Keep going past unreadable files with check --continue (closes #11)

With --continue, check stopped at the first file whose content or
checksum attribute it could not read, and at the first directory it
could not list. Each of these now counts as failed, its error, which
names the path, goes to stderr, and the walk goes on; the run still
exits non-zero. The walk shared with sum and clear takes the continue
setting, and they pass false. If the count that sizes the progress bar
cannot read a path, check --continue runs without the bar. Without
--continue the first such error still stops the run, and the summary
printed before it now counts an unreadable checksum attribute as
failed, as it already did for unreadable content.

Model: opus-5-5

.dockerignore

@@ -0,0 +1,63 @@
+# .dockerignore does NOT use .gitignore semantics. Docker matches with
+# moby/patternmatcher: filepath.Match plus `**`, so `*` does not cross
+# `/` and an unprefixed pattern is anchored at the context root. Every
+# depth-independent pattern therefore needs `**/`, or `config/.env` and
+# `certs/server.key` still ship while this file reads as solved. Only
+# genuinely root-anchored entries go unprefixed. Never transplant these
+# into .gitignore, where `**/` is wrong.
+#
+# Matching is case-sensitive, so secrets use character ranges rather
+# than an ALL-CAPS twin, which would still miss `Server.Key`.
+#
+# Extend with this repo's own host-built artifacts, written anchored:
+# `/myapp`, never `**/myapp`, which also matches `cmd/myapp/` and
+# deletes the package directory from the context.
+
+# .git is sent without its config. Without a VERSION build argument the
+# stage that compiles runs `git describe --tags --always` on .git, which
+# does not need .git/config; that file can hold a credential, such as a
+# password in a remote URL or the token the CI checkout step stores there.
+.git/config
+
+# Agent scratch: one full checkout of the repo per in-flight agent.
+# Anchored because it occurs once where agents run at the repo root.
+# KNOWN GAP: a repo running agents in subdirectories still ships
+# `services/api/.claude/` and must add its own anchored entry.
+.claude
+
+# Environment files. `*.env` covers bare `.env` and the `prod.env`
+# convention. Re-include a committed template with a negation if the
+# build needs one: `!docs/example.env`.
+**/*.[eE][nN][vV]
+**/.[eE][nN][vV].*
+**/.[eE][nN][vV][rR][cC]
+
+# Private keys and the bundles carrying them. Public certificates
+# (*.crt, *.cer) are deliberately absent: they are legitimate inputs.
+**/*.[pP][eE][mM]
+**/*.[kK][eE][yY]
+**/*.[pP]12
+**/*.[pP][fF][xX]
+**/[iI][dD]_[rR][sS][aA]
+**/[iI][dD]_[dD][sS][aA]
+**/[iI][dD]_[eE][cC][dD][sS][aA]
+**/[iI][dD]_[eE][dD]25519
+
+# Dependencies: restored inside the image, never copied in.
+**/node_modules
+
+# OS metadata.
+**/.DS_Store
+**/Thumbs.db
+
+# Editor state: never a build input, and it churns COPY.
+**/*.swp
+**/*.swo
+**/*~
+**/*.bak
+**/.idea
+**/.vscode
+**/*.sublime-*
+
+# This repo's host-built binary (`make build`); the image builds its own.
+/attrsum

.gitea/workflows/check.yml

@@ -6,4 +6,8 @@ jobs:
         steps:
             # actions/checkout v4.2.2, 2026-02-28
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+              # Full history and tags, so the build stamps the same
+              # `git describe` version as a full clone.
+              with:
+                  fetch-depth: 0
             - run: script/cibuild

Dockerfile

@@ -29,7 +29,21 @@ RUN make check
 
 # Build the binary (still as the unprivileged user: it owns /src, so git VCS
 # stamping sees consistent ownership).
-RUN make build
+#
+# The version stamped into the binary: the VERSION build argument when one
+# is given, otherwise `git describe --tags --always` of the .git the build
+# context carries: the tag on a tagged commit, tag-N-gHASH on a commit after
+# one, the short commit when no tag is reachable. A context that carries .git
+# and still yields no version fails the build. With neither, as from a source
+# tarball, the binary reports dev.
+ARG VERSION
+RUN version="${VERSION:-$(git describe --tags --always)}"; \
+    if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \
+        [ "$version" = unknown ]; }; then \
+        echo "version is '$version' although .git is present" >&2; \
+        exit 1; \
+    fi; \
+    make build VERSION="${version:-dev}"
 
 # Runtime stage
 # alpine 3.21, 2026-02-28

Makefile

@@ -1,6 +1,9 @@
 .PHONY: default bootstrap setup test lint fmt fmt-check check docker hooks build clean try
 
-TESTDIR := $(HOME)/Documents/_SYSADMIN/cyberdyne
+# The version `make build` stamps into the binary: the git tag or short
+# commit, -dirty with uncommitted changes. `make build VERSION=x` stamps x,
+# which is how the Dockerfile passes its version in.
+VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
 
 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern.
@@ -35,18 +38,27 @@ hooks:
 	@script/install-precommit
 
 build: clean
-	@go build .
+	@go build -ldflags "-X main.Version=$(VERSION)" .
 
 clean:
 	@rm -f attrsum
 
+# Runs the binary on three small files in a new temporary directory, which
+# the trap removes when the recipe ends, also when a step fails. The check
+# after clear is expected to fail, so its exit status is ignored.
 try: build
-	./attrsum sum add -v $(TESTDIR)
-	./attrsum check -v $(TESTDIR)
-	./attrsum clear -v $(TESTDIR)
-	-./attrsum check -v $(TESTDIR)
-	./attrsum sum add -v $(TESTDIR)
-	./attrsum check -v $(TESTDIR)
-	touch $(TESTDIR)/*
-	./attrsum sum update -v $(TESTDIR)
-	./attrsum check -v $(TESTDIR)
+	@set -ex; \
+	dir=$$(mktemp -d); \
+	trap 'rm -rf "$$dir"' EXIT; \
+	echo one >"$$dir/a"; \
+	echo two >"$$dir/b"; \
+	echo three >"$$dir/c"; \
+	./attrsum sum add -v "$$dir"; \
+	./attrsum check -v "$$dir"; \
+	./attrsum clear -v "$$dir"; \
+	./attrsum check -v "$$dir" || true; \
+	./attrsum sum add -v "$$dir"; \
+	./attrsum check -v "$$dir"; \
+	touch "$$dir"/*; \
+	./attrsum sum update -v "$$dir"; \
+	./attrsum check -v "$$dir"

TODO.md

@@ -20,12 +20,21 @@ have landed since the tag.
 Policy scaffold commit: add LICENSE, REPO_POLICIES.md, .editorconfig,
 .golangci.yml, and a comprehensive .gitignore (currently only the
 attrsum binary), and extend the Makefile (only test/build/clean/try
-today) with lint, fmt, fmt-check, check, and hooks targets. Fix the try
-target to use a temp fixture instead of the hardcoded
-$(HOME)/Documents/_SYSADMIN/cyberdyne path.
+today) with lint, fmt, fmt-check, check, and hooks targets.
 
 # Completed Steps
 
+* 2026-10-06: `check --continue` keeps going past a file or directory
+    it cannot read: it counts it as failed, prints the error and the
+    path on stderr, and checks the rest of the tree
+* 2026-10-05: `make try` runs on three small files in a temporary
+    directory that it removes afterwards, also when a step fails,
+    instead of on a fixed directory on one person's machine
+* 2026-10-02: `attrsum --version` reports the git tag or short commit,
+    stamped by `make build` and by a plain `docker build .` of a clone;
+    `.dockerignore` sends `.git` without `.git/config` and keeps a
+    host-built `attrsum` out; CI checks out full history so it stamps
+    the same version
 * 2026-02-02: correctness pass: track actual bytes read instead of
     stale file size, atomic failure tracking in ProcessCheck, detect
     file modification during checksum (TOCTOU), propagate countFiles
@@ -39,8 +48,6 @@ $(HOME)/Documents/_SYSADMIN/cyberdyne path.
 
 # Future Steps
 
-* Add Dockerfile and .dockerignore that run make check, images pinned
-    by sha256, plus a Makefile docker target
 * Add .gitea/workflows/check.yml
 * Restructure README.md into the standard sections: Description,
     Getting Started, Rationale, Design, TODO, License, Author (Getting

attrsum.go

@@ -36,6 +36,10 @@ const (
 	progressThrottle = 250 * time.Millisecond
 )
 
+// Version is the git tag or short commit, set at link time with -X by
+// `make build`. A build that does not set it reports dev.
+var Version = "dev" //nolint:gochecknoglobals // set at link time with -X
+
 // Sentinel errors returned by the command implementations.
 var (
 	errNoPaths           = errors.New("no paths provided")
@@ -101,8 +105,9 @@ func main() {
 	opts := &options{}
 
 	rootCmd := &cobra.Command{
-		Use:   "attrsum",
-		Short: "Compute and verify file checksums via xattrs",
+		Use:     "attrsum",
+		Short:   "Compute and verify file checksums via xattrs",
+		Version: Version,
 	}
 	rootCmd.SilenceUsage = true
 	rootCmd.SilenceErrors = true
@@ -254,7 +259,7 @@ func newSumCmd(opts *options) *cobra.Command {
 }
 
 func processSumAdd(opts *options, dir string, stats *Stats, bar *progressbar.ProgressBar) error {
-	return walkAndProcess(opts, dir, stats, bar, func(p string, info os.FileInfo, s *Stats) error {
+	return walkAndProcess(opts, dir, false, stats, bar, func(p string, info os.FileInfo, s *Stats) error {
 		if hasXattr(p, checksumKey) {
 			atomic.AddInt64(&s.FilesSkipped, 1)
 
@@ -273,7 +278,7 @@ func processSumAdd(opts *options, dir string, stats *Stats, bar *progressbar.Pro
 }
 
 func processSumUpdate(opts *options, dir string, stats *Stats, bar *progressbar.ProgressBar) error {
-	return walkAndProcess(opts, dir, stats, bar, func(p string, info os.FileInfo, s *Stats) error {
+	return walkAndProcess(opts, dir, false, stats, bar, func(p string, info os.FileInfo, s *Stats) error {
 		t, err := readSumTime(p)
 		if err != nil || info.ModTime().After(t) {
 			werr := writeChecksumAndTime(opts, p, info, s)
@@ -364,7 +369,7 @@ func newClearCmd(opts *options) *cobra.Command {
 }
 
 func processClear(opts *options, dir string, stats *Stats, bar *progressbar.ProgressBar) error {
-	return walkAndProcess(opts, dir, stats, bar, func(p string, info os.FileInfo, s *Stats) error {
+	return walkAndProcess(opts, dir, false, stats, bar, func(p string, info os.FileInfo, s *Stats) error {
 		cleared, err := clearOne(opts, p)
 		if err != nil {
 			atomic.AddInt64(&s.FilesFailed, 1)
@@ -444,8 +449,10 @@ func runCheck(opts *options, args []string, cont bool) error {
 	var bar *progressbar.ProgressBar
 
 	if !opts.quiet {
+		// With --continue, a path the count cannot read leaves the run
+		// without a progress bar; the walk below reports it as failed.
 		bar, err = countAndBar(opts, paths, "Verifying checksums")
-		if err != nil {
+		if err != nil && !cont {
 			return err
 		}
 	}
@@ -476,7 +483,7 @@ func processCheck(opts *options, dir string, cont bool, stats *Stats, bar *progr
 	// Track initial failed count to detect failures during this walk.
 	initialFailed := atomic.LoadInt64(&stats.FilesFailed)
 
-	err := walkAndProcess(opts, dir, stats, bar, func(p string, _ os.FileInfo, s *Stats) error {
+	err := walkAndProcess(opts, dir, cont, stats, bar, func(p string, _ os.FileInfo, s *Stats) error {
 		return checkOne(opts, p, cont, s)
 	})
 	if err != nil {
@@ -500,7 +507,7 @@ func checkOne(opts *options, p string, cont bool, s *Stats) error {
 	exp, err := xattr.Get(p, checksumKey)
 	if err != nil {
 		if !errors.Is(err, xattr.ENOATTR) {
-			return err
+			return unreadable(cont, s, err)
 		}
 
 		return missingChecksum(opts, p, cont, s)
@@ -508,9 +515,7 @@ func checkOne(opts *options, p string, cont bool, s *Stats) error {
 
 	act, bytesRead, err := fileMultihash(p)
 	if err != nil {
-		atomic.AddInt64(&s.FilesFailed, 1)
-
-		return err
+		return unreadable(cont, s, err)
 	}
 
 	ok := bytes.Equal(exp, act)
@@ -546,6 +551,21 @@ func missingChecksum(opts *options, p string, cont bool, s *Stats) error {
 	return errVerification
 }
 
+// unreadable counts a file or directory that could not be read as failed.
+// With --continue it prints err, which names the path, to stderr and
+// returns nil so the walk goes on; otherwise it returns err.
+func unreadable(cont bool, s *Stats, err error) error {
+	atomic.AddInt64(&s.FilesFailed, 1)
+
+	if !cont {
+		return err
+	}
+
+	log.Print(err)
+
+	return nil
+}
+
 // reportCheck prints a per-file verification result when verbose output is on.
 func reportCheck(opts *options, p, actual string, ok bool) {
 	if !opts.verbose || opts.quiet {
@@ -645,6 +665,7 @@ func newProgressBar(total int64, description string) *progressbar.ProgressBar {
 func walkAndProcess(
 	opts *options,
 	root string,
+	cont bool,
 	stats *Stats,
 	bar *progressbar.ProgressBar,
 	fn func(string, os.FileInfo, *Stats) error,
@@ -653,7 +674,7 @@ func walkAndProcess(
 
 	return filepath.Walk(root, func(p string, info os.FileInfo, err error) error {
 		if err != nil {
-			return err
+			return unreadable(cont, stats, err)
 		}
 
 		skip, skipErr := walkSkip(opts, root, p, info)

attrsum_test.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 	"strings"
@@ -271,3 +272,51 @@ func TestPermissionErrors(t *testing.T) {
 		t.Fatalf("expected permission error on check, got nil")
 	}
 }
+
+func TestCheckContinuePastUnreadable(t *testing.T) {
+	t.Parallel()
+
+	opts := &options{}
+	dir := t.TempDir()
+	skipIfNoXattr(t, dir)
+
+	writeFile(t, dir, "a.txt", "one")
+	secret := writeFile(t, dir, "b.txt", "two")
+	writeFile(t, dir, "c/d.txt", "three")
+	writeFile(t, dir, "e.txt", "four")
+
+	err := processSumAdd(opts, dir, newTestStats(), nil)
+	if err != nil {
+		t.Fatalf("add: %v", err)
+	}
+
+	// An unreadable file and an unlistable directory sit between the
+	// readable files a.txt and e.txt.
+	sub := filepath.Join(dir, "c")
+
+	err = os.Chmod(secret, noPerm)
+	if err != nil {
+		t.Fatalf("chmod file: %v", err)
+	}
+
+	defer func() { _ = os.Chmod(secret, filePerm) }()
+
+	err = os.Chmod(sub, noPerm)
+	if err != nil {
+		t.Fatalf("chmod dir: %v", err)
+	}
+
+	defer func() { _ = os.Chmod(sub, dirPerm) }()
+
+	stats := newTestStats()
+
+	err = processCheck(opts, dir, true, stats, nil)
+	if !errors.Is(err, errVerification) {
+		t.Fatalf("expected verification error, got %v", err)
+	}
+
+	if stats.FilesProcessed != 2 || stats.FilesFailed != 2 {
+		t.Fatalf("expected 2 verified and 2 failed, got %d and %d",
+			stats.FilesProcessed, stats.FilesFailed)
+	}
+}

script/docker

@@ -1,6 +1,8 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
 # Identical in all repos; the tag comes from script/projectname.
+# --no-cache because the gate phases the final stage depends on are RUN
+# steps, and a cached one is a check that did not run.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -8,7 +10,15 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build -t "$("$SCRIPT_DIR/projectname")" .
+    # Own line: a failing command substitution inside an argument does
+    # not trip `set -e`, so the inline form degrades silently to an
+    # empty constant. The VERSION build argument takes precedence over
+    # the version a build stage derives from the .git in the context.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    docker build --no-cache \
+        --build-arg VERSION="$version" \
+        -t "$("$SCRIPT_DIR/projectname")" .
 }
 
 main "$@"