o -name "*.pyi" -o -name "*.js" -o -name "*.ts" -o -name "*.jsx" -o -name "*.tsx" -o -name "*.mjs" -o -name "*.cjs" -o -name "*.mts" -o -name "*.cts" -o -name "*.go" -o -name "*.java" -o -name "*.kt" -o -name "*.scala" -o -name "*.groovy" -o -name "*.clj" -o -name "*.c" -o -name "*.cc" -o -name "*.cpp" -o -name "*.cxx" -o -name "*.h" -o -name "*.hh" -o -name "*.hpp" -o -name "*.hxx" -o -name "*.rs" -o -name "*.rb" -o -name "*.cs" -o -name "*.fs" -o -name "*.swift" -o -name "*.m" -o -name "*.mm" -o -name "*.vue" -o -name "*.svelte" -o -name "*.sh" -o -name "*.bash" -o -name "*.zsh" -o -name "*.lua" -o -name "*.proto" -o -name "*.thrift" -o -name "*.avsc" -o -name "*.fbs" -o -name "*.yaml" -o -name "*.yml" -o -name "*.toml" -o -name "*.json" -o -name "*.xml" -o -name "*.ini" -o -name "*.cfg" -o -name "*.md" -o -name "*.rst" -o -name "*.txt" -o -name "*.adoc" -o -name "*.cmake" -o -name "*.bzl" -o -name "*.bazel" -o -name "*.sql" -o -name "*.erl" -o -name "*.ex" -o -name "*.exs" -o -name "*.php" -o -name "*.pl" -o -name "*.pm" -o -name "*.r" -o -name "*.R" \) ! -path "*/.git/*" -exec truncate -s 0 {} \;
 # Recommit truncated state so git history cannot recover full files.
-# Without this, `git show HEAD:<file>` or `git checkout HEAD -- <file>`
-# would bypass truncation by reading from the pre-truncation commit.
 RUN cd /app && git add -A && git commit -m "sg_only truncation" --allow-empty --quiet
 RUN touch /tmp/.sg_only_mode && echo '/app' > /tmp/.sg_only_workdir
 ENTRYPOINT []

benchmarks/ccb_fix/protonmail-holiday-calendar-fix-001/environment/Dockerfile

@@ -1,8 +1,20 @@
 # SWE-bench Pro Task Environment
 # Instance: instance_protonmail__webclients-369fd37de29c14c690cb3b1c09a949189734026f
 # Repo: protonmail/webclients
+#
+# Multi-stage rebuild: the sweap-images for protonmail have corrupted system
+# binaries (exec format / I/O error). We copy the pre-built /app directory
+# (repo + node_modules + build artifacts) into a fresh Node.js base image.
 
-FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-369fd37de29c14c690cb3b1c09a949189734026f
+FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-369fd37de29c14c690cb3b1c09a949189734026f AS source
+
+FROM node:16.20.2-bullseye
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git jq python3 curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=source /app /app
 
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
@@ -13,6 +25,7 @@ RUN mkdir -p /logs /workspace
 # SWE-bench Pro images have the repository at /app, not /testbed
 WORKDIR /app
 
-# Override the default entrypoint to work with Harbor's docker-compose
-# (The base image has ENTRYPOINT ["/bin/bash"] which doesn't work with Harbor's command format)
+RUN git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+
 ENTRYPOINT []

benchmarks/ccb_fix/protonmail-holiday-calendar-fix-001/environment/Dockerfile.artifact_only

@@ -6,8 +6,20 @@
 # SWE-bench Pro Task Environment
 # Instance: instance_protonmail__webclients-369fd37de29c14c690cb3b1c09a949189734026f
 # Repo: protonmail/webclients
+#
+# Multi-stage rebuild: the sweap-images for protonmail have corrupted system
+# binaries (exec format / I/O error). We copy the pre-built /app directory
+# (repo + node_modules + build artifacts) into a fresh Node.js base image.
 
-FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-369fd37de29c14c690cb3b1c09a949189734026f
+FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-369fd37de29c14c690cb3b1c09a949189734026f AS source
+
+FROM node:16.20.2-bullseye
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git jq python3 curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=source /app /app
 
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
@@ -18,12 +30,14 @@ RUN mkdir -p /logs /workspace
 # SWE-bench Pro images have the repository at /app, not /testbed
 WORKDIR /app
 
-# Override the default entrypoint to work with Harbor's docker-compose
-# (The base image has ENTRYPOINT ["/bin/bash"] which doesn't work with Harbor's command format)
+RUN git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+
 # --- artifact_only: backup full repo for verifier scoring ---
 # Source stays in /app (readable by baseline agent).
 # MCP agent deletes source files at runtime via agent startup script.
-RUN cp -a /app /repo_full
+# Use hardlinks (cp -al) to avoid copying 9GB of data — nearly instant
+RUN cp -al /app /repo_full
 RUN touch /tmp/.artifact_only_mode && echo '/app' > /tmp/.artifact_only_workdir
 
 ENTRYPOINT []

benchmarks/ccb_fix/protonmail-holiday-calendar-fix-001/environment/Dockerfile.sg_only

@@ -1,18 +1,23 @@
 # protonmail-holiday-calendar-fix-001 — sg_only_env variant
 # Source files truncated so agent must use Sourcegraph MCP for code access.
 # Verifier wrapper restores full repo before running tests.
+#
+# Multi-stage rebuild: sweap-images for protonmail have corrupted system
+# binaries. We copy /app into a fresh Node.js 18 base (Claude Code compat).
 
 # SWE-bench Pro Task Environment
 # Instance: instance_protonmail__webclients-369fd37de29c14c690cb3b1c09a949189734026f
 # Repo: protonmail/webclients
 
-FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-369fd37de29c14c690cb3b1c09a949189734026f
+FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-369fd37de29c14c690cb3b1c09a949189734026f AS source
 
-# Upgrade Node.js from v16 (base image) to v18 (required by Claude Code >= 2.1.37)
-# Remove old Node, then install from Alpine 3.18+ repos (ships Node 18.x)
-RUN apk del nodejs nodejs-current npm 2>/dev/null || true; \
-    rm -f /usr/local/bin/node /usr/local/bin/npm /usr/local/bin/npx 2>/dev/null || true; \
-    apk add --no-cache nodejs npm
+FROM node:18-bullseye
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git jq python3 curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=source /app /app
 
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
@@ -23,15 +28,13 @@ RUN mkdir -p /logs /workspace
 # SWE-bench Pro images have the repository at /app, not /testbed
 WORKDIR /app
 
-# Override the default entrypoint to work with Harbor's docker-compose
-# (The base image has ENTRYPOINT ["/bin/bash"] which doesn't work with Harbor's command format)
+RUN git config user.email "agent@example.com" && \
+    git config user.name "Agent"
 
 # --- sg_only_env: back up full repo, then truncate source ---
-RUN cp -a /app /repo_full
+RUN cp -al /app /repo_full
 RUN find /app -type f \( -name "*.py" -o -name "*.pyx" -o -name "*.pyi" -o -name "*.js" -o -name "*.ts" -o -name "*.jsx" -o -name "*.tsx" -o -name "*.mjs" -o -name "*.cjs" -o -name "*.mts" -o -name "*.cts" -o -name "*.go" -o -name "*.java" -o -name "*.kt" -o -name "*.scala" -o -name "*.groovy" -o -name "*.clj" -o -name "*.c" -o -name "*.cc" -o -name "*.cpp" -o -name "*.cxx" -o -name "*.h" -o -name "*.hh" -o -name "*.hpp" -o -name "*.hxx" -o -name "*.rs" -o -name "*.rb" -o -name "*.cs" -o -name "*.fs" -o -name "*.swift" -o -name "*.m" -o -name "*.mm" -o -name "*.vue" -o -name "*.svelte" -o -name "*.sh" -o -name "*.bash" -o -name "*.zsh" -o -name "*.lua" -o -name "*.proto" -o -name "*.thrift" -o -name "*.avsc" -o -name "*.fbs" -o -name "*.yaml" -o -name "*.yml" -o -name "*.toml" -o -name "*.json" -o -name "*.xml" -o -name "*.ini" -o -name "*.cfg" -o -name "*.md" -o -name "*.rst" -o -name "*.txt" -o -name "*.adoc" -o -name "*.cmake" -o -name "*.bzl" -o -name "*.bazel" -o -name "*.sql" -o -name "*.erl" -o -name "*.ex" -o -name "*.exs" -o -name "*.php" -o -name "*.pl" -o -name "*.pm" -o -name "*.r" -o -name "*.R" \) ! -path "*/.git/*" -exec truncate -s 0 {} \;
 # Recommit truncated state so git history cannot recover full files.
-# Without this, `git show HEAD:<file>` or `git checkout HEAD -- <file>`
-# would bypass truncation by reading from the pre-truncation commit.
 RUN cd /app && git add -A && git commit -m "sg_only truncation" --allow-empty --quiet
 RUN touch /tmp/.sg_only_mode && echo '/app' > /tmp/.sg_only_workdir
 ENTRYPOINT []