move 'make check' into Dockerfile, simplify CI to just 'docker build .'

Per reviewer feedback: the Dockerfile now runs 'make check' early in
its build process (after dependencies are extracted). The CI workflow
is simplified to just run 'docker build .', which implicitly runs
'make check' as part of the Docker build.

.drone.yml

@@ -1,23 +0,0 @@
-kind: pipeline
-name: test-docker-build
-
-steps:
-- name: test-docker-build
-  image: plugins/docker
-  network_mode: bridge
-  settings:
-    repo: sneak/mfer
-    build_args_from_env: [ DRONE_COMMIT_SHA ]
-    dry_run: true
-    custom_dns: [ 116.202.204.30 ]
-    tags:
-      - ${DRONE_COMMIT_SHA:0:7}
-      - ${DRONE_BRANCH}
-      - latest
-- name: notify
-  image: plugins/slack
-  settings:
-    webhook:
-      from_secret: SLACK_WEBHOOK_URL
-  when:
-    event: pull_request

.gitea/workflows/check.yml

@@ -0,0 +1,13 @@
+name: check
+on:
+  push:
+    branches: [main, next]
+  pull_request:
+    branches: [main, next]
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13894f8d5 # v4
+      - name: Build Docker image (runs make check internally)
+        run: docker build .

.gitignore

@@ -3,3 +3,8 @@
 *.tmp
 *.dockerimage
 /vendor
+vendor.tzst
+modcache.tzst
+
+# Stale files
+.drone.yml

Dockerfile

@@ -17,6 +17,7 @@ ARG DRONE_COMMIT_SHA unknown
 RUN mkdir -p "$(go env GOMODCACHE)" && cd "$(go env GOMODCACHE)" && \
     zstdmt -d --stdout /build/modcache.tzst | tar xf - && \
     rm /build/modcache.tzst && cd /build
+RUN make check
 RUN \
     cd mfer && go generate . && cd .. && \
     GOPACKAGESDEBUG=true golangci-lint run ./... && \

Makefile

@@ -13,7 +13,7 @@ GOLDFLAGS += -X main.Version=$(VERSION)
 GOLDFLAGS += -X main.Gitrev=$(GITREV_BUILD)
 GOFLAGS := -ldflags "$(GOLDFLAGS)"
 
-.PHONY: docker default run ci test fixme
+.PHONY: docker default run ci test fixme check check-fmt lint
 
 default: fmt test
 
@@ -51,9 +51,8 @@ fmt: mfer/mf.pb.go
 	-prettier -w *.json
 	-prettier -w *.md
 
-lint:
-	golangci-lint run
-	sh -c 'test -z "$$(gofmt -l .)"'
+lint: mfer/mf.pb.go
+	golangci-lint run ./...
 
 docker: sneak-mfer.$(ARCH).tzst.dockerimage
 
@@ -79,3 +78,11 @@ modcache.tzst: go.mod go.sum
 	go mod download -x
 	cd $(shell go env GOMODCACHE) && tar -c . | pv | zstdmt -19 > $(PWD)/$@.tmp
 	mv $@.tmp $@
+
+# Individual check targets
+check-fmt:
+	@echo "==> Checking formatting..."
+	@test -z "$$(gofmt -l .)" || (echo "Files not formatted:" && gofmt -l . && exit 1)
+
+# Run all checks (formatting, linting, tests) without modifying files
+check: check-fmt lint test

internal/cli/gen.go

@@ -25,6 +25,12 @@ func (mfa *CLIApp) generateManifestOperation(ctx *cli.Context) error {
 		Fs:              mfa.Fs,
 	}
 
+	// Set seed for deterministic UUID if provided
+	if seed := ctx.String("seed"); seed != "" {
+		opts.Seed = seed
+		log.Infof("using deterministic seed for manifest UUID")
+	}
+
 	// Set up signing options if sign-key is provided
 	if signKey := ctx.String("sign-key"); signKey != "" {
 		opts.SigningOptions = &mfer.SigningOptions{

internal/cli/mfer.go

@@ -154,6 +154,11 @@ func (mfa *CLIApp) run(args []string) {
 						Usage:   "GPG key ID to sign the manifest with",
 						EnvVars: []string{"MFER_SIGN_KEY"},
 					},
+					&cli.StringFlag{
+						Name:    "seed",
+						Usage:   "Seed value for deterministic manifest UUID",
+						EnvVars: []string{"MFER_SEED"},
+					},
 				),
 			},
 			{

mfer/builder.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"sort"
 	"strings"
 	"sync"
 	"time"
@@ -88,6 +89,15 @@ type Builder struct {
 	files          []*MFFilePath
 	createdAt      time.Time
 	signingOptions *SigningOptions
+	fixedUUID      []byte // if set, use this UUID instead of generating one
+}
+
+// SetSeed derives a deterministic UUID from the given seed string.
+// The seed is hashed once with SHA-256 and the first 16 bytes are used
+// as a fixed UUID for the manifest.
+func (b *Builder) SetSeed(seed string) {
+	hash := sha256.Sum256([]byte(seed))
+	b.fixedUUID = hash[:16]
 }
 
 // NewBuilder creates a new Builder.
@@ -222,6 +232,11 @@ func (b *Builder) Build(w io.Writer) error {
 	b.mu.Lock()
 	defer b.mu.Unlock()
 
+	// Sort files by path for deterministic output
+	sort.Slice(b.files, func(i, j int) bool {
+		return b.files[i].Path < b.files[j].Path
+	})
+
 	// Create inner manifest
 	inner := &MFFile{
 		Version:   MFFile_VERSION_ONE,
@@ -233,6 +248,7 @@ func (b *Builder) Build(w io.Writer) error {
 	m := &manifest{
 		pbInner:        inner,
 		signingOptions: b.signingOptions,
+		fixedUUID:      b.fixedUUID,
 	}
 
 	// Generate outer wrapper

mfer/builder_test.go

@@ -115,6 +115,54 @@ func TestNewTimestampFromTimeExtremeDate(t *testing.T) {
 	}
 }
 
+func TestBuilderDeterministicOutput(t *testing.T) {
+	buildManifest := func() []byte {
+		b := NewBuilder()
+		// Use a fixed createdAt and UUID so output is reproducible
+		b.createdAt = time.Date(2025, 1, 1, 0, 0, 0, 0, time.UTC)
+		b.fixedUUID = make([]byte, 16) // all zeros
+
+		mtime := ModTime(time.Date(2025, 6, 1, 0, 0, 0, 0, time.UTC))
+
+		// Add files in reverse order to test sorting
+		files := []struct {
+			path    string
+			content string
+		}{
+			{"c/file.txt", "content c"},
+			{"a/file.txt", "content a"},
+			{"b/file.txt", "content b"},
+		}
+		for _, f := range files {
+			r := bytes.NewReader([]byte(f.content))
+			_, err := b.AddFile(RelFilePath(f.path), FileSize(len(f.content)), mtime, r, nil)
+			require.NoError(t, err)
+		}
+
+		var buf bytes.Buffer
+		err := b.Build(&buf)
+		require.NoError(t, err)
+		return buf.Bytes()
+	}
+
+	out1 := buildManifest()
+	out2 := buildManifest()
+	assert.Equal(t, out1, out2, "two builds with same input should produce byte-identical output")
+}
+
+func TestSetSeedDeterministic(t *testing.T) {
+	b1 := NewBuilder()
+	b1.SetSeed("test-seed-value")
+	b2 := NewBuilder()
+	b2.SetSeed("test-seed-value")
+	assert.Equal(t, b1.fixedUUID, b2.fixedUUID, "same seed should produce same UUID")
+	assert.Len(t, b1.fixedUUID, 16, "UUID should be 16 bytes")
+
+	b3 := NewBuilder()
+	b3.SetSeed("different-seed")
+	assert.NotEqual(t, b1.fixedUUID, b3.fixedUUID, "different seeds should produce different UUIDs")
+}
+
 func TestBuilderBuildEmpty(t *testing.T) {
 	b := NewBuilder()
 

mfer/checker.go

@@ -272,12 +272,14 @@ func (c *Checker) checkFile(entry *MFFilePath, checkedBytes *FileSize) Result {
 
 // FindExtraFiles walks the filesystem and reports files not in the manifest.
 // Results are sent to the results channel. The channel is closed when done.
+// Hidden files/directories (starting with .) are skipped, as they are excluded
+// from manifests by default. The manifest file itself is also skipped.
 func (c *Checker) FindExtraFiles(ctx context.Context, results chan<- Result) error {
 	if results != nil {
 		defer close(results)
 	}
 
-	return afero.Walk(c.fs, string(c.basePath), func(path string, info os.FileInfo, err error) error {
+	return afero.Walk(c.fs, string(c.basePath), func(walkPath string, info os.FileInfo, err error) error {
 		if err != nil {
 			return err
 		}
@@ -288,16 +290,31 @@ func (c *Checker) FindExtraFiles(ctx context.Context, results chan<- Result) err
 		default:
 		}
 
+		// Get relative path
+		rel, err := filepath.Rel(string(c.basePath), walkPath)
+		if err != nil {
+			return err
+		}
+
+		// Skip hidden files and directories (dotfiles)
+		if IsHiddenPath(filepath.ToSlash(rel)) {
+			if info.IsDir() {
+				return filepath.SkipDir
+			}
+			return nil
+		}
+
 		// Skip directories
 		if info.IsDir() {
 			return nil
 		}
 
-		// Get relative path
-		rel, err := filepath.Rel(string(c.basePath), path)
-		if err != nil {
-			return err
+		// Skip manifest files
+		base := filepath.Base(rel)
+		if base == "index.mf" || base == ".index.mf" {
+			return nil
 		}
+
 		relPath := RelFilePath(rel)
 
 		// Check if path is in manifest

mfer/checker_test.go

@@ -305,6 +305,44 @@ func TestFindExtraFiles(t *testing.T) {
 	assert.Equal(t, "not in manifest", extras[0].Message)
 }
 
+func TestFindExtraFilesSkipsManifestAndDotfiles(t *testing.T) {
+	fs := afero.NewMemMapFs()
+	manifestFiles := map[string][]byte{
+		"file1.txt": []byte("in manifest"),
+	}
+	createTestManifest(t, fs, "/data/.index.mf", manifestFiles)
+	createFilesOnDisk(t, fs, "/data", map[string][]byte{
+		"file1.txt": []byte("in manifest"),
+	})
+	// Create dotfile and manifest that should be skipped
+	require.NoError(t, afero.WriteFile(fs, "/data/.hidden", []byte("hidden"), 0o644))
+	require.NoError(t, afero.WriteFile(fs, "/data/.config/settings", []byte("cfg"), 0o644))
+	// Create a real extra file
+	require.NoError(t, fs.MkdirAll("/data", 0o755))
+	require.NoError(t, afero.WriteFile(fs, "/data/extra.txt", []byte("extra"), 0o644))
+
+	chk, err := NewChecker("/data/.index.mf", "/data", fs)
+	require.NoError(t, err)
+
+	results := make(chan Result, 10)
+	err = chk.FindExtraFiles(context.Background(), results)
+	require.NoError(t, err)
+
+	var extras []Result
+	for r := range results {
+		extras = append(extras, r)
+	}
+
+	// Should only report extra.txt, not .hidden, .config/settings, or .index.mf
+	for _, e := range extras {
+		t.Logf("extra: %s", e.Path)
+	}
+	assert.Len(t, extras, 1)
+	if len(extras) > 0 {
+		assert.Equal(t, RelFilePath("extra.txt"), extras[0].Path)
+	}
+}
+
 func TestFindExtraFilesContextCancellation(t *testing.T) {
 	fs := afero.NewMemMapFs()
 	files := map[string][]byte{"file.txt": []byte("data")}

mfer/gpg.go

@@ -100,7 +100,7 @@ func gpgExtractPubKeyFingerprint(pubKey []byte) (string, error) {
 	if err != nil {
 		return "", fmt.Errorf("failed to create temp dir: %w", err)
 	}
-	defer os.RemoveAll(tmpDir)
+	defer func() { _ = os.RemoveAll(tmpDir) }()
 
 	// Set restrictive permissions
 	if err := os.Chmod(tmpDir, 0o700); err != nil {
@@ -158,7 +158,7 @@ func gpgVerify(data, signature, pubKey []byte) error {
 	if err != nil {
 		return fmt.Errorf("failed to create temp dir: %w", err)
 	}
-	defer os.RemoveAll(tmpDir)
+	defer func() { _ = os.RemoveAll(tmpDir) }()
 
 	// Set restrictive permissions
 	if err := os.Chmod(tmpDir, 0o700); err != nil {

mfer/gpg_test.go

@@ -34,15 +34,15 @@ func testGPGEnv(t *testing.T) (GPGKeyID, func()) {
 
 	// Save original GNUPGHOME and set new one
 	origGPGHome := os.Getenv("GNUPGHOME")
-	os.Setenv("GNUPGHOME", gpgHome)
+	require.NoError(t, os.Setenv("GNUPGHOME", gpgHome))
 
 	cleanup := func() {
 		if origGPGHome == "" {
-			os.Unsetenv("GNUPGHOME")
+			_ = os.Unsetenv("GNUPGHOME")
 		} else {
-			os.Setenv("GNUPGHOME", origGPGHome)
+			_ = os.Setenv("GNUPGHOME", origGPGHome)
 		}
-		os.RemoveAll(gpgHome)
+		_ = os.RemoveAll(gpgHome)
 	}
 
 	// Generate a test key with no passphrase

mfer/manifest.go

@@ -17,6 +17,7 @@ type manifest struct {
 	pbOuter        *MFFileOuter
 	output         *bytes.Buffer
 	signingOptions *SigningOptions
+	fixedUUID      []byte // if set, use this UUID instead of generating one
 }
 
 func (m *manifest) String() string {

mfer/scanner.go

@@ -47,6 +47,7 @@ type ScannerOptions struct {
 	FollowSymLinks  bool            // Resolve symlinks instead of skipping them
 	Fs              afero.Fs        // Filesystem to use, defaults to OsFs if nil
 	SigningOptions  *SigningOptions // GPG signing options (nil = no signing)
+	Seed            string          // If set, derive a deterministic UUID from this seed
 }
 
 // FileEntry represents a file that has been enumerated.
@@ -276,6 +277,9 @@ func (s *Scanner) ToManifest(ctx context.Context, w io.Writer, progress chan<- S
 	if s.options.SigningOptions != nil {
 		builder.SetSigningOptions(s.options.SigningOptions)
 	}
+	if s.options.Seed != "" {
+		builder.SetSeed(s.options.Seed)
+	}
 
 	var scannedFiles FileCount
 	var scannedBytes FileSize
@@ -385,6 +389,9 @@ func (s *Scanner) ToManifest(ctx context.Context, w io.Writer, progress chan<- S
 // The path should use forward slashes.
 func IsHiddenPath(p string) bool {
 	tp := path.Clean(p)
+	if tp == "." || tp == "/" {
+		return false
+	}
 	if strings.HasPrefix(tp, ".") {
 		return true
 	}

mfer/scanner_test.go

@@ -352,6 +352,8 @@ func TestIsHiddenPath(t *testing.T) {
 		{"/absolute/.hidden", true},
 		{"./relative", false}, // path.Clean removes leading ./
 		{"a/b/c/.d/e", true},
+		{".", false}, // current directory is not hidden
+		{"/", false}, // root is not hidden
 	}
 
 	for _, tt := range tests {

mfer/serialize.go

@@ -49,8 +49,13 @@ func (m *manifest) generateOuter() error {
 		return errors.New("internal error")
 	}
 
-	// Generate UUID and set on inner message
-	manifestUUID := uuid.New()
+	// Use fixed UUID if provided, otherwise generate a new one
+	var manifestUUID uuid.UUID
+	if len(m.fixedUUID) == 16 {
+		copy(manifestUUID[:], m.fixedUUID)
+	} else {
+		manifestUUID = uuid.New()
+	}
 	m.pbInner.Uuid = manifestUUID[:]
 
 	innerData, err := proto.MarshalOptions{Deterministic: true}.Marshal(m.pbInner)