sneak
223c520110
All checks were successful
check / check (push) Successful in 56s
script/cibuild was a bare `docker build .`, and the Dockerfile did
`COPY . .` then `RUN make check`. COPY is keyed on content, so on an
unchanged tree Docker served the check layer from cache: the checks
never executed, no Hugo or prettier output appeared, and the build still
exited 0. A gate that reports success without running is worse than no
gate, because it is trusted -- three separate reviewers in this repo
have been fooled by it.
The Dockerfile now declares `ARG CHECK_EPOCH` immediately below
`COPY . .`, guards it, and expands it into the check command:
ARG CHECK_EPOCH
RUN [ -n "$CHECK_EPOCH" ] || exit 1
RUN echo "check epoch: ${CHECK_EPOCH}" && make check
script/cibuild and script/docker both generate the value identically and
pass it. Every element is load-bearing:
- No default value. A default is a constant, and a constant is a stable
cache key -- the defect unchanged.
- Placed below `COPY . .`. Everything above keeps caching, so the
script/bootstrap layer, which compiles Hugo from source, is not
rebuilt. Whole-build `--no-cache` would have discarded it and blown
the five-minute budget for no benefit.
- The guard. An unset ARG is the empty string, which is also a stable
cache key, so without it a bare `docker build .` still collects the
false green. Failed steps are never cached, so it fails on every such
invocation rather than only the first. This is why script/docker had
to be updated too: the guard makes passing the argument mandatory for
every entrypoint that builds the image.
- The value expanded into the RUN. Hardening rather than the fix: the
bare unreferenced-ARG form does work, but expansion makes the cache
miss contractual rather than dependent on BuildKit's handling of an
unreferenced ARG, and puts the epoch in the build log. The guard also
references the value, so there are two independent invalidation
points, not one.
- `epoch="$(date +%s%N)$$"` on its own line rather than inlined into the
argument list. A command substitution that fails inside an argument
does not trip `set -e`, so the inline form would quietly pass an empty
string and restore the cached false green. `%N` keeps concurrent
invocations distinct; `$$` covers busybox date, which drops `%N`
silently and still exits 0.
ARG is stage-scoped and must be redeclared in every stage that runs
checks. This image is single-stage, so one declaration is complete.
This is the shape settled upstream in the prompts repo, where it has not
merged to main yet, so it may need re-syncing later.
Verified: two consecutive script/cibuild runs on an unchanged tree both
executed the checks (two Hugo builds and the prettier line in each,
15s then 6s) with `RUN script/bootstrap` and `COPY . .` both CACHED in
the second -- the validity control that rules out a cache eviction
between them. A constant-epoch counterfactual restored the cached false
green, confirming the varying value is what does the work. A bare
`docker build .` now fails on the guard, and fails again on immediate
repeat. A planted prettier failure failed the build with exit 1. `make
docker` and `make check` both pass.
132 lines
7.7 KiB
Markdown
132 lines
7.7 KiB
Markdown
# Workflow
|
|
|
|
- branch (from `main`)
|
|
- do the work in Next Step
|
|
- move Next Step to the top of Completed Steps
|
|
- move the top item of Future Steps into Next Step
|
|
- commit (`TODO.md` changes in the same commit as the work)
|
|
- merge to `main` if the branch is not protected, otherwise open a PR
|
|
- push
|
|
|
|
# Status
|
|
|
|
pre-1.0
|
|
|
|
No git tags. The site is live and now has the scripts-to-rule-them-all scaffold
|
|
(`Makefile`, `script/`, `Dockerfile`, `check.yml`); still missing `LICENSE` and
|
|
policy files. Every external reference in the repo is now pinned by
|
|
cryptographic hash (or, for the wrangler CLI install, an exact version), and the
|
|
Hugo that builds the published site is a deliberate pinned version rather than
|
|
whatever the base image's package repo serves.
|
|
|
|
# Next Step
|
|
|
|
Add the remaining policy scaffold: `LICENSE`, `REPO_POLICIES.md`,
|
|
`.editorconfig`, and prettier config files (`.prettierrc`, `.prettierignore`).
|
|
Update `README.md` accordingly.
|
|
|
|
# Completed Steps
|
|
|
|
- 2026-08-09: stopped `script/cibuild` reporting a green it never earned (closes
|
|
#23). `COPY . .` is keyed on content, so on an unchanged tree Docker served
|
|
`RUN make check` from cache: the checks never executed and the build still
|
|
exited 0. Three separate reviewers had already been fooled by it here. The
|
|
`Dockerfile` now declares `ARG CHECK_EPOCH` below `COPY . .` with no default
|
|
(a default is a constant, and a constant is a stable cache key), guards it
|
|
with `RUN [ -n "$CHECK_EPOCH" ] || exit 1`, and expands it into the check
|
|
command; `script/cibuild` and `script/docker` both pass
|
|
`epoch="$(date +%s%N)$$"` — assigned on its own line, because a failing
|
|
command substitution inside an argument does not trip `set -e`, and with `$$`
|
|
because busybox `date` drops `%N` silently. This is the canonical shape
|
|
settled upstream in `prompts` #26, which has not merged there yet, so it may
|
|
need re-syncing. Verified with two consecutive runs on an unchanged tree that
|
|
both executed the checks while `RUN script/bootstrap` stayed `CACHED`, a
|
|
constant-epoch counterfactual that restored the false green, and a planted
|
|
prettier failure that failed the build
|
|
- 2026-08-09: disabled the unused `taxonomy` and `term` page kinds in
|
|
`hugo.toml` (closes #13). Hugo enables the `tags` and `categories` taxonomies
|
|
by default; this single-page site has no taxonomy terms and no taxonomy
|
|
templates, so every build emitted
|
|
`WARN found no layout file for "html" for kind "taxonomy"` and generated
|
|
`categories/index.xml` and `tags/index.xml` that nothing links to. Re-verified
|
|
the warning still occurs on the now-pinned hugo v0.164.0 rather than trusting
|
|
the issue's text, which predates the version move. `make test` and `make lint`
|
|
are now `WARN`-free, so the build's noise floor is zero and the next warning
|
|
will be visible. `public/` is otherwise byte-identical — `index.html`,
|
|
`css/style.css` and the RSS `index.xml` all unchanged — and `sitemap.xml` is
|
|
still generated, now listing only the home page instead of two taxonomy URLs
|
|
- 2026-08-09: replaced `hugo.toml`'s deprecated `languageCode` key with `locale`
|
|
(closes #18). Hugo deprecated `languageCode` in v0.158.0, so the Hugo pinned
|
|
in the preceding commit warns about it; left alone it would become a third
|
|
routinely-ignored warning, and a latent breakage when the key is removed.
|
|
Deliberately sequenced **after** the Hugo version move and in the same branch:
|
|
under the apk hugo 0.139.0 that CI ran until now, `locale` is an unknown key
|
|
that is silently ignored, which downgrades the generated RSS from
|
|
`<language>en-us</language>` to `<language>en</language>` with no warning and
|
|
exit 0. Verified on hugo v0.164.0 that the RSS `<language>` still reads
|
|
`en-us`, the `lang` attribute is unchanged, and `public/` is byte-identical to
|
|
the preceding commit's output
|
|
- 2026-08-09: installed Hugo at a deliberate, hash-verified version instead of
|
|
taking whatever alpine ships (closes #26). `script/bootstrap` no longer does
|
|
`pkg_install hugo`; it installs `github.com/gohugoio/hugo@v0.164.0` with
|
|
`go install`, which verifies the module against `sum.golang.org`. The version
|
|
is a commented constant, as is the Go toolchain (`go1.26.5`) — hugo v0.164.0
|
|
requires go >= 1.26.0 and alpine 3.21 ships go 1.23.9 with
|
|
`GOTOOLCHAIN=local`, so a bare `go install` refuses to run. `CGO_ENABLED=0` is
|
|
deliberate: standard Hugo, not extended, because this site has no SCSS, no
|
|
`resources.ToCSS`, no PostCSS and no image processing. This moves the build
|
|
off apk's hugo 0.139.0, about two years behind, onto the current stable.
|
|
Rendered output across the whole `public/` tree is unchanged except the
|
|
`meta name=generator` version string
|
|
- 2026-08-09: made `script/check` run `script/lint` (closes #9). It previously
|
|
ran only `fmt-check` then `test`, so `script/lint` executed nowhere — not in
|
|
`make check`, not in the pre-commit hook, and not in CI, even though the
|
|
`Dockerfile` runs `make check` and `script/cibuild` builds it. It now runs
|
|
`test`, `lint`, `fmt-check` in the canonical order, so the
|
|
`hugo --printPathWarnings` render-target-collision signal is no longer
|
|
discarded. `README.md`'s Entrypoints line was corrected to match
|
|
- 2026-08-09: hash-pinned every external reference in
|
|
`.gitea/workflows/deploy.yml` (closes #7): both job container images are
|
|
pinned by digest, all three `uses:` are pinned by 40-hex commit SHA, and the
|
|
wrangler install is pinned to an exact version. The abandoned
|
|
`klakegg/hugo:ext-alpine` image is gone: the build job now runs on the same
|
|
pinned `alpine` digest the `Dockerfile` uses, with a pre-checkout
|
|
`apk add nodejs git tar` step (the Actions runner needs `node` inside the job
|
|
container to execute JavaScript actions), an explicit `shell: sh` default,
|
|
then `script/bootstrap` and `script/test`. The `deploy` job is guarded with
|
|
`if: github.ref_name == 'main'` so it can never publish from a branch. Also
|
|
dropped the dead `feat/initial-site` push trigger and reindented the file to
|
|
4-space YAML to match `check.yml`. This is the second attempt; the first broke
|
|
the deploy and was reverted, so this one was verified by temporarily
|
|
triggering the workflow on the PR branch and iterating until the `build` job
|
|
ran green for real
|
|
- 2026-07-25: added the scripts-to-rule-them-all scaffold (closes #4): `script/`
|
|
entrypoints, `Makefile` shims, a Hugo `Dockerfile` (sha256-pinned alpine) plus
|
|
`.dockerignore` that runs `make check`, `.gitea/workflows/check.yml` running
|
|
`script/cibuild`, and a README Entrypoints section. `test`/`lint` are a clean
|
|
`hugo --minify` build; `fmt`/`fmt-check` run prettier over the repo's own
|
|
top-level markdown only
|
|
- 2026-02-10: design pass: minimal light theme with inline CSS, grey wells for
|
|
mesh channels and signal groups, horizontal overflow fix, body width tuning,
|
|
map link update
|
|
- 2026-02-10: added README and footer contribute link
|
|
- 2026-02-10: added Gitea workflow that builds the site and deploys to
|
|
Cloudflare Pages
|
|
- 2026-02-08: initial Hugo static site for lora.vegas
|
|
|
|
# Future Steps
|
|
|
|
- Move the artifact actions to v4 once this Gitea Actions instance serves the v4
|
|
artifact protocol; they are pinned on the deprecated v3 line because v4 fails
|
|
here (#20)
|
|
- Move the deploy container to a pinned node 22 so the wrangler pin can advance
|
|
past 4.86.0 (#21)
|
|
- Rework README.md into the standard sections: Description, Getting Started,
|
|
Rationale, Design, TODO, License, Author (currently About, Contributing,
|
|
Technical Details, License)
|
|
- Replace the "content is provided as-is" README note with the text of the
|
|
committed LICENSE
|
|
- Expand .gitignore beyond Hugo outputs (OS and editor files)
|
|
- Verify the Cloudflare Pages deploy still works after the workflow changes
|
|
- Keep mesh channel and signal group listings current
|