Re-vendor the shared files from sneak/prompts at dd4027b (closes #113)

The shared files are the sneak/prompts copies at dd4027b, with this
repository's own entries after them. make lint and make test each build
one Dockerfile phase without the cache, both covering the frontend
through a node stage; the builder stage waits on both and takes its
version from git describe unless VERSION is given. golangci-lint moves
to v2.14.0 with the new .golangci.yml; one test spells X-Request-ID as
canonicalheader asks. prettier formats only JavaScript, CSS, HTML and
Markdown, so .golangci.yml stays as fetched. script/fmt and
script/fmt-check put ~/.local/bin on PATH, which the shared workflow no
longer does. script/bootstrap keeps a Go only if it is exactly
GO_VERSION, and re-checks the go on PATH after installing.

Model: opus-5-5

backend/.golangci.yml

@@ -17,6 +17,7 @@ linters:
   disable:
     # Genuinely incompatible with project patterns
     - exhaustruct      # Requires all struct fields
+    - exhaustruct_v5   # Requires all struct fields (successor to exhaustruct)
     - godot            # Requires comments to end with periods
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go

backend/README.md

@@ -28,20 +28,21 @@ docker run -p 8080:8080 netwatch
 This directory follows the same
 [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
 pattern as the repo root: the targets in `backend/Makefile` are thin shims over
-`backend/script/`. The root `Dockerfile` runs them, and the root scripts call
-`test`, `fmt` and `fmt-check`:
+`backend/script/`. The root `Dockerfile` runs `build`, and the root scripts call
+`fmt` and `fmt-check`:
 
 - `script/build` — compile the static `netwatch-server` binary with its version
   stamped in. The version is `VERSION` from the environment; when that is unset
   or empty, it falls back to `git describe` inside a git checkout, then to `dev`
-- `script/test` — run the Go tests with the race detector and coverage. Go's
-  `-timeout 30s` bounds the tests, not their compile. If they fail, they run
-  again with `-v` for the details, and the script fails. The race detector needs
-  a C compiler
-- `script/lint` — check `.golangci.yml` against its pinned sha256, then run
-  golangci-lint. It runs inside the golangci-lint image of the lint stage of the
-  root `Dockerfile`; from a checkout, run `make lint` at the repo root, which
-  builds that stage
+- `script/test` — run the Go tests on the host with the race detector and
+  coverage; the root `make test` runs them in the `test` phase of the root
+  `Dockerfile`. Go's `-timeout 90s` bounds the tests, not their compile, and
+  `-count=1` keeps Go from reporting a stored pass. If they fail, they run again
+  with `-v` for the details, and the script fails. The race detector needs a C
+  compiler
+- `script/lint` — run the root `script/lint`, which builds the `lint` phase of
+  the root `Dockerfile`: golangci-lint over this directory, and eslint over the
+  frontend. golangci-lint never runs on the host
 - `script/fmt` — format the Go sources (writes)
 - `script/fmt-check` — check Go formatting (read-only)
 - `script/run` — build and run the server locally

backend/internal/middleware/middleware_test.go

@@ -343,7 +343,7 @@ func TestLoggingCutsRequestStringsToBound(t *testing.T) {
 		http.MethodGet, "/"+long, http.NoBody)
 	req.Header.Set("User-Agent", long)
 	req.Header.Set("Referer", long)
-	req.Header.Set("X-Request-Id", long)
+	req.Header.Set("X-Request-ID", long)
 
 	handler.ServeHTTP(httptest.NewRecorder(), req)
 

backend/script/lint

@@ -1,50 +1,13 @@
 #!/bin/sh
-# script/lint: run golangci-lint over the backend. This runs inside the
-# lint stage of the root Dockerfile, whose digest-pinned golangci-lint
-# image provides the linter; nothing installs golangci-lint on the host.
-# From a checkout, run `make lint` at the repo root, which builds that
-# stage.
-#
-# .golangci.yml is standardized org-wide and must never be edited here
-# (REPO_POLICIES.md). Its last silent drift replaced the v2 schema with
-# v1 keys, which left every threshold in the file inert while the build
-# stayed green. So the file is first checked against the canonical
-# copy's sha256: a local comparison, no network, nothing unpinned.
+# script/lint: lint the whole repo as the root make lint does, by
+# building the lint phase of the root Dockerfile. golangci-lint never
+# runs on the host (REPO_POLICIES.md).
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# The sha256 of the org standard .golangci.yml. When that file changes in
-# sneak/prompts and is copied here again, this changes with it.
-GOLANGCI_CONFIG_SHA256="a79b63a254602a5318db5d0e9a06bc71b84bf0c1d896305229d8bfed1d1b1776"
+ROOT="$(cd "$(dirname "$0")/../.." && pwd -P)"
 
 main() {
-    cd "$ROOT"
-    if [ ! -f .golangci.yml ]; then
-        echo "backend/.golangci.yml is missing. Copy the org standard verbatim" >&2
-        echo "from https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml" >&2
-        exit 1
-    fi
-    actual="$(sha256sum .golangci.yml | cut -d' ' -f1)"
-    if [ -z "$actual" ]; then
-        echo "sha256sum is missing or printed no hash, so" >&2
-        echo "backend/.golangci.yml could not be checked." >&2
-        exit 1
-    fi
-    if [ "$actual" != "$GOLANGCI_CONFIG_SHA256" ]; then
-        echo "backend/.golangci.yml does not match GOLANGCI_CONFIG_SHA256" >&2
-        echo "in backend/script/lint." >&2
-        echo "  expected $GOLANGCI_CONFIG_SHA256" >&2
-        echo "  actual   $actual" >&2
-        echo "Compare it with the org standard," >&2
-        echo "https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml" >&2
-        echo "- If they differ, it was edited here: restore the org standard" >&2
-        echo "  verbatim. Do not edit it." >&2
-        echo "- If they are the same, the org standard changed: set" >&2
-        echo "  GOLANGCI_CONFIG_SHA256 in backend/script/lint to the actual hash." >&2
-        exit 1
-    fi
-    golangci-lint run ./...
+    exec "$ROOT/script/lint"
 }
 
 main "$@"

backend/script/test

@@ -1,18 +1,21 @@
 #!/bin/sh
-# script/test: run the backend test suite with the race detector and
-# coverage. Go's own -timeout bounds the tests and not their compile,
-# so a cold build cache cannot fail it. The race detector needs cgo,
-# and so a C compiler. If the tests fail, they run again with -v for
-# the details, and the script fails even if that run passes.
+# script/test: run the backend test suite on the host with the race
+# detector and coverage. The root make test runs the same in the test
+# phase of the root Dockerfile. Go's own -timeout bounds the tests and
+# not their compile, so a cold build cache cannot fail it. -count=1
+# keeps Go's test result cache out of both runs, so neither can report
+# a stored pass. The race detector needs cgo, and so a C compiler. If
+# the tests fail, they run again with -v for the details, and the
+# script fails even if that run passes.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    go test -timeout 30s -race -cover ./... || {
+    go test -count=1 -timeout 90s -race -cover ./... || {
         echo "--- Rerunning with -v for details ---"
-        go test -timeout 30s -race -v ./...
+        go test -count=1 -timeout 90s -race -v ./...
         exit 1
     }
 }