clawbot
5683d0f4ff
All checks were successful
check / check (push) Successful in 4s
Adds .prettierrc and .prettierignore, a single script/prettier entrypoint shared by fmt and fmt-check so the two cannot drift, and prettier 3.9.6 pinned by yarn.lock integrity hash. Markdown formatting is now gated in the authoritative Docker build via a new mdfmt stage, since the golangci-lint image has no node. REPO_POLICIES.md is ignored so local tooling cannot drift it from upstream. Removes the || true that made the previous prettier invocation unable to fail.
110 lines
5.3 KiB
Markdown
110 lines
5.3 KiB
Markdown
# Workflow
|
|
|
|
- branch (from `main`)
|
|
- do the work in Next Step
|
|
- move Next Step to the top of Completed Steps
|
|
- move the top item of Future Steps into Next Step
|
|
- commit (`TODO.md` changes in the same commit as the work)
|
|
- merge to `main` if the branch is not protected, otherwise open a PR
|
|
- push
|
|
|
|
# Status
|
|
|
|
pre-1.0. No git tags. README section "TODO: Remaining Work for 1.0" lists open
|
|
design questions and implementation tasks; policy compliance work is in flight
|
|
and unmerged.
|
|
|
|
# Next Step
|
|
|
|
Work through the remaining compliance items folded from the 2026-07-02 audit
|
|
(the first group under Future Steps): `.editorconfig`, `.gitignore` coverage,
|
|
gofumpt-based `fmt-check`, README "Getting Started", and the rest.
|
|
`.golangci.yml` and `TODO.md` are tracked and committed as of 2026-08-07, so the
|
|
only thing left of the `chore/align-repo-policies` branch is the list below.
|
|
|
|
# Completed Steps
|
|
|
|
- 2026-08-09: added `.prettierrc`/`.prettierignore`, gave `script/fmt` and
|
|
`script/fmt-check` one shared prettier file set via `script/prettier`, dropped
|
|
the `|| true` that hid prettier failures, and added a node-based Dockerfile
|
|
stage so a markdown formatting violation fails `docker build .` (#69)
|
|
- 2026-08-07: updated golangci-lint to v2.12.2 everywhere it is pinned
|
|
(`Makefile`, `Dockerfile`), added the canonical `.golangci.yml`
|
|
(`default: all`), and fixed all resulting lint findings across the codebase
|
|
- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
|
|
shims, README Entrypoints section
|
|
- 2026-07-03: aligned repo tooling, docs, and config with standardized policies
|
|
(7d9a138, on chore/align-repo-policies, unmerged)
|
|
- 2026-06-28: moved to standardized repo policies (#56, on main)
|
|
- 2026-04-07: added 1.0 roadmap as README TODO section, removed old TODO.md
|
|
(#54)
|
|
- 2026-03-20: added Gitea Actions CI workflow (#53)
|
|
- 2026-03-17: added REPO_POLICIES.md, renamed CLAUDE.md to AGENTS.md (#51);
|
|
removed committed .index.mf (#52)
|
|
- 2026-03-15: split Dockerfile with pre-built golangci-lint stage for faster CI
|
|
(#45)
|
|
- 2026-03-01: 1.0 quality polish: code review, tests, bug fixes, docs (#32)
|
|
- 2026-02-20: deterministic file ordering in Builder.Build() (#28); removed
|
|
committed vendor/modcache archives (#35)
|
|
- 2026-02-08: added --seed flag for deterministic manifest UUID
|
|
|
|
# Future Steps
|
|
|
|
- Compliance (fold of TODO.md audit 2026-07-02; verify which items the in-flight
|
|
branch already closes, then check off):
|
|
- Add .editorconfig (canonical copy from sneak/prompts)
|
|
- Make .gitignore cover secrets (.env, _.key, _.pem), OS files (.DS_Store),
|
|
and editor files (_.swp, _~)
|
|
- Make fmt-check/lint verify with gofumpt, not gofmt -l, so `make check`
|
|
matches what `make fmt` writes
|
|
- Add README "Getting Started" section with copy-pasteable install/usage
|
|
block
|
|
- Move FORMAT.md from repo root to docs/ and update the AGENTS.md reference
|
|
- Pin Makefile-installed Go tools (`protoc-gen-go@v1.28.1`,
|
|
`golangci-lint@v2.12.2`) by module hash, not mutable tag
|
|
- Set `make test` timeout to 30s (currently 10s)
|
|
- Add explicit README "Rationale" heading (content exists under other
|
|
names); name the author in the README Description first line
|
|
- Reconcile root-level AGENTS.md with directory-hygiene policy (keep or
|
|
relocate)
|
|
- Add a `make build` target
|
|
- Rewrite `make hooks` to use printf or a heredoc instead of non-portable
|
|
`echo '...\n...'`
|
|
- Answer the 14 owner design questions in the README 1.0 roadmap:
|
|
- Format: simplify MFFileChecksum; store file mode; drop atime; specify path
|
|
normalization rules; version byte after magic; length-prefix after magic
|
|
- Signatures: hash covers compressed or uncompressed data; sign raw bytes vs
|
|
hex canonical string; detached .mf.sig support; GPG subprocess vs pure-Go
|
|
crypto
|
|
- Implementation: deterministic manifests by default; consolidate duplicate
|
|
scanner/checker implementations; export the manifest type; canonical Go
|
|
module path for 1.0
|
|
- Format and correctness:
|
|
- Resolve proto go_package vs go.mod module path inconsistency
|
|
- Specify and validate path invariants (UTF-8, forward-slash, relative, no
|
|
.., no leading /)
|
|
- Remove or deprecate atime; reserve mode field; add version byte (all
|
|
pending design answers)
|
|
- Write a standalone format specification document
|
|
- Library:
|
|
- Delete internal/scanner and internal/checker; consolidate on the mfer/
|
|
package versions (pending design answer)
|
|
- Add decompression size limit via io.LimitReader in deserializeInner()
|
|
- Fix errors.Is dead code in checker; make AddFile verify totalRead == size
|
|
- Export manifest type or define a public interface (pending)
|
|
- Replace GPG subprocess with pure-Go crypto (pending); add timeouts to
|
|
remaining subprocess calls
|
|
- CLI:
|
|
- Kebab-case primary flag names; fix fetch URL construction with
|
|
url.JoinPath; add http.Client timeout and retry with backoff to fetch;
|
|
rate-limit Checker progress output; add --deterministic flag or default;
|
|
wire top-level --version properly
|
|
- Testing:
|
|
- Fuzz NewManifestFromReader; end-to-end tests for freshen and fetch
|
|
- Documentation:
|
|
- Promote docs/FORMAT.md as primary spec reference; audit error messages;
|
|
document the signature scheme fully
|
|
- Release:
|
|
- Finalize module path, bump version constant, SemVer --version output, tag
|
|
v1.0.0
|