Stale build cache leads to outdated dependencies after scalingo rebuild

Guaranteeing a Fresh Build

To guarantee that every Scalingo deploy uses only current source code and dependencies, use the scalingo rebuild command. This command explicitly instructs the platform to discard cached build layers and re-execute the buildpack process from scratch.

Cache Behavior and Reliability

The scalingo rebuild command is designed to be reliable across both free and paid plans. While plan tiers may differ in build speed or resource allocation, the logic for cache invalidation remains consistent: it forces the buildpack to re-evaluate dependency manifests (such as package.json, Gemfile, or requirements.txt) rather than reusing a previously computed layer.

Potential Causes of Persistent "Stale" Dependencies

If dependencies still appear outdated after a rebuild, the issue is likely not the Scalingo build cache, but rather one of the following:

• Non-Deterministic Versioning: Using latest or wide version ranges (e.g., ^1.0.0) in your manifest. If the upstream registry has not updated the package, the buildpack will pull the same version again, mimicking a cached state.
• Lockfile Mismatches: If a lockfile (e.g., package-lock.json) is committed to the repository, the buildpack will prioritize the versions locked there over the ranges defined in the manifest.
• External Proxies: External dependency mirrors or corporate proxies may serve cached versions of packages regardless of the PaaS build state.

Note on Environment Variables: Variables like DATABASE_URL are typically injected at container start-up (runtime) and do not influence build-time layer caching.

Verification Without Build Logs

To confirm a fresh build occurred without inspecting logs, use these methods:

1. Runtime Inspection: Use the Scalingo CLI to open a shell in the running container and list the actual installed versions:

   scalingo ssh
   # For Node.js:
   npm list --depth=0
   # For Ruby:
   bundle list
   

2. Build-Time Artifacts: Add a temporary step to your build process (or a script in your manifest) that writes the current timestamp to a file. Verify the timestamp exists and is current via scalingo ssh.
3. Image Hash Comparison: Compare the image ID/hash of the deployment before and after the rebuild. A change in the hash confirms a new image was generated.

Diagnostic Requirement

Are you using a lockfile (e.g., yarn.lock, Gemfile.lock) in your repository? If so, the rebuild will strictly adhere to that file, which may be the source of the "stale" versions.