sneak
90f188c256
REPO_POLICIES.md lists the files every repo must contain at minimum; four were missing here and .gitignore covered only Hugo's outputs. REPO_POLICIES.md is a byte-identical copy of the canonical file in the prompts repo, YAML front matter (title, last_modified) intact so it can be diffed against upstream as policy evolves. It is not clean under this repo's prettier settings, so the reformat is the next commit rather than churn mixed in here; the byte-identical copy is what landed. .editorconfig, .prettierrc and .prettierignore are the canonical contents. script/fmt and script/fmt-check keep passing --tab-width 4 --prose-wrap always on the command line: the duplication is deliberate so the scripts still work standalone when copied as a template, and the values agree, so adding .prettierrc changes nothing about what make fmt does. .gitignore keeps its three Hugo lines and gains the canonical OS/editor/node/secrets block plus .claude/. The secrets patterns are the point: a stray .env or private key can no longer be committed by a broad git add. .claude/ holds worktrees/, so without it a clean checkout with agent tooling present is not git status-clean. .dockerignore gains the same coverage but not the same syntax. It does not use .gitignore semantics: it matches with Go's filepath.Match rules extended with **, where * does not cross / and an unprefixed pattern is anchored at the context root. A bare *.key therefore excludes ./server.key and ships ./certs/server.key into the image, which is worse than an obviously incomplete file because it reads as complete. Every depth-independent pattern here carries an explicit **/ prefix; only the entries that are genuinely root-anchored by definition go bare - .git, Hugo's public and resources output directories, and .hugo_build.lock. The distinction is spelled out in a comment at the top of the file so the next edit does not quietly undo it. Excluding .claude/ also keeps entire additional checkouts of this repo out of the build context, which the Dockerfile's COPY . . would otherwise copy into the image. Verified by planting .env, server.key, deep.pem and node_modules two directories deep and building: with the patterns unprefixed all of them reach /src in the image, with **/ none do. Root-only testing does not exercise this and produces a false pass.
153 lines
9.3 KiB
Markdown
153 lines
9.3 KiB
Markdown
# Workflow
|
|
|
|
- branch (from `main`)
|
|
- do the work in Next Step
|
|
- move Next Step to the top of Completed Steps
|
|
- move the top item of Future Steps into Next Step
|
|
- commit (`TODO.md` changes in the same commit as the work)
|
|
- merge to `main` if the branch is not protected, otherwise open a PR
|
|
- push
|
|
|
|
# Status
|
|
|
|
pre-1.0
|
|
|
|
No git tags. The site is live and now has the scripts-to-rule-them-all scaffold
|
|
(`Makefile`, `script/`, `Dockerfile`, `check.yml`) and the canonical policy
|
|
dotfiles; `LICENSE` is the only mandated file still missing. Every external
|
|
reference in the repo is now pinned by cryptographic hash (or, for the wrangler
|
|
CLI install, an exact version), and the Hugo that builds the published site is a
|
|
deliberate pinned version rather than whatever the base image's package repo
|
|
serves.
|
|
|
|
# Next Step
|
|
|
|
Add `LICENSE` (#10) and replace the README's "content is provided as-is" note
|
|
with the committed license. Blocked on the owner's choice of license — the
|
|
remaining policy scaffold is otherwise complete.
|
|
|
|
# Completed Steps
|
|
|
|
- 2026-08-09: added the canonical policy dotfiles and hardened both ignore files
|
|
(closes #8). `REPO_POLICIES.md` is a byte-identical copy of the canonical
|
|
`prompts` file, front matter intact; `.editorconfig`, `.prettierrc` and
|
|
`.prettierignore` are the canonical contents. `.gitignore` keeps its three
|
|
Hugo lines and gains the OS/editor/node/secrets block plus `.claude/`, so a
|
|
clean checkout with agent tooling present is `git status`-clean and a stray
|
|
key or `.env` can no longer be committed. `.dockerignore` gained the same
|
|
coverage but **not** the same syntax: it matches with Go's `filepath.Match`
|
|
rules extended with `**`, where `*` does not cross `/` and an unprefixed
|
|
pattern is anchored at the context root, so every depth-independent pattern
|
|
carries an explicit `**/` prefix and only the genuinely root-anchored entries
|
|
(`.git`, `public`, `resources`, `.hugo_build.lock`) go bare. Verified by
|
|
planting `.env`, `*.key`, `*.pem` and `node_modules` two directories deep: the
|
|
unprefixed form shipped all of them into the image and the `**/` form ships
|
|
none. Excluding `.claude/` also takes `worktrees/` — entire additional
|
|
checkouts of this repo — out of the build context; #23's two-consecutive-run
|
|
proof was re-run against the smaller context, since that issue was validated
|
|
against the old one. Note the canonical upstream `REPO_POLICIES.md` is not
|
|
clean under this repo's prettier settings, so the reformat is a separate
|
|
follow-up commit rather than churn mixed into this one
|
|
- 2026-08-09: stopped `script/cibuild` reporting a green it never earned (closes
|
|
#23). `COPY . .` is keyed on content, so on an unchanged tree Docker served
|
|
`RUN make check` from cache: the checks never executed and the build still
|
|
exited 0. Three separate reviewers had already been fooled by it here. The
|
|
`Dockerfile` now declares `ARG CHECK_EPOCH` below `COPY . .` with no default
|
|
(a default is a constant, and a constant is a stable cache key), guards it
|
|
with `RUN [ -n "$CHECK_EPOCH" ] || exit 1`, and expands it into the check
|
|
command; `script/cibuild` and `script/docker` both pass
|
|
`epoch="$(date +%s%N)$$"` — assigned on its own line, because a failing
|
|
command substitution inside an argument does not trip `set -e`, and with `$$`
|
|
because busybox `date` drops `%N` silently. This is the canonical shape
|
|
settled upstream in `prompts` #26, which has not merged there yet, so it may
|
|
need re-syncing. Verified with two consecutive runs on an unchanged tree that
|
|
both executed the checks while `RUN script/bootstrap` stayed `CACHED`, a
|
|
constant-epoch counterfactual that restored the false green, and a planted
|
|
prettier failure that failed the build
|
|
- 2026-08-09: disabled the unused `taxonomy` and `term` page kinds in
|
|
`hugo.toml` (closes #13). Hugo enables the `tags` and `categories` taxonomies
|
|
by default; this single-page site has no taxonomy terms and no taxonomy
|
|
templates, so every build emitted
|
|
`WARN found no layout file for "html" for kind "taxonomy"` and generated
|
|
`categories/index.xml` and `tags/index.xml` that nothing links to. Re-verified
|
|
the warning still occurs on the now-pinned hugo v0.164.0 rather than trusting
|
|
the issue's text, which predates the version move. `make test` and `make lint`
|
|
are now `WARN`-free, so the build's noise floor is zero and the next warning
|
|
will be visible. `public/` is otherwise byte-identical — `index.html`,
|
|
`css/style.css` and the RSS `index.xml` all unchanged — and `sitemap.xml` is
|
|
still generated, now listing only the home page instead of two taxonomy URLs
|
|
- 2026-08-09: replaced `hugo.toml`'s deprecated `languageCode` key with `locale`
|
|
(closes #18). Hugo deprecated `languageCode` in v0.158.0, so the Hugo pinned
|
|
in the preceding commit warns about it; left alone it would become a third
|
|
routinely-ignored warning, and a latent breakage when the key is removed.
|
|
Deliberately sequenced **after** the Hugo version move and in the same branch:
|
|
under the apk hugo 0.139.0 that CI ran until now, `locale` is an unknown key
|
|
that is silently ignored, which downgrades the generated RSS from
|
|
`<language>en-us</language>` to `<language>en</language>` with no warning and
|
|
exit 0. Verified on hugo v0.164.0 that the RSS `<language>` still reads
|
|
`en-us`, the `lang` attribute is unchanged, and `public/` is byte-identical to
|
|
the preceding commit's output
|
|
- 2026-08-09: installed Hugo at a deliberate, hash-verified version instead of
|
|
taking whatever alpine ships (closes #26). `script/bootstrap` no longer does
|
|
`pkg_install hugo`; it installs `github.com/gohugoio/hugo@v0.164.0` with
|
|
`go install`, which verifies the module against `sum.golang.org`. The version
|
|
is a commented constant, as is the Go toolchain (`go1.26.5`) — hugo v0.164.0
|
|
requires go >= 1.26.0 and alpine 3.21 ships go 1.23.9 with
|
|
`GOTOOLCHAIN=local`, so a bare `go install` refuses to run. `CGO_ENABLED=0` is
|
|
deliberate: standard Hugo, not extended, because this site has no SCSS, no
|
|
`resources.ToCSS`, no PostCSS and no image processing. This moves the build
|
|
off apk's hugo 0.139.0, about two years behind, onto the current stable.
|
|
Rendered output across the whole `public/` tree is unchanged except the
|
|
`meta name=generator` version string
|
|
- 2026-08-09: made `script/check` run `script/lint` (closes #9). It previously
|
|
ran only `fmt-check` then `test`, so `script/lint` executed nowhere — not in
|
|
`make check`, not in the pre-commit hook, and not in CI, even though the
|
|
`Dockerfile` runs `make check` and `script/cibuild` builds it. It now runs
|
|
`test`, `lint`, `fmt-check` in the canonical order, so the
|
|
`hugo --printPathWarnings` render-target-collision signal is no longer
|
|
discarded. `README.md`'s Entrypoints line was corrected to match
|
|
- 2026-08-09: hash-pinned every external reference in
|
|
`.gitea/workflows/deploy.yml` (closes #7): both job container images are
|
|
pinned by digest, all three `uses:` are pinned by 40-hex commit SHA, and the
|
|
wrangler install is pinned to an exact version. The abandoned
|
|
`klakegg/hugo:ext-alpine` image is gone: the build job now runs on the same
|
|
pinned `alpine` digest the `Dockerfile` uses, with a pre-checkout
|
|
`apk add nodejs git tar` step (the Actions runner needs `node` inside the job
|
|
container to execute JavaScript actions), an explicit `shell: sh` default,
|
|
then `script/bootstrap` and `script/test`. The `deploy` job is guarded with
|
|
`if: github.ref_name == 'main'` so it can never publish from a branch. Also
|
|
dropped the dead `feat/initial-site` push trigger and reindented the file to
|
|
4-space YAML to match `check.yml`. This is the second attempt; the first broke
|
|
the deploy and was reverted, so this one was verified by temporarily
|
|
triggering the workflow on the PR branch and iterating until the `build` job
|
|
ran green for real
|
|
- 2026-07-25: added the scripts-to-rule-them-all scaffold (closes #4): `script/`
|
|
entrypoints, `Makefile` shims, a Hugo `Dockerfile` (sha256-pinned alpine) plus
|
|
`.dockerignore` that runs `make check`, `.gitea/workflows/check.yml` running
|
|
`script/cibuild`, and a README Entrypoints section. `test`/`lint` are a clean
|
|
`hugo --minify` build; `fmt`/`fmt-check` run prettier over the repo's own
|
|
top-level markdown only
|
|
- 2026-02-10: design pass: minimal light theme with inline CSS, grey wells for
|
|
mesh channels and signal groups, horizontal overflow fix, body width tuning,
|
|
map link update
|
|
- 2026-02-10: added README and footer contribute link
|
|
- 2026-02-10: added Gitea workflow that builds the site and deploys to
|
|
Cloudflare Pages
|
|
- 2026-02-08: initial Hugo static site for lora.vegas
|
|
|
|
# Future Steps
|
|
|
|
- Move the artifact actions to v4 once this Gitea Actions instance serves the v4
|
|
artifact protocol; they are pinned on the deprecated v3 line because v4 fails
|
|
here (#20)
|
|
- Move the deploy container to a pinned node 22 so the wrangler pin can advance
|
|
past 4.86.0 (#21)
|
|
- Rework README.md into the standard sections: Description, Getting Started,
|
|
Rationale, Design, TODO, License, Author (currently About, Contributing,
|
|
Technical Details, License)
|
|
- Sync the reformat of `REPO_POLICIES.md` back upstream to `prompts` so the
|
|
canonical copy is clean under the shared prettier settings and future syncs
|
|
are a straight byte copy
|
|
- Verify the Cloudflare Pages deploy still works after the workflow changes
|
|
- Keep mesh channel and signal group listings current
|