Fix letsencrypt auto-renew.

functions

@@ -637,11 +637,19 @@ fn-ga-image-current() {
 }
 
 fn-ga-build-image() {
+  declare NO_CACHE="${1:-false}"
   command -v docker >/dev/null 2>&1 || dokku_log_fail "docker is required to build the google-auth service image"
-  dokku_log_info1 "Building $GOOGLE_AUTH_IMAGE (first build downloads the Go toolchain image; this can take a few minutes)"
-  docker image build \
-    --label "google-auth.source-hash=$(fn-ga-source-hash)" \
-    -t "$GOOGLE_AUTH_IMAGE" "$GOOGLE_AUTH_PLUGIN_DIR"
+  local args=(image build)
+  if [[ "$NO_CACHE" == "true" ]]; then
+    # --pull too: the source hash cannot see the base images, so a rebuild that
+    # keeps a cached golang:1.24-alpine is not actually a fresh build.
+    args+=(--no-cache --pull)
+    dokku_log_info1 "Building $GOOGLE_AUTH_IMAGE from scratch (ignoring the layer cache, re-pulling base images)"
+  else
+    dokku_log_info1 "Building $GOOGLE_AUTH_IMAGE (first build downloads the Go toolchain image; this can take a few minutes)"
+  fi
+  args+=(--label "google-auth.source-hash=$(fn-ga-source-hash)" -t "$GOOGLE_AUTH_IMAGE" "$GOOGLE_AUTH_PLUGIN_DIR")
+  docker "${args[@]}"
 }
 
 fn-ga-service-running() {
@@ -739,7 +747,7 @@ fn-ga-service-start() {
   # Starting the service is how an operator expects to pick up an upgraded
   # plugin, and reusing the old binary there is what makes a new feature look
   # broken rather than absent.
-  fn-ga-image-current || fn-ga-build-image
+  fn-ga-image-current || fn-ga-build-image false
   fn-ga-write-env-file
   local port
   port="$(fn-ga-global-get port "$GOOGLE_AUTH_DEFAULT_PORT")"