Fix letsencrypt auto-renew.

test/access-list-test.sh

@@ -238,6 +238,7 @@ cat >"$WORK/bin-docker/docker" <<'EOF'
 case "$1 $2" in
   "container inspect") cat "$DOCKER_INSPECT_FIXTURE" ;;
   "image inspect") printf '%s\n' "$DOCKER_IMAGE_FIXTURE" ;;
+  "image build") printf '%s\n' "$*" >"$DOCKER_ARGS_FIXTURE" ;;
 esac
 exit 0
 EOF
@@ -308,6 +309,33 @@ image_current "$SOURCE_HASH" || fail "an image labelled with the current source
 image_current "0000000000000000" && fail "an image built from other source is not current"
 image_current "<no value>" && fail "an unlabelled image (built before this check) is not current"
 image_current "" && fail "an image with no label value is not current"
+
+# Every build must apply the label, or the image it produces is stale on
+# arrival — the plugin would rebuild on every start and the report would call a
+# freshly installed binary out of date.
+# shellcheck disable=SC2030,SC2031 # the subshell is what keeps the stubs local
+build_args() (
+  export DOCKER_ARGS_FIXTURE="$WORK/build-args"
+  PATH="$WORK/bin-docker:$PATH"
+  fn-ga-build-image "$1" >/dev/null
+  cat "$DOCKER_ARGS_FIXTURE"
+)
+
+DEFAULT_BUILD="$(build_args false)"
+grep -q -- "--label google-auth.source-hash=$SOURCE_HASH" <<<"$DEFAULT_BUILD" ||
+  fail "a build must label the image with the source hash, got: $DEFAULT_BUILD"
+grep -q -- "-t dokku-google-auth:latest" <<<"$DEFAULT_BUILD" ||
+  fail "a build must tag the service image, got: $DEFAULT_BUILD"
+grep -q -- "--no-cache" <<<"$DEFAULT_BUILD" &&
+  fail "an ordinary build should use the layer cache"
+
+FORCED_BUILD="$(build_args true)"
+grep -q -- "--no-cache" <<<"$FORCED_BUILD" || fail "a forced build should ignore the layer cache"
+# The source hash covers this plugin's files, not the images the Dockerfile
+# pulls, so a forced build that reuses a cached base image is not a fresh one.
+grep -q -- "--pull" <<<"$FORCED_BUILD" || fail "a forced build should re-pull the base images"
+grep -q -- "--label google-auth.source-hash=$SOURCE_HASH" <<<"$FORCED_BUILD" ||
+  fail "a forced build must still label the image, got: $FORCED_BUILD"
 echo "ok: service image tracks the plugin source"
 
 # --- lifecycle triggers carry per-app lists ---