Re-vendor the shared files from sneak/prompts at dd4027b (closes #113)

The shared files are the sneak/prompts copies at dd4027b, with this
repository's own entries after them. make lint and make test each build
one phase of the Dockerfile without the cache, and each covers the
frontend through a node stage; the builder stage waits on both and takes
its version from git describe unless VERSION is given. golangci-lint
moves to v2.14.0 with the new .golangci.yml, and one test spells
X-Request-ID as canonicalheader asks. prettier formats only JavaScript,
CSS, HTML and Markdown, so the shared .golangci.yml stays as fetched.
script/fmt and script/fmt-check put ~/.local/bin on PATH, which the
shared workflow no longer does.

Model: opus-5-5

backend/.golangci.yml

@@ -17,6 +17,7 @@ linters:
   disable:
     # Genuinely incompatible with project patterns
     - exhaustruct      # Requires all struct fields
+    - exhaustruct_v5   # Requires all struct fields (successor to exhaustruct)
     - godot            # Requires comments to end with periods
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go

backend/README.md

@@ -28,20 +28,21 @@ docker run -p 8080:8080 netwatch
 This directory follows the same
 [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
 pattern as the repo root: the targets in `backend/Makefile` are thin shims over
-`backend/script/`. The root `Dockerfile` runs them, and the root scripts call
-`test`, `fmt` and `fmt-check`:
+`backend/script/`. The root `Dockerfile` runs `build`, and the root scripts call
+`fmt` and `fmt-check`:
 
 - `script/build` — compile the static `netwatch-server` binary with its version
   stamped in. The version is `VERSION` from the environment; when that is unset
   or empty, it falls back to `git describe` inside a git checkout, then to `dev`
-- `script/test` — run the Go tests with the race detector and coverage. Go's
-  `-timeout 30s` bounds the tests, not their compile. If they fail, they run
-  again with `-v` for the details, and the script fails. The race detector needs
-  a C compiler
-- `script/lint` — check `.golangci.yml` against its pinned sha256, then run
-  golangci-lint. It runs inside the golangci-lint image of the lint stage of the
-  root `Dockerfile`; from a checkout, run `make lint` at the repo root, which
-  builds that stage
+- `script/test` — run the Go tests on the host with the race detector and
+  coverage; the root `make test` runs them in the `test` phase of the root
+  `Dockerfile`. Go's `-timeout 90s` bounds the tests, not their compile, and
+  `-count=1` keeps Go from reporting a stored pass. If they fail, they run again
+  with `-v` for the details, and the script fails. The race detector needs a C
+  compiler
+- `script/lint` — run the root `script/lint`, which builds the `lint` phase of
+  the root `Dockerfile`: golangci-lint over this directory, and eslint over the
+  frontend. golangci-lint never runs on the host
 - `script/fmt` — format the Go sources (writes)
 - `script/fmt-check` — check Go formatting (read-only)
 - `script/run` — build and run the server locally

backend/internal/middleware/middleware_test.go

@@ -343,7 +343,7 @@ func TestLoggingCutsRequestStringsToBound(t *testing.T) {
 		http.MethodGet, "/"+long, http.NoBody)
 	req.Header.Set("User-Agent", long)
 	req.Header.Set("Referer", long)
-	req.Header.Set("X-Request-Id", long)
+	req.Header.Set("X-Request-ID", long)
 
 	handler.ServeHTTP(httptest.NewRecorder(), req)
 

backend/script/lint

@@ -1,50 +1,13 @@
 #!/bin/sh
-# script/lint: run golangci-lint over the backend. This runs inside the
-# lint stage of the root Dockerfile, whose digest-pinned golangci-lint
-# image provides the linter; nothing installs golangci-lint on the host.
-# From a checkout, run `make lint` at the repo root, which builds that
-# stage.
-#
-# .golangci.yml is standardized org-wide and must never be edited here
-# (REPO_POLICIES.md). Its last silent drift replaced the v2 schema with
-# v1 keys, which left every threshold in the file inert while the build
-# stayed green. So the file is first checked against the canonical
-# copy's sha256: a local comparison, no network, nothing unpinned.
+# script/lint: lint the whole repo as the root make lint does, by
+# building the lint phase of the root Dockerfile. golangci-lint never
+# runs on the host (REPO_POLICIES.md).
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# The sha256 of the org standard .golangci.yml. When that file changes in
-# sneak/prompts and is copied here again, this changes with it.
-GOLANGCI_CONFIG_SHA256="a79b63a254602a5318db5d0e9a06bc71b84bf0c1d896305229d8bfed1d1b1776"
+ROOT="$(cd "$(dirname "$0")/../.." && pwd -P)"
 
 main() {
-    cd "$ROOT"
-    if [ ! -f .golangci.yml ]; then
-        echo "backend/.golangci.yml is missing. Copy the org standard verbatim" >&2
-        echo "from https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml" >&2
-        exit 1
-    fi
-    actual="$(sha256sum .golangci.yml | cut -d' ' -f1)"
-    if [ -z "$actual" ]; then
-        echo "sha256sum is missing or printed no hash, so" >&2
-        echo "backend/.golangci.yml could not be checked." >&2
-        exit 1
-    fi
-    if [ "$actual" != "$GOLANGCI_CONFIG_SHA256" ]; then
-        echo "backend/.golangci.yml does not match GOLANGCI_CONFIG_SHA256" >&2
-        echo "in backend/script/lint." >&2
-        echo "  expected $GOLANGCI_CONFIG_SHA256" >&2
-        echo "  actual   $actual" >&2
-        echo "Compare it with the org standard," >&2
-        echo "https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml" >&2
-        echo "- If they differ, it was edited here: restore the org standard" >&2
-        echo "  verbatim. Do not edit it." >&2
-        echo "- If they are the same, the org standard changed: set" >&2
-        echo "  GOLANGCI_CONFIG_SHA256 in backend/script/lint to the actual hash." >&2
-        exit 1
-    fi
-    golangci-lint run ./...
+    exec "$ROOT/script/lint"
 }
 
 main "$@"

backend/script/test

@@ -1,18 +1,21 @@
 #!/bin/sh
-# script/test: run the backend test suite with the race detector and
-# coverage. Go's own -timeout bounds the tests and not their compile,
-# so a cold build cache cannot fail it. The race detector needs cgo,
-# and so a C compiler. If the tests fail, they run again with -v for
-# the details, and the script fails even if that run passes.
+# script/test: run the backend test suite on the host with the race
+# detector and coverage. The root make test runs the same in the test
+# phase of the root Dockerfile. Go's own -timeout bounds the tests and
+# not their compile, so a cold build cache cannot fail it. -count=1
+# keeps Go's test result cache out of both runs, so neither can report
+# a stored pass. The race detector needs cgo, and so a C compiler. If
+# the tests fail, they run again with -v for the details, and the
+# script fails even if that run passes.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    go test -timeout 30s -race -cover ./... || {
+    go test -count=1 -timeout 90s -race -cover ./... || {
         echo "--- Rerunning with -v for details ---"
-        go test -timeout 30s -race -v ./...
+        go test -count=1 -timeout 90s -race -v ./...
         exit 1
     }
 }