sneak
7f75f2ee72
All checks were successful
check / check (push) Successful in 35s
Fix every golangci-lint finding under the repo's standard .golangci.yml (from ~192 down to 0 under the pinned v2.10.1) without changing program behavior: - gochecknoglobals: replace the verbose/quiet/exclude* package globals with an options struct threaded through the command implementations. - err113: introduce package-level sentinel errors and wrap them with %w. - errcheck: check or explicitly discard every previously unchecked error (bar.Add/Finish, deferred Close, verbose writes). - forbidigo: route verbose output through os.Stdout instead of fmt.Print*. - noinlineerr / wsl_v5 / nlreturn / gofmt: split inline error checks and normalize whitespace. - complexity (cyclop/gocognit/nestif): extract small behavior-preserving helpers (runOverPaths, countAndBar, walkSkip, clearOne, checkOne, missingChecksum, reportCheck). - mnd/lll/nonamedreturns/revive/modernize/nilnil: named constants, wrapped lines, unnamed returns, doc comments, SplitSeq, non-(nil,nil) returns. - paralleltest/thelper: mark tests parallel (now race-safe with no shared globals) and add t.Helper(); probe the real xattr key so the guard is accurate. Also make the tests actually runnable in CI rather than skipping: - move the xattr keys into the user.* namespace (user.berlin.sneak.app.*), which Linux requires for regular-file xattrs; macOS treats the whole string as an opaque name, so behavior is unchanged there. - run the Docker builder's checks as an unprivileged user so the permission tests are meaningful (root bypasses file mode bits).
45 lines
1.4 KiB
Docker
45 lines
1.4 KiB
Docker
# Build stage
|
|
# golang 1.25-alpine, 2026-02-28
|
|
FROM golang@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4ced AS builder
|
|
|
|
RUN apk add --no-cache git make gcc musl-dev binutils-gold
|
|
|
|
# golangci-lint v2.10.1
|
|
RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee
|
|
# goimports v0.42.0
|
|
RUN go install golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0
|
|
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
# Run the checks as an unprivileged user. Root bypasses file mode bits, which
|
|
# would make the permission tests (expecting EACCES on a 0000 file) spuriously
|
|
# pass with no error. Caches live under /tmp (world-writable) so the user needs
|
|
# no home directory of its own.
|
|
ENV GOCACHE=/tmp/gocache
|
|
ENV XDG_CACHE_HOME=/tmp/xdgcache
|
|
RUN adduser -D -u 1000 builder && chown -R builder:builder /src /go
|
|
USER builder
|
|
|
|
# Run all checks - build fails if any check fails
|
|
RUN make check
|
|
|
|
# Build the binary (still as the unprivileged user: it owns /src, so git VCS
|
|
# stamping sees consistent ownership).
|
|
RUN make build
|
|
|
|
# Runtime stage
|
|
# alpine 3.21, 2026-02-28
|
|
FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
|
|
|
|
RUN apk add --no-cache ca-certificates tzdata
|
|
|
|
WORKDIR /app
|
|
|
|
COPY --from=builder /src/attrsum /app/attrsum
|
|
|
|
ENTRYPOINT ["/app/attrsum"]
|