build: add ESLint to script/lint and containerize linting (closes #152)

script/lint

@@ -1,13 +1,51 @@
 #!/bin/sh
-# script/lint: run the linter.
+# script/lint: run the linter (eslint, then prettier --check).
+#
+# Linting is containerized. ESLint results depend on the ESLint version, and
+# the pinned one is the one in the image; a host's own install must not be
+# able to decide whether this repo is green. From a host this therefore builds
+# the Dockerfile's `lint` stage, which runs this same script inside the image.
+#
+# AUTISTMASK_LINT_NATIVE is set only in that image (see the Dockerfile) and is
+# what stops the recursion, so `make check` inside the CI build lints in place
+# instead of trying to reach a docker daemon it does not have.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    echo "Linting..."
-    yarn run lint 2>&1
+
+    case "${AUTISTMASK_LINT_NATIVE:-}" in
+    1)
+        echo "Linting..."
+        yarn run lint 2>&1
+        return 0
+        ;;
+    "") ;;
+    *)
+        # Set but not recognized: say so rather than silently taking the
+        # docker path, which would look like the variable had no effect.
+        echo "lint: AUTISTMASK_LINT_NATIVE is set to" \
+            "'${AUTISTMASK_LINT_NATIVE}'; the only recognized value is 1" >&2
+        exit 1
+        ;;
+    esac
+
+    if ! command -v docker >/dev/null 2>&1; then
+        echo "lint: docker is required; linting does not run on the host" >&2
+        exit 1
+    fi
+
+    echo "Linting in the pinned container..."
+    # --progress=plain: the default progress renderer collapses the lint
+    # output on success, and a lint run whose output cannot be seen is not
+    # evidence that it ran.
+    #
+    # --output=type=cacheonly: the exit status is the whole result; exporting
+    # an image afterwards costs about ten times the lint itself.
+    docker build --progress=plain --target lint \
+        --output=type=cacheonly . 2>&1
 }
 
 main "$@"