add make check target, CI workflow, and Dockerfile lint stage

- Add lint stage using prebuilt golangci/golangci-lint image for fast
  feedback on formatting and lint issues
- Add build stage using golang:1.24-alpine for tests and compilation
  (replaces sneak/builder:2022-12-08 which has Go 1.19, too old for
  go 1.23 modules)
- Build stage depends on lint stage via COPY --from=lint to ensure
  BuildKit runs both stages
- All Docker base images pinned by sha256 hash
- Add Makefile targets: fmt-check, build, check, hooks
- check target runs fmt-check, lint, and test
- CI workflow simply runs 'docker build .' which implicitly runs all
  checks via the Dockerfile stages
- Update README with new targets and correct Go version requirement
- Remove vendor.tzst/modcache.tzst references from Dockerfile (removed
  in prior commit)

.gitea/workflows/check.yml

@@ -0,0 +1,13 @@
+name: check
+on:
+  push:
+    branches: [main, next]
+  pull_request:
+    branches: [main, next]
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13894f8d5 # v4
+      - name: Build Docker image (runs make check internally)
+        run: docker build .

Dockerfile

@@ -1,37 +1,46 @@
 ################################################################################
-#2345678911234567892123456789312345678941234567895123456789612345678971234567898
+# Lint stage — fast feedback on formatting and lint issues
 ################################################################################
-FROM sneak/builder:2022-12-08 AS builder
-ENV DEBIAN_FRONTEND noninteractive
-WORKDIR /build
-COPY ./Makefile ./.golangci.yml ./go.mod ./go.sum /build/
-COPY ./vendor.tzst /build/vendor.tzst
-COPY ./modcache.tzst /build/modcache.tzst
-COPY ./internal ./internal
-COPY ./bin/gitrev.sh ./bin/gitrev.sh
-COPY ./mfer ./mfer
-COPY ./cmd ./cmd
-ARG GITREV unknown
-ARG DRONE_COMMIT_SHA unknown
+# golangci/golangci-lint:v1.64.8
+FROM golangci/golangci-lint@sha256:2987913e27f4eca9c8a39129d2c7bc1e74fbcf77f181e01cea607be437aa5cb8 AS lint
+
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+RUN make fmt-check
+RUN make lint
 
-RUN mkdir -p "$(go env GOMODCACHE)" && cd "$(go env GOMODCACHE)" && \
-    zstdmt -d --stdout /build/modcache.tzst | tar xf - && \
-    rm /build/modcache.tzst && cd /build
-RUN \
-    cd mfer && go generate . && cd .. && \
-    GOPACKAGESDEBUG=true golangci-lint run ./... && \
-    mkdir vendor && cd vendor && \
-    zstdmt -d --stdout /build/vendor.tzst | tar xf - && rm /build/vendor.tzst && \
-    cd .. && \
-    make mfer.cmd
-RUN rm -rf /build/vendor && go mod vendor && tar -c . | zstdmt -19 > /src.tzst
 ################################################################################
-#2345678911234567892123456789312345678941234567895123456789612345678971234567898
+# Build stage — tests and compilation
 ################################################################################
-## final image
+# golang:1.24-alpine
+FROM golang@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191 AS builder
+
+# Force BuildKit to run the lint stage by creating a stage dependency
+COPY --from=lint /src/go.sum /dev/null
+
+RUN apk add --no-cache git make zstd
+
+WORKDIR /build
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+RUN make test
+RUN make build
+
+# Archive source for posterity
+RUN go mod vendor && tar -c . | zstd -T0 -19 -o /src.tzst
+
+################################################################################
+# Final image
 ################################################################################
 FROM scratch
 # we put all the source into the final image for posterity, it's small
 COPY --from=builder /src.tzst /src.tzst
-COPY --from=builder /build/mfer.cmd /mfer
+COPY --from=builder /build/bin/mfer /mfer
 ENTRYPOINT ["/mfer"]

Makefile

@@ -13,7 +13,7 @@ GOLDFLAGS += -X main.Version=$(VERSION)
 GOLDFLAGS += -X main.Gitrev=$(GITREV_BUILD)
 GOFLAGS := -ldflags "$(GOLDFLAGS)"
 
-.PHONY: docker default run ci test fixme
+.PHONY: docker default run ci test fixme check fmt-check lint build hooks
 
 default: fmt test
 
@@ -23,7 +23,7 @@ run: ./bin/mfer
 
 ci: test
 
-test: $(SOURCEFILES) mfer/mf.pb.go
+test:
 	go test -v --timeout 10s ./...
 
 $(PROTOC_GEN_GO):
@@ -42,6 +42,9 @@ bin/mfer: $(SOURCEFILES) mfer/mf.pb.go
 	protoc --version
 	cd cmd/mfer && go build -tags urfave_cli_no_docs -o ../../bin/mfer $(GOFLAGS) .
 
+build:
+	cd cmd/mfer && go build -tags urfave_cli_no_docs -o ../../bin/mfer $(GOFLAGS) .
+
 clean:
 	rm -rfv mfer/*.pb.go bin/mfer cmd/mfer/mfer *.dockerimage
 
@@ -51,31 +54,31 @@ fmt: mfer/mf.pb.go
 	-prettier -w *.json
 	-prettier -w *.md
 
+fmt-check:
+	@echo "==> Checking formatting..."
+	@test -z "$$(gofmt -l .)" || (echo "Files not formatted:" && gofmt -l . && exit 1)
+
 lint:
-	golangci-lint run
-	sh -c 'test -z "$$(gofmt -l .)"'
+	golangci-lint run ./...
+
+# Run all checks (formatting, linting, tests) without modifying files
+check: fmt-check lint test
+
+hooks:
+	@echo "Installing git hooks..."
+	@mkdir -p .git/hooks
+	@echo '#!/bin/sh' > .git/hooks/pre-commit
+	@echo 'make check' >> .git/hooks/pre-commit
+	@chmod +x .git/hooks/pre-commit
+	@echo "Pre-commit hook installed."
 
 docker: sneak-mfer.$(ARCH).tzst.dockerimage
 
-sneak-mfer.$(ARCH).tzst.dockerimage: $(SOURCEFILES) vendor.tzst modcache.tzst
+sneak-mfer.$(ARCH).tzst.dockerimage: $(SOURCEFILES)
 	docker build --progress plain --build-arg GITREV=$(GITREV_BUILD) -t sneak/mfer .
-	docker save sneak/mfer | pv | zstdmt -19 > $@
+	docker save sneak/mfer | pv | zstd -T0 -19 > $@
 	du -sh $@
 
 godoc:
 	open http://127.0.0.1:6060
 	godoc -http=:6060
-
-vendor.tzst: go.mod go.sum
-	go mod tidy
-	go mod vendor
-	cd vendor && tar -c . | pv | zstdmt -19 > $(PWD)/$@.tmp
-	rm -rf vendor
-	mv $@.tmp $@
-
-modcache.tzst: go.mod go.sum
-	go mod tidy
-	cd $(HOME)/go/pkg && chmod -R u+rw . && rm -rf mod sumdb
-	go mod download -x
-	cd $(shell go env GOMODCACHE) && tar -c . | pv | zstdmt -19 > $(PWD)/$@.tmp
-	mv $@.tmp $@

README.md

@@ -55,7 +55,7 @@ Reading file contents and computing cryptographic hashes for manifest generation
 
 ## Prerequisites
 
-- Go 1.21 or later
+- Go 1.23 or later
 - `protoc` (Protocol Buffers compiler) — only needed if modifying `.proto` files
 - `golangci-lint` — for linting (`go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest`)
 - `gofumpt` — for formatting (`go install mvdan.cc/gofumpt@latest`)
@@ -64,7 +64,7 @@ Reading file contents and computing cryptographic hashes for manifest generation
 
 ```sh
 # Build the binary
-make bin/mfer
+make build
 
 # Run tests
 make test
@@ -72,8 +72,17 @@ make test
 # Format code
 make fmt
 
+# Check formatting (without modifying files)
+make fmt-check
+
 # Lint
 make lint
+
+# Run all checks (formatting, linting, tests)
+make check
+
+# Install git pre-commit hook that runs make check
+make hooks
 ```
 
 ## Install from source