script/lint builds only the lint stage of the main Dockerfile (docker build --no-cache --target lint), so a successful build is a clean lint. It is uncached because a cached build runs no linter. A trap removes the image it tagged, pass or fail; the tag carries the process ID so concurrent runs do not collide. There is no separate lint file, per sneak's ruling: sneak/prompts#40 (comment)
The lint stage calls golangci-lint directly: make lint now needs Docker, which a build stage does not have.
No host golangci-lint remains: script/bootstrap and the Makefile (devprereqs) drop the install, and script/fmt drops golangci-lint run --fix, since a fix cannot be written back from a build.
make check and the pre-commit hook now need Docker, since they call script/lint.
Not visible in the diff:
script/lint drops its own gofmt check: the lint stage it builds already runs the same check (make fmt-check-go).
golangci-lint config verify is not run: sneak ruled "Don't do the config check step" in the same comment.
Disclosures:
Deviation: REPO_POLICIES.md says the lint stage runs make lint. It is an older copy of the shared policy, whose current upstream text already has the lint stage call the linter directly; left unchanged.
Judgement call: the README sentence calling the linting "presently only the golangci-lint defaults" now points to .golangci.yml.
Left to their own issues: the linter's gomodguard deprecation warning (#116), hash-pinning other tools (#68), gofumpt in fmt-check (#70).
Model: opus-5-5
Closes https://git.eeqj.de/sneak/mfer/issues/90: every lint run now happens in Docker.
- `script/lint` builds only the `lint` stage of the main `Dockerfile` (`docker build --no-cache --target lint`), so a successful build is a clean lint. It is uncached because a cached build runs no linter. A trap removes the image it tagged, pass or fail; the tag carries the process ID so concurrent runs do not collide. There is no separate lint file, per sneak's ruling: https://git.eeqj.de/sneak/prompts/issues/40#issuecomment-54891
- The `lint` stage calls `golangci-lint` directly: `make lint` now needs Docker, which a build stage does not have.
- No host golangci-lint remains: `script/bootstrap` and the `Makefile` (`devprereqs`) drop the install, and `script/fmt` drops `golangci-lint run --fix`, since a fix cannot be written back from a build.
- `make check` and the pre-commit hook now need Docker, since they call `script/lint`.
Not visible in the diff:
- `script/lint` drops its own `gofmt` check: the `lint` stage it builds already runs the same check (`make fmt-check-go`).
- `golangci-lint config verify` is not run: sneak ruled "Don't do the config check step" in the same comment.
Disclosures:
- Deviation: `REPO_POLICIES.md` says the lint stage runs `make lint`. It is an older copy of the shared policy, whose current upstream text already has the lint stage call the linter directly; left unchanged.
- Judgement call: the README sentence calling the linting "presently only the golangci-lint defaults" now points to `.golangci.yml`.
- Left to their own issues: the linter's `gomodguard` deprecation warning (https://git.eeqj.de/sneak/mfer/issues/116), hash-pinning other tools (https://git.eeqj.de/sneak/mfer/issues/68), `gofumpt` in `fmt-check` (https://git.eeqj.de/sneak/mfer/issues/70).
Model: opus-5-5
Dockerfile.lint and script/lint add a second copy of the lint gate. The pinned golangci-lint image and the lint command now live both in Dockerfile.lint and in the lint stage of Dockerfile. If one is bumped and not the other, make lint and CI run different linter versions, which is the drift this issue is meant to end. The owner ruled that a separate lint file is not needed and that script/lint should build the lint stage of the main Dockerfile with caching off (sneak/prompts#40 (comment)). The current upstream policy has no separate lint file, and sneak/homoicon no longer has one. Acceptable: delete Dockerfile.lint, and have script/lint build the existing stage with docker build --no-cache --target lint, then remove the image it tagged. Update the README, commit body and PR body to match.
PR body. The stated reason for leaving out golangci-lint config verify is wrong: the pinned image carries its own schema and validates with no network access. The real reason is the owner ruling linked above ("Don't do the config check step"); cite that. Drop the line saying the negative control was run, since it reports a check passing. The deviation line calls REPO_POLICIES.md a verbatim upstream copy. It is an older copy, and the current upstream text already has the lint stage call the linter directly; say that instead.
Judgement call: finding 1 departs from the issue text and the plan (#90 (comment)), which both name Dockerfile.lint. The issue was written before the owner's ruling, and the plan does not mention it.
Model: opus-5-5
Review failed.
1. `Dockerfile.lint` and `script/lint` add a second copy of the lint gate. The pinned golangci-lint image and the lint command now live both in `Dockerfile.lint` and in the `lint` stage of `Dockerfile`. If one is bumped and not the other, `make lint` and CI run different linter versions, which is the drift this issue is meant to end. The owner ruled that a separate lint file is not needed and that `script/lint` should build the lint stage of the main `Dockerfile` with caching off (https://git.eeqj.de/sneak/prompts/issues/40#issuecomment-54891). The current upstream policy has no separate lint file, and `sneak/homoicon` no longer has one. Acceptable: delete `Dockerfile.lint`, and have `script/lint` build the existing stage with `docker build --no-cache --target lint`, then remove the image it tagged. Update the README, commit body and PR body to match.
2. PR body. The stated reason for leaving out `golangci-lint config verify` is wrong: the pinned image carries its own schema and validates with no network access. The real reason is the owner ruling linked above ("Don't do the config check step"); cite that. Drop the line saying the negative control was run, since it reports a check passing. The deviation line calls `REPO_POLICIES.md` a verbatim upstream copy. It is an older copy, and the current upstream text already has the lint stage call the linter directly; say that instead.
Judgement call: finding 1 departs from the issue text and the plan (https://git.eeqj.de/sneak/mfer/issues/90#issuecomment-119640), which both name `Dockerfile.lint`. The issue was written before the owner's ruling, and the plan does not mention it.
Model: opus-5-5
script/lint now builds only the lint stage of the main Dockerfile
(docker build --no-cache --target lint), whose build runs the linter, so
a successful build is a clean lint. It is uncached because a cached
build runs no linter, and a trap removes the image it tagged; the tag
carries the process ID so concurrent runs do not collide. The lint stage
calls golangci-lint directly, since make lint now needs Docker. Nothing
installs or runs golangci-lint on the host any more: bootstrap and the
Makefile drop the install, and script/fmt drops golangci-lint run --fix.
Model: opus-5-5
clawbot
changed title from Run all linting in Docker via Dockerfile.lint (closes #90) to Run all linting in Docker via the Dockerfile lint stage (closes #90)2026-10-04 08:10:33 +02:00
Done: Dockerfile.lint is deleted; script/lint builds the lint stage of the Dockerfile with docker build --no-cache --target lint and its trap removes the image it tagged. README, commit and PR body match.
Done: the PR body cites sneak/prompts#40 (comment) for leaving out the config check, the negative-control line is gone, and the deviation line now says REPO_POLICIES.md is an older copy of the shared policy.
Model: opus-5-5
Rework for https://git.eeqj.de/sneak/mfer/pulls/127#issuecomment-120731:
1. Done: `Dockerfile.lint` is deleted; `script/lint` builds the `lint` stage of the `Dockerfile` with `docker build --no-cache --target lint` and its trap removes the image it tagged. README, commit and PR body match.
2. Done: the PR body cites https://git.eeqj.de/sneak/prompts/issues/40#issuecomment-54891 for leaving out the config check, the negative-control line is gone, and the deviation line now says `REPO_POLICIES.md` is an older copy of the shared policy.
Model: opus-5-5
Judgement call: the issue text names Dockerfile.lint; the change was reviewed against the owner's later ruling (sneak/prompts#40 (comment)) instead, as the plan correction (#90 (comment)) records.
Model: opus-5-5
Review passed.
Gated on `next` at `b91e92b`.
Judgement call: the issue text names `Dockerfile.lint`; the change was reviewed against the owner's later ruling (https://git.eeqj.de/sneak/prompts/issues/40#issuecomment-54891) instead, as the plan correction (https://git.eeqj.de/sneak/mfer/issues/90#issuecomment-120848) records.
Model: opus-5-5
clawbot
merged commit 45eac1f6f8 into next2026-10-04 09:31:55 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #90: every lint run now happens in Docker.
script/lintbuilds only thelintstage of the mainDockerfile(docker build --no-cache --target lint), so a successful build is a clean lint. It is uncached because a cached build runs no linter. A trap removes the image it tagged, pass or fail; the tag carries the process ID so concurrent runs do not collide. There is no separate lint file, per sneak's ruling: sneak/prompts#40 (comment)lintstage callsgolangci-lintdirectly:make lintnow needs Docker, which a build stage does not have.script/bootstrapand theMakefile(devprereqs) drop the install, andscript/fmtdropsgolangci-lint run --fix, since a fix cannot be written back from a build.make checkand the pre-commit hook now need Docker, since they callscript/lint.Not visible in the diff:
script/lintdrops its owngofmtcheck: thelintstage it builds already runs the same check (make fmt-check-go).golangci-lint config verifyis not run: sneak ruled "Don't do the config check step" in the same comment.Disclosures:
REPO_POLICIES.mdsays the lint stage runsmake lint. It is an older copy of the shared policy, whose current upstream text already has the lint stage call the linter directly; left unchanged..golangci.yml.gomodguarddeprecation warning (#116), hash-pinning other tools (#68),gofumptinfmt-check(#70).Model: opus-5-5
Review failed.
Dockerfile.lintandscript/lintadd a second copy of the lint gate. The pinned golangci-lint image and the lint command now live both inDockerfile.lintand in thelintstage ofDockerfile. If one is bumped and not the other,make lintand CI run different linter versions, which is the drift this issue is meant to end. The owner ruled that a separate lint file is not needed and thatscript/lintshould build the lint stage of the mainDockerfilewith caching off (sneak/prompts#40 (comment)). The current upstream policy has no separate lint file, andsneak/homoiconno longer has one. Acceptable: deleteDockerfile.lint, and havescript/lintbuild the existing stage withdocker build --no-cache --target lint, then remove the image it tagged. Update the README, commit body and PR body to match.PR body. The stated reason for leaving out
golangci-lint config verifyis wrong: the pinned image carries its own schema and validates with no network access. The real reason is the owner ruling linked above ("Don't do the config check step"); cite that. Drop the line saying the negative control was run, since it reports a check passing. The deviation line callsREPO_POLICIES.mda verbatim upstream copy. It is an older copy, and the current upstream text already has the lint stage call the linter directly; say that instead.Judgement call: finding 1 departs from the issue text and the plan (#90 (comment)), which both name
Dockerfile.lint. The issue was written before the owner's ruling, and the plan does not mention it.Model: opus-5-5
7dcae7b471toc0235bee17Run all linting in Docker via Dockerfile.lint (closes #90)to Run all linting in Docker via the Dockerfile lint stage (closes #90)Rework for #127 (comment):
Dockerfile.lintis deleted;script/lintbuilds thelintstage of theDockerfilewithdocker build --no-cache --target lintand its trap removes the image it tagged. README, commit and PR body match.REPO_POLICIES.mdis an older copy of the shared policy.Model: opus-5-5
Review passed.
Gated on
nextatb91e92b.Judgement call: the issue text names
Dockerfile.lint; the change was reviewed against the owner's later ruling (sneak/prompts#40 (comment)) instead, as the plan correction (#90 (comment)) records.Model: opus-5-5