Pinned CI action references to commit SHAs for security (tags are mutable and an RCE vector):
- `actions/checkout@v4` → `actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5`
- `actions/setup-go@v5` → `actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff`
The correct way of running make check in CI is not to install the prereqs/deps, but simply to docker build. The Dockerfile should always run make check (and have all of the prereqs installed in the build phase) to be able to fail if make check fails. This keeps CI configuration clean. Please remember this for all projects.
@clawbot
The correct way of running `make check` in CI is not to install the prereqs/deps, but simply to `docker build`. The Dockerfile should always run `make check` (and have all of the prereqs installed in the build phase) to be able to fail if `make check` fails. This keeps CI configuration clean. Please remember this for all projects.
sneak
removed their assignment 2026-02-27 05:16:10 +01:00
clawbot
was assigned by sneak2026-02-27 05:16:11 +01:00
Got it — CI workflow should just docker build ., and the Dockerfile handles all prereqs + make check in the build phase. Will fix this PR and remember for all projects going forward.
Got it — CI workflow should just `docker build .`, and the Dockerfile handles all prereqs + `make check` in the build phase. Will fix this PR and remember for all projects going forward.
Got it — CI should only run docker build ., with all prereqs and make check inside the Dockerfile build phase. Will update this PR accordingly. Noted as a standing rule for all projects.
Got it — CI should only run `docker build .`, with all prereqs and `make check` inside the Dockerfile build phase. Will update this PR accordingly. Noted as a standing rule for all projects.
The CI workflow on main already uses docker build . only (from PR #18/#19). This PR branch has been rebased onto main — the original approach of installing deps in CI is no longer needed. The Dockerfile handles all prereqs and runs make check during the build.
Note: docker build . currently fails on main due to an invalid golangci-lint v2 install path in the Dockerfile (github.com/golangci/golangci-lint/cmd/golangci-lint@v2.1.6 should be github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6). This is a separate issue on main, not specific to this PR.
The CI workflow on main already uses `docker build .` only (from PR #18/#19). This PR branch has been rebased onto main — the original approach of installing deps in CI is no longer needed. The Dockerfile handles all prereqs and runs `make check` during the build.
Note: `docker build .` currently fails on main due to an invalid golangci-lint v2 install path in the Dockerfile (`github.com/golangci/golangci-lint/cmd/golangci-lint@v2.1.6` should be `github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6`). This is a separate issue on main, not specific to this PR.
Pull request closed
Please reopen this pull request to perform a merge.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Adds CI workflow that runs
make checkon push/PR to main.Pinned CI action references to commit SHAs for security (tags are mutable and an RCE vector):
actions/checkout@v4→actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5actions/setup-go@v5→actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff@clawbot
The correct way of running
make checkin CI is not to install the prereqs/deps, but simply todocker build. The Dockerfile should always runmake check(and have all of the prereqs installed in the build phase) to be able to fail ifmake checkfails. This keeps CI configuration clean. Please remember this for all projects.Got it — CI workflow should just
docker build ., and the Dockerfile handles all prereqs +make checkin the build phase. Will fix this PR and remember for all projects going forward.Closing — this CI workflow was already added as part of PR #18 (repo standards audit), which has been merged to main.
Got it — CI should only run
docker build ., with all prereqs andmake checkinside the Dockerfile build phase. Will update this PR accordingly. Noted as a standing rule for all projects.Fixed and force-pushed. Changes:
docker build .onlyv2/cmd/golangci-lint(was missing/v2/)e2e40021c9007020676c93680a36e3ab06c6cd33(v2.9+ requires Go 1.25)CGO_ENABLED=0for golangci-lint install (fixes linker issue in Alpine)//nolint:gosecdirectives that were causing nolintlint failuresdocker build .passes locally — all tests pass, 0 lint issues, build succeeds.The CI workflow on main already uses
docker build .only (from PR #18/#19). This PR branch has been rebased onto main — the original approach of installing deps in CI is no longer needed. The Dockerfile handles all prereqs and runsmake checkduring the build.Note:
docker build .currently fails on main due to an invalid golangci-lint v2 install path in the Dockerfile (github.com/golangci/golangci-lint/cmd/golangci-lint@v2.1.6should begithub.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6). This is a separate issue on main, not specific to this PR.Pull request closed