sneak/mfer
1
0
Fork 0
Code Issues 30 Pull Requests 1 Actions Releases Wiki Activity
Files
204f09c6469cbb88608b6bc6eb5e52c4fe18453f
mfer/TODO.md
sneak 204f09c646
All checks were successful
check / check (push) Successful in 38s
Details
Configure prettier and make fmt-check cover markdown (closes #69) 
script/fmt ran prettier with default settings over root-level *.md and
*.json, swallowing every failure with `|| true`, while script/fmt-check
checked gofmt only. The formatter and the gate therefore disagreed
silently: `make fmt` rewrote markdown that `make check` never looked at,
including REPO_POLICIES.md, which is a verbatim copy of an authoritative
upstream document that local tooling must not touch.

Configuration:

- .prettierrc pins the two policy deviations from prettier defaults,
  four-space indents and proseWrap: always. Nothing else.
- .prettierignore excludes REPO_POLICIES.md so no local run can drift it
  from upstream again, plus .golangci.yml (user-owned, and listed even
  though the current file set does not reach it) and node_modules,
  vendor, bin.

One canonical file set:

- New script/prettier takes --write or --check and applies the same
  patterns in both modes, so script/fmt and script/fmt-check cannot
  drift apart by construction. The patterns are repo-wide (**/*.md,
  **/*.json) rather than root-only, so markdown in subdirectories such
  as a future docs/ is covered.
- No `|| true` anywhere, and no --no-error-on-unmatched-pattern: both
  patterns always match tracked files, so an empty match means the glob
  broke and prettier should say so instead of passing vacuously. A
  missing prettier is a hard error naming script/bootstrap, not a
  silent skip.

Pinned prettier:

- package.json/yarn.lock pin prettier 3.9.6; the lockfile carries the
  integrity hash, and --frozen-lockfile enforces it. script/prettier
  prefers node_modules/.bin/prettier and warns on stderr when it has to
  fall back to a PATH prettier of unknown version.
- script/bootstrap now installs node, yarn, and the locked JS deps. Its
  NODE_VERSION and YARN_VERSION pins already existed.

Docker gate:

- The golangci-lint image has no node, so the lint stage runs the new
  script/fmt-check-go (the Go half of fmt-check, extracted) instead of
  the whole thing.
- The markdown half gets its own stage on a digest-pinned node image
  shipping exactly the node and yarn versions bootstrap pins. The
  builder stage takes a COPY --from dependency on it, so BuildKit cannot
  skip it and a markdown violation fails `docker build .` rather than
  being skipped somewhere nobody looks.

Markdown files other than REPO_POLICIES.md are reformatted here for the
first time under the policy settings.
2026-08-10 14:08:33 +00:00

5.3 KiB
Raw Blame History

Workflow

  • branch (from main)
  • do the work in Next Step
  • move Next Step to the top of Completed Steps
  • move the top item of Future Steps into Next Step
  • commit (TODO.md changes in the same commit as the work)
  • merge to main if the branch is not protected, otherwise open a PR
  • push

Status

pre-1.0. No git tags. README section "TODO: Remaining Work for 1.0" lists open design questions and implementation tasks; policy compliance work is in flight and unmerged.

Next Step

Work through the remaining compliance items folded from the 2026-07-02 audit (the first group under Future Steps): .editorconfig, .gitignore coverage, gofumpt-based fmt-check, README "Getting Started", and the rest. .golangci.yml and TODO.md are tracked and committed as of 2026-08-07, so the only thing left of the chore/align-repo-policies branch is the list below.

Completed Steps

  • 2026-08-09: added .prettierrc/.prettierignore, gave script/fmt and script/fmt-check one shared prettier file set via script/prettier, dropped the || true that hid prettier failures, and added a node-based Dockerfile stage so a markdown formatting violation fails docker build . (#69)
  • 2026-08-07: updated golangci-lint to v2.12.2 everywhere it is pinned (Makefile, Dockerfile), added the canonical .golangci.yml (default: all), and fixed all resulting lint findings across the codebase
  • 2026-07-07 Adopted scripts-to-rule-them-all: script/ entrypoints, Makefile shims, README Entrypoints section
  • 2026-07-03: aligned repo tooling, docs, and config with standardized policies (7d9a138, on chore/align-repo-policies, unmerged)
  • 2026-06-28: moved to standardized repo policies (#56, on main)
  • 2026-04-07: added 1.0 roadmap as README TODO section, removed old TODO.md (#54)
  • 2026-03-20: added Gitea Actions CI workflow (#53)
  • 2026-03-17: added REPO_POLICIES.md, renamed CLAUDE.md to AGENTS.md (#51); removed committed .index.mf (#52)
  • 2026-03-15: split Dockerfile with pre-built golangci-lint stage for faster CI (#45)
  • 2026-03-01: 1.0 quality polish: code review, tests, bug fixes, docs (#32)
  • 2026-02-20: deterministic file ordering in Builder.Build() (#28); removed committed vendor/modcache archives (#35)
  • 2026-02-08: added --seed flag for deterministic manifest UUID

Future Steps

  • Compliance (fold of TODO.md audit 2026-07-02; verify which items the in-flight branch already closes, then check off):
    • Add .editorconfig (canonical copy from sneak/prompts)
    • Make .gitignore cover secrets (.env, _.key, .pem), OS files (.DS_Store), and editor files (.swp, _~)
    • Make fmt-check/lint verify with gofumpt, not gofmt -l, so make check matches what make fmt writes
    • Add README "Getting Started" section with copy-pasteable install/usage block
    • Move FORMAT.md from repo root to docs/ and update the AGENTS.md reference
    • Pin Makefile-installed Go tools (protoc-gen-go@v1.28.1, golangci-lint@v2.12.2) by module hash, not mutable tag
    • Set make test timeout to 30s (currently 10s)
    • Add explicit README "Rationale" heading (content exists under other names); name the author in the README Description first line
    • Reconcile root-level AGENTS.md with directory-hygiene policy (keep or relocate)
    • Add a make build target
    • Rewrite make hooks to use printf or a heredoc instead of non-portable echo '...\n...'
  • Answer the 14 owner design questions in the README 1.0 roadmap:
    • Format: simplify MFFileChecksum; store file mode; drop atime; specify path normalization rules; version byte after magic; length-prefix after magic
    • Signatures: hash covers compressed or uncompressed data; sign raw bytes vs hex canonical string; detached .mf.sig support; GPG subprocess vs pure-Go crypto
    • Implementation: deterministic manifests by default; consolidate duplicate scanner/checker implementations; export the manifest type; canonical Go module path for 1.0
  • Format and correctness:
    • Resolve proto go_package vs go.mod module path inconsistency
    • Specify and validate path invariants (UTF-8, forward-slash, relative, no .., no leading /)
    • Remove or deprecate atime; reserve mode field; add version byte (all pending design answers)
    • Write a standalone format specification document
  • Library:
    • Delete internal/scanner and internal/checker; consolidate on the mfer/ package versions (pending design answer)
    • Add decompression size limit via io.LimitReader in deserializeInner()
    • Fix errors.Is dead code in checker; make AddFile verify totalRead == size
    • Export manifest type or define a public interface (pending)
    • Replace GPG subprocess with pure-Go crypto (pending); add timeouts to remaining subprocess calls
  • CLI:
    • Kebab-case primary flag names; fix fetch URL construction with url.JoinPath; add http.Client timeout and retry with backoff to fetch; rate-limit Checker progress output; add --deterministic flag or default; wire top-level --version properly
  • Testing:
    • Fuzz NewManifestFromReader; end-to-end tests for freshen and fetch
  • Documentation:
    • Promote docs/FORMAT.md as primary spec reference; audit error messages; document the signature scheme fully
  • Release:
    • Finalize module path, bump version constant, SemVer --version output, tag v1.0.0
Reference in New Issue View Git Blame Copy Permalink