image-builder: catch build/push failures, prune cache on --force

The main loop runs build_variant in an `if ! (...)` condition, which
suppresses set -e inside the subshell, so a failed docker build fell through
to push a nonexistent tag and log "Done" (seen live: a transient containerd
export lock reported success). Add explicit exit checks on docker build and
docker push in all three scripts; return non-zero so the variant is marked
failed.

Also prune the build cache before a --force full-image build: --force already
implies --no-cache, so the stale cache is dead weight that still loads the
snapshotter's lock bookkeeping and has raced the layer export. Best-effort,
never fails the build.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 11 insertions, 2 deletions

diff --git a/.extras/image-builder/build-sbo-testbuild.sh b/.extras/image-builder/build-sbo-testbuild.sh
index 4364cd5..d04c426 100755
--- a/.extras/image-builder/build-sbo-testbuild.sh
+++ b/.extras/image-builder/build-sbo-testbuild.sh
@@ -104,10 +104,19 @@ DOCKERFILE
 
     local BUILD_FLAGS=()
     [[ "${FORCE}" == "true" ]] && BUILD_FLAGS+=(--no-cache)
+    # Explicit exit checks: build_variant runs in an `if ! (...)` condition
+    # (see Main), which suppresses `set -e` in this subshell, so a failed build
+    # would otherwise push a nonexistent tag and log "Done".
     _log "  Building ${TB_TAG}..."
-    docker build "${BUILD_FLAGS[@]}" -t "${TB_TAG}" "${WORKDIR}"
+    if ! docker build "${BUILD_FLAGS[@]}" -t "${TB_TAG}" "${WORKDIR}"; then
+        _warn "  build failed for ${TB_TAG}; not pushing."
+        return 1
+    fi
     _log "  Pushing ${TB_TAG}..."
-    docker push "${TB_TAG}"
+    if ! docker push "${TB_TAG}"; then
+        _warn "  push failed for ${TB_TAG}."
+        return 1
+    fi
     _log "=== Done: ${TB_TAG} ==="
 }