Well now I'm curious how the push-docker-image step is implemented...? :-) `bazel run` just builds the specified target (a normal hermetic build) and then exec

Well now I'm curious how the push-docker-image step is implemented...? :-) `bazel run` just builds the specified target (a normal hermetic build) and then executes what it just built (not hermetic). But if you're actually pushing images to somewhere as part of the build itself (not pushing as part of whatever the app_prod.apply tool does) then that sounds like a non-hermetic/non-reproducible build step, which makes me think there's something happening that I don't understand. Sounds interesting.