From 68c5325da3abb02c2ba1c3e09f588e600ee690e1 Mon Sep 17 00:00:00 2001
From: sneak <sneak@sneak.berlin>
Date: Sat, 3 Oct 2026 14:46:07 +0000
Subject: [PATCH] Lint's .golangci.yml check says which fix applies (closes
 #34)

backend/script/lint compared .golangci.yml with its pinned sha256 and,
on any failure, said to restore the file from sneak/prompts. Once the
org standard has legitimately changed, that advice loops: the copied
file is right and GOLANGCI_CONFIG_SHA256 is stale. On a mismatch the
script now says to compare the file with the org standard, restore it
if they differ, and update GOLANGCI_CONFIG_SHA256 if they are the same;
it still prints both hashes. A missing .golangci.yml, and a sha256sum
that is missing or prints no hash, get their own messages instead of
being reported as a mismatch. Each failure still exits 1. .golangci.yml
is unchanged.

Model: opus-5-5
---
 TODO.md             |  8 ++++++++
 backend/script/lint | 22 ++++++++++++++++++++--
 2 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/TODO.md b/TODO.md
index 536f37f..b494400 100644
--- a/TODO.md
+++ b/TODO.md
@@ -23,6 +23,14 @@ latest run passes.
 
 # Completed Steps
 
+- 2026-10-03: `backend/script/lint` says what went wrong with its
+  `.golangci.yml` check (issue #34). On a hash mismatch it says to compare the
+  file with the org standard: if they differ, restore the org standard; if they
+  are the same, the org standard changed, so update `GOLANGCI_CONFIG_SHA256` in
+  that script. It used to say only to restore the file, which loops once the org
+  standard itself has moved. A missing `.golangci.yml`, and a `sha256sum` that
+  is missing or prints no hash, each get their own message instead of being
+  reported as a mismatch; every one still fails the lint
 - 2026-10-03: the Go tests run with the race detector and coverage (issue #88):
   `backend/script/test` runs `go test -timeout 30s -race -cover ./...` and, if
   that fails, runs it again with `-v` and fails. Go's `-timeout` bounds the
diff --git a/backend/script/lint b/backend/script/lint
index 720b747..b447e9e 100755
--- a/backend/script/lint
+++ b/backend/script/lint
@@ -14,16 +14,34 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# The sha256 of the org standard .golangci.yml. When that file changes in
+# sneak/prompts and is copied here again, this changes with it.
 GOLANGCI_CONFIG_SHA256="a79b63a254602a5318db5d0e9a06bc71b84bf0c1d896305229d8bfed1d1b1776"
 
 main() {
     cd "$ROOT"
+    if [ ! -f .golangci.yml ]; then
+        echo "backend/.golangci.yml is missing. Copy the org standard verbatim" >&2
+        echo "from https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml" >&2
+        exit 1
+    fi
     actual="$(sha256sum .golangci.yml | cut -d' ' -f1)"
+    if [ -z "$actual" ]; then
+        echo "sha256sum is missing or printed no hash, so" >&2
+        echo "backend/.golangci.yml could not be checked." >&2
+        exit 1
+    fi
     if [ "$actual" != "$GOLANGCI_CONFIG_SHA256" ]; then
-        echo ".golangci.yml has drifted from the org standard." >&2
+        echo "backend/.golangci.yml does not match GOLANGCI_CONFIG_SHA256" >&2
+        echo "in backend/script/lint." >&2
         echo "  expected $GOLANGCI_CONFIG_SHA256" >&2
         echo "  actual   $actual" >&2
-        echo "Restore it verbatim from sneak/prompts; do not edit it." >&2
+        echo "Compare it with the org standard," >&2
+        echo "https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml" >&2
+        echo "- If they differ, it was edited here: restore the org standard" >&2
+        echo "  verbatim. Do not edit it." >&2
+        echo "- If they are the same, the org standard changed: set" >&2
+        echo "  GOLANGCI_CONFIG_SHA256 in backend/script/lint to the actual hash." >&2
         exit 1
     fi
     golangci-lint run ./...