script/cibuild ran a bare "docker build .". The Dockerfile does "COPY . ."
and then runs the checks, so on an unchanged tree every check layer was a
cache hit: the suite never executed and the build still exited 0. A green
from script/cibuild did not mean the checks had passed, only that they had
passed at some point in the past.
Declare "ARG CHECK_EPOCH" in each stage that runs a check, positioned below
the dependency layers and immediately above the first check, and have
script/cibuild pass a fresh "$(date +%s)" on every invocation. A changed
build arg invalidates every layer below its declaration, so the checks
always execute while the base images, "go mod download" and the "yarn
install" in mdfmt stay cached.
All three check-running stages are covered: lint (fmt-check-go, lint),
mdfmt (prettier --check) and builder (test). ARG is scoped per stage, so a
stage without its own declaration would keep serving a cached pass and be
indistinguishable from a working fix at the exit code.
"--no-cache" was not used: it would also discard "go mod download" and the
yarn install, for no additional guarantee.
The README's build-status claim is accurate again and now says why.
Adds .prettierrc and .prettierignore, a single script/prettier entrypoint shared by fmt and fmt-check so the two cannot drift, and prettier 3.9.6 pinned by yarn.lock integrity hash.
Markdown formatting is now gated in the authoritative Docker build via a new mdfmt stage, since the golangci-lint image has no node. REPO_POLICIES.md is ignored so local tooling cannot drift it from upstream.
Removes the || true that made the previous prettier invocation unable to fail.
Adopts golangci-lint v2.12.2 and the canonical .golangci.yml (default: all), and fixes all resulting findings across the tree.
Two intended behavior changes: absent MFFilePath.Mtime is handled explicitly in freshen, list and export rather than dereferenced (main panicked); gpg positional key IDs now follow an explicit -- end-of-options marker.
All twelve reworded user-visible error messages restored to byte-identical parity with main and pinned by tests.
Closes#39
Splits the Dockerfile into a dedicated lint stage using the `golangci/golangci-lint` image directly, rather than copying the binary into the builder stage.
## Changes
### Dockerfile
- **Lint stage** (`AS lint`): Uses the pre-built `golangci/golangci-lint` image (pinned by sha256) to run `make fmt-check` and `make lint`. This is a self-contained stage with its own `go mod download` and source copy.
- **Builder stage** (`AS builder`): Runs only `make test` and the final binary build. No longer needs golangci-lint installed.
- **Stage dependency**: `COPY --from=lint /src/go.sum /dev/null` forces BuildKit to always execute the lint stage (without this, unused stages are silently skipped).
- Both stages touch `mfer/mf.pb.go` to prevent make from trying to regenerate via protoc.
With BuildKit, the lint and builder stages run in parallel after their shared `go mod download` layers complete, so lint/formatting failures surface much faster without blocking on test execution.
### Makefile
- Added `lint` to the `check` target prereqs: `check: test lint fmt-check` (was `check: test fmt-check`), matching the [REPO_POLICIES](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/REPO_POLICIES.md) requirement.
Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de>
Reviewed-on: #45
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>
