By: Michael Lynch <git@mtlynch.io>
Test Dockerfile as impure NixCI job Replace the pure docker-image derivation with a runnable wrapper that NixCI can execute as an impure test. The test runs Kaniko against the real Dockerfile from an in-repository checkout, so registry pulls, Go module downloads, and apk installs happen outside the pure Nix build sandbox.