fix(build): avoid cache merge allocation overflow

Author: aledbf

internal/cli/build.go

@@ -662,8 +662,8 @@ func cacheFromForDockerfileBuild(flagCacheFrom []string, cfg *config.DevContaine
 	if cfg == nil || cfg.Build == nil || len(cfg.Build.CacheFrom) == 0 {
 		return flagCacheFrom
 	}
-	combined := make([]string, 0, len(flagCacheFrom)+len(cfg.Build.CacheFrom))
-	combined = append(combined, flagCacheFrom...)
+	combined := make([]string, len(flagCacheFrom))
+	copy(combined, flagCacheFrom)
 	combined = append(combined, cfg.Build.CacheFrom...)
 	return combined
 }

internal/cli/build_cachefrom_test.go

@@ -42,10 +42,17 @@ func TestCacheFromForDockerfileBuild(t *testing.T) {
 // aliasing/appending into the caller's flag slice (which extendImageWithFeatures
 // still passes verbatim for the feature layers).
 func TestCacheFromForDockerfileBuildDoesNotMutateFlag(t *testing.T) {
-	flag := []string{"flag1"}
+	flagBacking := []string{"flag1", "sentinel"}
+	flag := flagBacking[:1]
 	cfg := &config.DevContainer{Build: &config.Build{CacheFrom: config.StringOrStrings{"cfg1"}}}
-	_ = cacheFromForDockerfileBuild(flag, cfg)
+	got := cacheFromForDockerfileBuild(flag, cfg)
 	if len(flag) != 1 || flag[0] != "flag1" {
 		t.Fatalf("flag slice mutated: %v", flag)
 	}
+	if flagBacking[1] != "sentinel" {
+		t.Fatalf("flag backing array mutated: %v", flagBacking)
+	}
+	if !reflect.DeepEqual(got, []string{"flag1", "cfg1"}) {
+		t.Fatalf("merged cache-from = %v, want [flag1 cfg1]", got)
+	}
 }