test-build: variant-namespace the dep cache and prune stale digests

The dep cache was keyed on image digest alone, so a nightly image rebuild
orphaned the old digest's cache dir forever (disk creep). Namespace it as
<variant>-<digest> and, on each run, prune superseded digests of the SAME
variant. Scoping to the variant means a --current run does not wipe the 15.0
cache, so testing both trees back-to-back still reuses built deps (e.g.
google-go-lang). Correctness was already fine (digest self-invalidates); this
just stops the accumulation, matching sbo-batch-test's invalidate-on-base-update.

Add three prune self-checks.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2 files changed, 32 insertions, 3 deletions

diff --git a/.extras/test-build b/.extras/test-build
index 26bf2a4..6c2d580 100755
--- a/.extras/test-build
+++ b/.extras/test-build
@@ -425,16 +425,32 @@ cache_label() {
   fi
 }
 
-# Compute CACHE_ROOT from the image's digest. Falls back to the tag if the
-# digest cannot be read (still isolates per image reference).
+# Compute CACHE_ROOT from the image's digest, namespaced by variant. Falls back
+# to the tag if the digest cannot be read (still isolates per image reference).
+# The dir is "<variant>-<digest>", so an image rebuild changes the digest and
+# self-invalidates the cache (deps built against the old base are never reused).
+#
+# Prune stale digests of THIS variant on the way in: a base update leaves the
+# old <variant>-<olddigest> dir orphaned, so drop it. Scoped to the variant so a
+# --current run does not wipe the 15.0 cache (both live caches survive, and
+# testing both trees back-to-back still reuses built deps).
 resolve_cache_root() {
   [[ -z "$PKG_CACHE" ]] && { CACHE_ROOT=""; return; }
   local digest
   digest="$(docker image inspect --format '{{index .Id}}' "$ACTIVE_IMAGE" 2>/dev/null)"
   [[ -z "$digest" ]] && digest="tag-${ACTIVE_IMAGE//[^a-zA-Z0-9._-]/_}"
   digest="${digest//[^a-zA-Z0-9._-]/_}"
-  CACHE_ROOT="$PKG_CACHE/$digest"
+  local name="${VERSION_ID}-${digest}"
+  CACHE_ROOT="$PKG_CACHE/$name"
   mkdir -p "$CACHE_ROOT"
+
+  # drop superseded caches for this variant only
+  local d
+  for d in "$PKG_CACHE/${VERSION_ID}-"*; do
+    [[ -d "$d" ]] || continue
+    [[ "$(basename "$d")" == "$name" ]] && continue
+    rm -rf "$d"
+  done
 }
 
 # Does SlackBuild dir $1 directly require any prog in the dead list (nameref $2)?
diff --git a/.extras/test-logic.sh b/.extras/test-logic.sh
index 469ac1d..7dc7387 100644
--- a/.extras/test-logic.sh
+++ b/.extras/test-logic.sh
@@ -181,6 +181,19 @@ CACHE_ROOT_SAVE="$CACHE_ROOT"; USE_CACHE=0
 [[ "$(cache_decision net libfoo 1.2)" == "new" ]] && ok "--no-cache disables (new)" || bad "disabled cache got [$(cache_decision net libfoo 1.2)]"
 USE_CACHE=1; CACHE_ROOT="$CACHE_ROOT_SAVE"
 
+# resolve_cache_root prunes stale digests of the SAME variant, keeps the other.
+# No docker here, so the digest falls back to the tag-derived name; seed sibling
+# dirs and confirm only the active-variant orphan is removed.
+PRUNE_CACHE=$(mktemp -d)
+PKG_CACHE="$PRUNE_CACHE"; ACTIVE_IMAGE="sbo-testbuild:current"; VERSION_ID="current"
+mkdir -p "$PRUNE_CACHE/current-oldstale" "$PRUNE_CACHE/15.0-keepme"
+resolve_cache_root
+[[ -d "$CACHE_ROOT" ]] && ok "cache root created" || bad "cache root missing"
+[[ ! -e "$PRUNE_CACHE/current-oldstale" ]] && ok "prune drops stale same-variant digest" || bad "stale current digest survived"
+[[ -d "$PRUNE_CACHE/15.0-keepme" ]] && ok "prune keeps other-variant cache" || bad "15.0 cache wrongly pruned"
+rm -rf "$PRUNE_CACHE"
+VERSION_ID="current"; CACHE_ROOT="$CACHE_ROOT_SAVE"
+
 # --- BLOCKED-BY-DEP (depends_on_failed) -------------------------------------
 dead=(b)
 if depends_on_failed "$T/cat/g" dead; then ok "g blocked when b dead"; else bad "g should block on b"; fi