sneak/AutistMask
1
0
Fork 0
Code Issues 42 Pull Requests 8 Actions Packages Projects Releases Wiki Activity

chore: repo policy compliance sweep — test rerun pattern, yarn/npx, frozen lockfile, undocumented targets #166

New Issue
Closed
opened 2026-08-09 03:47:55 +02:00 by clawbot · 0 comments
clawbot commented 2026-08-09 03:47:55 +02:00
Collaborator
Copy Link

Problem

A full audit against REPO_POLICIES.md and
prompts/EXISTING_REPO_CHECKLIST.md found no blockers — hash pinning is
clean (Dockerfile pinned by @sha256 with a version/date comment; the Gitea
workflow action pinned to a full commit SHA; script/bootstrap fetches a
pinned, hash-verified nvm archive with no curl | sh; all 412 yarn.lock
entries carry integrity hashes), all twelve script/ entrypoints exist and are
POSIX-clean with main() functions, .gitignore is a superset of the
canonical one, and make check does not mutate the tree.

This issue collects the remaining small divergences. Note this repo is
Go-free (no .go files, no go.mod), so all Go policies — including the
org-standard .golangci.yml — are correctly N/A and must not be added.

Items to fix

1. make test is missing the conditional verbose rerun pattern (MAJOR).
REPO_POLICIES.md:196-229 requires running tests without -v first and
automatically rerunning with -v on failure, then exit 1. script/test:7-11
is just:

main() {
    cd "$ROOT"
    echo "Running tests..."
    timeout 30 yarn run test 2>&1
}

Add the rerun. The jest invocation is jest --forceExit (package.json:9), so
the verbose form is jest --forceExit --verbose. Keep the existing 30-second
timeout, which is already correct.

2. build.js:65 shells out to npx (MINOR).

`npx @tailwindcss/cli -i ${tailwindInput} -o ${tailwindOutput} --minify`,

REPO_POLICIES.md:268 says "Use yarn, not npm", and npx will fetch from
the registry if the local binary is absent — an unpinned network fetch during
build. It only resolves locally today because @tailwindcss/cli is a
devDependency. Replace with yarn run or a direct node_modules/.bin path.

3. make install does not use --frozen-lockfile (MINOR).
Makefile:13-14 runs bare yarn install, while script/bootstrap:121-128
correctly uses yarn install --frozen-lockfile. Worse, README.md:31-35
Getting Started steers new users to make install + make build rather than
the policy-canonical make setup — so a fresh clone following the README never
installs the pre-commit hook and can silently mutate yarn.lock.

Fix both: make make install frozen, and update the README Getting Started to
use make setup.

4. make clean and make dev are undocumented (MINOR).
Makefile:41-46 defines both; neither appears in README.md.
REPO_POLICIES.md:83-90 makes the Makefile authoritative documentation and
requires a contributor to be able to understand the whole workflow from it.
Document them in the README Entrypoints section (or a Makefile-targets
section), noting they are Makefile-only conveniences.

5. script/check, script/precommit, script/setup compute SCRIPT_DIR
but never cd to the repo root (MINOR).
REPO_POLICIES.md:47-49 requires locating the root and cd-ing there before
acting. Harmless today because each child script does cd "$ROOT" itself, and
these three are byte-identical to the canonical templates upstream. Fix only
if it can be done without diverging from the canonical templates — if the
upstream prompts templates have the same shape, leave them alone and say so
in the PR rather than creating a local fork of a shared file.

Explicitly out of scope

  • script/bootstrap:113-118's npm install -g yarn@… fallback: version-pinned
    and identical to the canonical upstream template. Leave it; it is an upstream
    concern.
  • .dockerignore omitting .git: this is deliberate and load-bearing —
    build.js:20,28 shells out to git rev-parse for build-info stamping and
    Dockerfile:17 runs make build, so excluding .git would make every built
    extension report commitHash: "unknown". Do not "fix" this. Add a
    one-line comment to .dockerignore recording why .git is intentionally
    present, so nobody removes it later.
  • build.js living in the repo root, and TODO.md/RULES.md not being on the
    root-cleanliness allowlist: raised separately; do not move files here.
  • runs-on: ubuntu-latest in the workflow: matches the canonical template.

Definition of done

  • script/test implements the verbose rerun pattern and still exits
    non-zero on failure. Demonstrate in the PR with a deliberately failing
    test that the rerun output appears and the target fails.
  • make test still completes within 30 seconds on success.
  • No npx invocation remains in build.js; the build still produces
    working Tailwind CSS output for both targets.
  • make install uses --frozen-lockfile.
  • README Getting Started directs new users to make setup.
  • make clean and make dev are documented in the README.
  • .dockerignore carries a comment explaining why .git is included.
  • The SCRIPT_DIR item is either fixed or explicitly deferred with the
    template-divergence reasoning stated in the PR.
  • make check passes and modifies no files.
  • make build still produces working dist/chrome and dist/firefox
    artifacts.
  • TODO.md updated in the same commit.
## Problem A full audit against `REPO_POLICIES.md` and `prompts/EXISTING_REPO_CHECKLIST.md` found **no blockers** — hash pinning is clean (Dockerfile pinned by `@sha256` with a version/date comment; the Gitea workflow action pinned to a full commit SHA; `script/bootstrap` fetches a pinned, hash-verified nvm archive with no `curl | sh`; all 412 `yarn.lock` entries carry integrity hashes), all twelve `script/` entrypoints exist and are POSIX-clean with `main()` functions, `.gitignore` is a superset of the canonical one, and `make check` does not mutate the tree. This issue collects the remaining small divergences. Note this repo is **Go-free** (no `.go` files, no `go.mod`), so all Go policies — including the org-standard `.golangci.yml` — are correctly N/A and must not be added. ## Items to fix **1. `make test` is missing the conditional verbose rerun pattern (MAJOR).** `REPO_POLICIES.md:196-229` requires running tests without `-v` first and automatically rerunning with `-v` on failure, then `exit 1`. `script/test:7-11` is just: ```sh main() { cd "$ROOT" echo "Running tests..." timeout 30 yarn run test 2>&1 } ``` Add the rerun. The jest invocation is `jest --forceExit` (`package.json:9`), so the verbose form is `jest --forceExit --verbose`. Keep the existing 30-second `timeout`, which is already correct. **2. `build.js:65` shells out to `npx` (MINOR).** ```js `npx @tailwindcss/cli -i ${tailwindInput} -o ${tailwindOutput} --minify`, ``` `REPO_POLICIES.md:268` says "Use `yarn`, not `npm`", and `npx` will fetch from the registry if the local binary is absent — an unpinned network fetch during build. It only resolves locally today because `@tailwindcss/cli` is a devDependency. Replace with `yarn run` or a direct `node_modules/.bin` path. **3. `make install` does not use `--frozen-lockfile` (MINOR).** `Makefile:13-14` runs bare `yarn install`, while `script/bootstrap:121-128` correctly uses `yarn install --frozen-lockfile`. Worse, `README.md:31-35` Getting Started steers new users to `make install` + `make build` rather than the policy-canonical `make setup` — so a fresh clone following the README never installs the pre-commit hook and can silently mutate `yarn.lock`. Fix both: make `make install` frozen, and update the README Getting Started to use `make setup`. **4. `make clean` and `make dev` are undocumented (MINOR).** `Makefile:41-46` defines both; neither appears in `README.md`. `REPO_POLICIES.md:83-90` makes the Makefile authoritative documentation and requires a contributor to be able to understand the whole workflow from it. Document them in the README Entrypoints section (or a Makefile-targets section), noting they are Makefile-only conveniences. **5. `script/check`, `script/precommit`, `script/setup` compute `SCRIPT_DIR` but never `cd` to the repo root (MINOR).** `REPO_POLICIES.md:47-49` requires locating the root and `cd`-ing there before acting. Harmless today because each child script does `cd "$ROOT"` itself, and these three are byte-identical to the canonical templates upstream. **Fix only if it can be done without diverging from the canonical templates** — if the upstream `prompts` templates have the same shape, leave them alone and say so in the PR rather than creating a local fork of a shared file. ## Explicitly out of scope - `script/bootstrap:113-118`'s `npm install -g yarn@…` fallback: version-pinned and identical to the canonical upstream template. Leave it; it is an upstream concern. - `.dockerignore` omitting `.git`: this is deliberate and load-bearing — `build.js:20,28` shells out to `git rev-parse` for build-info stamping and `Dockerfile:17` runs `make build`, so excluding `.git` would make every built extension report `commitHash: "unknown"`. **Do not "fix" this.** Add a one-line comment to `.dockerignore` recording why `.git` is intentionally present, so nobody removes it later. - `build.js` living in the repo root, and `TODO.md`/`RULES.md` not being on the root-cleanliness allowlist: raised separately; do not move files here. - `runs-on: ubuntu-latest` in the workflow: matches the canonical template. ## Definition of done - [ ] `script/test` implements the verbose rerun pattern and still exits non-zero on failure. Demonstrate in the PR with a deliberately failing test that the rerun output appears and the target fails. - [ ] `make test` still completes within 30 seconds on success. - [ ] No `npx` invocation remains in `build.js`; the build still produces working Tailwind CSS output for both targets. - [ ] `make install` uses `--frozen-lockfile`. - [ ] README Getting Started directs new users to `make setup`. - [ ] `make clean` and `make dev` are documented in the README. - [ ] `.dockerignore` carries a comment explaining why `.git` is included. - [ ] The `SCRIPT_DIR` item is either fixed or explicitly deferred with the template-divergence reasoning stated in the PR. - [ ] `make check` passes and modifies no files. - [ ] `make build` still produces working `dist/chrome` and `dist/firefox` artifacts. - [ ] `TODO.md` updated in the same commit.
clawbot added this to the 1.0.0 milestone 2026-08-09 03:47:55 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
merge-ready
needs-checks
needs-rebase
needs-review
needs-rework
No Label
Milestone
No items
No Milestone 1.0.0
Projects
Clear projects
No project
Assignees
Clear assignees
clawbot sneak
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/AutistMask#166
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?