scripts-to-rule-them-all (#58)

Reviewed-on: #58 Co-authored-by: sneak <sneak@sneak.berlin> Co-committed-by: sneak <sneak@sneak.berlin>
2026-07-07 02:13:35 +02:00
parent 688ebd90a4
commit 6d19de74e7
17 changed files with 713 additions and 93 deletions
--- a/TODO.md
+++ b/TODO.md
@@ -1,12 +1,12 @@
 # Workflow

-* branch (from `main`)
-* do the work in Next Step
-* move Next Step to the top of Completed Steps
-* move the top item of Future Steps into Next Step
-* commit (`TODO.md` changes in the same commit as the work)
-* merge to `main` if the branch is not protected, otherwise open a PR
-* push
+- branch (from `main`)
+- do the work in Next Step
+- move Next Step to the top of Completed Steps
+- move the top item of Future Steps into Next Step
+- commit (`TODO.md` changes in the same commit as the work)
+- merge to `main` if the branch is not protected, otherwise open a PR
+- push

 # Status

@@ -23,6 +23,8 @@ commit the uncommitted work (32 modified Go files, new untracked

 # Completed Steps

+- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
+  Makefile shims, README Entrypoints section
 - 2026-07-03: aligned repo tooling, docs, and config with standardized
  policies (7d9a138, on chore/align-repo-policies, unmerged)
 - 2026-06-28: moved to standardized repo policies (#56, on main)
@@ -42,64 +44,64 @@ commit the uncommitted work (32 modified Go files, new untracked

 - Compliance (fold of TODO.md audit 2026-07-02; verify which items the
  in-flight branch already closes, then check off):
-    - Add .editorconfig (canonical copy from sneak/prompts)
-    - Add standardized .golangci.yml (present untracked on the branch;
-      user-owned, copy verbatim)
-    - Make .gitignore cover secrets (.env, *.key, *.pem), OS files
-      (.DS_Store), and editor files (*.swp, *~)
-    - Make fmt-check/lint verify with gofumpt, not gofmt -l, so
-      `make check` matches what `make fmt` writes
-    - Add README "Getting Started" section with copy-pasteable
-      install/usage block
-    - Move FORMAT.md from repo root to docs/ and update the AGENTS.md
-      reference
-    - Pin Makefile-installed Go tools (protoc-gen-go@v1.28.1,
-      golangci-lint@v2.0.2) by module hash, not mutable tag
-    - Set `make test` timeout to 30s (currently 10s)
-    - Add explicit README "Rationale" heading (content exists under other
-      names); name the author in the README Description first line
-    - Reconcile root-level AGENTS.md with directory-hygiene policy (keep
-      or relocate)
-    - Add a `make build` target
-    - Rewrite `make hooks` to use printf or a heredoc instead of
-      non-portable `echo '...\n...'`
+  - Add .editorconfig (canonical copy from sneak/prompts)
+  - Add standardized .golangci.yml (present untracked on the branch;
+    user-owned, copy verbatim)
+  - Make .gitignore cover secrets (.env, _.key, _.pem), OS files
+    (.DS_Store), and editor files (_.swp, _~)
+  - Make fmt-check/lint verify with gofumpt, not gofmt -l, so
+    `make check` matches what `make fmt` writes
+  - Add README "Getting Started" section with copy-pasteable
+    install/usage block
+  - Move FORMAT.md from repo root to docs/ and update the AGENTS.md
+    reference
+  - Pin Makefile-installed Go tools (protoc-gen-go@v1.28.1,
+    golangci-lint@v2.0.2) by module hash, not mutable tag
+  - Set `make test` timeout to 30s (currently 10s)
+  - Add explicit README "Rationale" heading (content exists under other
+    names); name the author in the README Description first line
+  - Reconcile root-level AGENTS.md with directory-hygiene policy (keep
+    or relocate)
+  - Add a `make build` target
+  - Rewrite `make hooks` to use printf or a heredoc instead of
+    non-portable `echo '...\n...'`
 - Answer the 14 owner design questions in the README 1.0 roadmap:
-    - Format: simplify MFFileChecksum; store file mode; drop atime;
-      specify path normalization rules; version byte after magic;
-      length-prefix after magic
-    - Signatures: hash covers compressed or uncompressed data; sign raw
-      bytes vs hex canonical string; detached .mf.sig support; GPG
-      subprocess vs pure-Go crypto
-    - Implementation: deterministic manifests by default; consolidate
-      duplicate scanner/checker implementations; export the manifest
-      type; canonical Go module path for 1.0
+  - Format: simplify MFFileChecksum; store file mode; drop atime;
+    specify path normalization rules; version byte after magic;
+    length-prefix after magic
+  - Signatures: hash covers compressed or uncompressed data; sign raw
+    bytes vs hex canonical string; detached .mf.sig support; GPG
+    subprocess vs pure-Go crypto
+  - Implementation: deterministic manifests by default; consolidate
+    duplicate scanner/checker implementations; export the manifest
+    type; canonical Go module path for 1.0
 - Format and correctness:
-    - Resolve proto go_package vs go.mod module path inconsistency
-    - Specify and validate path invariants (UTF-8, forward-slash,
-      relative, no .., no leading /)
-    - Remove or deprecate atime; reserve mode field; add version byte
-      (all pending design answers)
-    - Write a standalone format specification document
+  - Resolve proto go_package vs go.mod module path inconsistency
+  - Specify and validate path invariants (UTF-8, forward-slash,
+    relative, no .., no leading /)
+  - Remove or deprecate atime; reserve mode field; add version byte
+    (all pending design answers)
+  - Write a standalone format specification document
 - Library:
-    - Delete internal/scanner and internal/checker; consolidate on the
-      mfer/ package versions (pending design answer)
-    - Add decompression size limit via io.LimitReader in
-      deserializeInner()
-    - Fix errors.Is dead code in checker; make AddFile verify
-      totalRead == size
-    - Export manifest type or define a public interface (pending)
-    - Replace GPG subprocess with pure-Go crypto (pending); add timeouts
-      to remaining subprocess calls
+  - Delete internal/scanner and internal/checker; consolidate on the
+    mfer/ package versions (pending design answer)
+  - Add decompression size limit via io.LimitReader in
+    deserializeInner()
+  - Fix errors.Is dead code in checker; make AddFile verify
+    totalRead == size
+  - Export manifest type or define a public interface (pending)
+  - Replace GPG subprocess with pure-Go crypto (pending); add timeouts
+    to remaining subprocess calls
 - CLI:
-    - Kebab-case primary flag names; fix fetch URL construction with
-      url.JoinPath; add http.Client timeout and retry with backoff to
-      fetch; rate-limit Checker progress output; add --deterministic
-      flag or default; wire top-level --version properly
+  - Kebab-case primary flag names; fix fetch URL construction with
+    url.JoinPath; add http.Client timeout and retry with backoff to
+    fetch; rate-limit Checker progress output; add --deterministic
+    flag or default; wire top-level --version properly
 - Testing:
-    - Fuzz NewManifestFromReader; end-to-end tests for freshen and fetch
+  - Fuzz NewManifestFromReader; end-to-end tests for freshen and fetch
 - Documentation:
-    - Promote docs/FORMAT.md as primary spec reference; audit error
-      messages; document the signature scheme fully
+  - Promote docs/FORMAT.md as primary spec reference; audit error
+    messages; document the signature scheme fully
 - Release:
-    - Finalize module path, bump version constant, SemVer --version
-      output, tag v1.0.0
+  - Finalize module path, bump version constant, SemVer --version
+    output, tag v1.0.0