clawbot
de476708e9
Some checks failed
check / check (push) Has been cancelled
Adopts golangci-lint v2.12.2 and the canonical .golangci.yml (default: all), and fixes all resulting findings across the tree. Two intended behavior changes: absent MFFilePath.Mtime is handled explicitly in freshen, list and export rather than dereferenced (main panicked); gpg positional key IDs now follow an explicit -- end-of-options marker. All twelve reworded user-visible error messages restored to byte-identical parity with main and pinned by tests.
112 lines
5.0 KiB
Markdown
112 lines
5.0 KiB
Markdown
# Workflow
|
|
|
|
- branch (from `main`)
|
|
- do the work in Next Step
|
|
- move Next Step to the top of Completed Steps
|
|
- move the top item of Future Steps into Next Step
|
|
- commit (`TODO.md` changes in the same commit as the work)
|
|
- merge to `main` if the branch is not protected, otherwise open a PR
|
|
- push
|
|
|
|
# Status
|
|
|
|
pre-1.0. No git tags. README section "TODO: Remaining Work for 1.0" lists
|
|
open design questions and implementation tasks; policy compliance work is
|
|
in flight and unmerged.
|
|
|
|
# Next Step
|
|
|
|
Work through the remaining compliance items folded from the 2026-07-02
|
|
audit (the first group under Future Steps): `.editorconfig`, `.gitignore`
|
|
coverage, gofumpt-based `fmt-check`, README "Getting Started", and the
|
|
rest. `.golangci.yml` and `TODO.md` are tracked and committed as of
|
|
2026-08-07, so the only thing left of the `chore/align-repo-policies`
|
|
branch is the list below.
|
|
|
|
# Completed Steps
|
|
|
|
- 2026-08-07: updated golangci-lint to v2.12.2 everywhere it is pinned
|
|
(`Makefile`, `Dockerfile`), added the canonical `.golangci.yml`
|
|
(`default: all`), and fixed all resulting lint findings across the
|
|
codebase
|
|
- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
|
|
Makefile shims, README Entrypoints section
|
|
- 2026-07-03: aligned repo tooling, docs, and config with standardized
|
|
policies (7d9a138, on chore/align-repo-policies, unmerged)
|
|
- 2026-06-28: moved to standardized repo policies (#56, on main)
|
|
- 2026-04-07: added 1.0 roadmap as README TODO section, removed old
|
|
TODO.md (#54)
|
|
- 2026-03-20: added Gitea Actions CI workflow (#53)
|
|
- 2026-03-17: added REPO_POLICIES.md, renamed CLAUDE.md to AGENTS.md (#51);
|
|
removed committed .index.mf (#52)
|
|
- 2026-03-15: split Dockerfile with pre-built golangci-lint stage for
|
|
faster CI (#45)
|
|
- 2026-03-01: 1.0 quality polish: code review, tests, bug fixes, docs (#32)
|
|
- 2026-02-20: deterministic file ordering in Builder.Build() (#28);
|
|
removed committed vendor/modcache archives (#35)
|
|
- 2026-02-08: added --seed flag for deterministic manifest UUID
|
|
|
|
# Future Steps
|
|
|
|
- Compliance (fold of TODO.md audit 2026-07-02; verify which items the
|
|
in-flight branch already closes, then check off):
|
|
- Add .editorconfig (canonical copy from sneak/prompts)
|
|
- Make .gitignore cover secrets (.env, _.key, _.pem), OS files
|
|
(.DS_Store), and editor files (_.swp, _~)
|
|
- Make fmt-check/lint verify with gofumpt, not gofmt -l, so
|
|
`make check` matches what `make fmt` writes
|
|
- Add README "Getting Started" section with copy-pasteable
|
|
install/usage block
|
|
- Move FORMAT.md from repo root to docs/ and update the AGENTS.md
|
|
reference
|
|
- Pin Makefile-installed Go tools (`protoc-gen-go@v1.28.1`,
|
|
`golangci-lint@v2.12.2`) by module hash, not mutable tag
|
|
- Set `make test` timeout to 30s (currently 10s)
|
|
- Add explicit README "Rationale" heading (content exists under other
|
|
names); name the author in the README Description first line
|
|
- Reconcile root-level AGENTS.md with directory-hygiene policy (keep
|
|
or relocate)
|
|
- Add a `make build` target
|
|
- Rewrite `make hooks` to use printf or a heredoc instead of
|
|
non-portable `echo '...\n...'`
|
|
- Answer the 14 owner design questions in the README 1.0 roadmap:
|
|
- Format: simplify MFFileChecksum; store file mode; drop atime;
|
|
specify path normalization rules; version byte after magic;
|
|
length-prefix after magic
|
|
- Signatures: hash covers compressed or uncompressed data; sign raw
|
|
bytes vs hex canonical string; detached .mf.sig support; GPG
|
|
subprocess vs pure-Go crypto
|
|
- Implementation: deterministic manifests by default; consolidate
|
|
duplicate scanner/checker implementations; export the manifest
|
|
type; canonical Go module path for 1.0
|
|
- Format and correctness:
|
|
- Resolve proto go_package vs go.mod module path inconsistency
|
|
- Specify and validate path invariants (UTF-8, forward-slash,
|
|
relative, no .., no leading /)
|
|
- Remove or deprecate atime; reserve mode field; add version byte
|
|
(all pending design answers)
|
|
- Write a standalone format specification document
|
|
- Library:
|
|
- Delete internal/scanner and internal/checker; consolidate on the
|
|
mfer/ package versions (pending design answer)
|
|
- Add decompression size limit via io.LimitReader in
|
|
deserializeInner()
|
|
- Fix errors.Is dead code in checker; make AddFile verify
|
|
totalRead == size
|
|
- Export manifest type or define a public interface (pending)
|
|
- Replace GPG subprocess with pure-Go crypto (pending); add timeouts
|
|
to remaining subprocess calls
|
|
- CLI:
|
|
- Kebab-case primary flag names; fix fetch URL construction with
|
|
url.JoinPath; add http.Client timeout and retry with backoff to
|
|
fetch; rate-limit Checker progress output; add --deterministic
|
|
flag or default; wire top-level --version properly
|
|
- Testing:
|
|
- Fuzz NewManifestFromReader; end-to-end tests for freshen and fetch
|
|
- Documentation:
|
|
- Promote docs/FORMAT.md as primary spec reference; audit error
|
|
messages; document the signature scheme fully
|
|
- Release:
|
|
- Finalize module path, bump version constant, SemVer --version
|
|
output, tag v1.0.0
|