Run all linting in Docker via Dockerfile.lint + script/lint #47

New Issue

clawbot · 2026-08-10T13:15:09+02:00

clawbot commented

2026-08-10 13:15:09 +02:00

Owner ruling, sneak 2026-08-09: every lint run happens inside a Docker container, invoked through the script/ entrypoint. Docker is always available. Linting runs independently and does not need a cache. He has directed a PR for every repo not already set up this way.

Reference implementation is sneak/homoicon — copy its shape: a root Dockerfile.lint built FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240, which COPYs the repo in and runs golangci-lint run --config .golangci.yml ./... as a build step, with script/lint reduced to building it. Linting as a build step means a successful build IS a clean lint.

This repo is polyglot, so the ruling covers the frontend linter too — the same containerised pattern around whatever lints the SPA, not only the Go side. Sequence it against the in-flight gate work rather than conflicting with it.

Two things to get right, both of which would otherwise ship a false green:

A cached build lints nothing. A lint build on an unchanged tree returns success in well under a second having run no linter. Caching is explicitly waived here, so force the lint layers to execute.
golangci-lint config verify fetches its JSON schema over an unpinned live HTTPS call — this repo already identified that hazard. Decide deliberately whether to include it.

Also remove golangci-lint installation from script/bootstrap — nothing runs on the host any more.

Definition of done

script/lint runs every linter only in Docker; no host path remains.
Two consecutive script/lint runs on an unchanged tree both demonstrably execute the linters.
Negative control: introduce a deliberate lint violation, confirm it fails with that specific finding, revert, confirm clean.
make check still green.

Canonical tracking issue: sneak/prompts#40

Owner ruling, sneak 2026-08-09: every lint run happens inside a Docker container, invoked through the `script/` entrypoint. Docker is always available. Linting runs independently and does not need a cache. He has directed a PR for every repo not already set up this way. Reference implementation is `sneak/homoicon` — copy its shape: a root `Dockerfile.lint` built `FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240`, which COPYs the repo in and runs `golangci-lint run --config .golangci.yml ./...` as a build step, with `script/lint` reduced to building it. Linting as a build step means a successful build IS a clean lint. This repo is polyglot, so the ruling covers the frontend linter too — the same containerised pattern around whatever lints the SPA, not only the Go side. Sequence it against the in-flight gate work rather than conflicting with it. Two things to get right, both of which would otherwise ship a false green: 1. **A cached build lints nothing.** A lint build on an unchanged tree returns success in well under a second having run no linter. Caching is explicitly waived here, so force the lint layers to execute. 2. **`golangci-lint config verify` fetches its JSON schema over an unpinned live HTTPS call** — this repo already identified that hazard. Decide deliberately whether to include it. Also remove golangci-lint installation from `script/bootstrap` — nothing runs on the host any more. ## Definition of done - `script/lint` runs every linter only in Docker; no host path remains. - Two consecutive `script/lint` runs on an unchanged tree both demonstrably execute the linters. - Negative control: introduce a deliberate lint violation, confirm it fails with that specific finding, revert, confirm clean. - `make check` still green. Canonical tracking issue: https://git.eeqj.de/sneak/prompts/issues/40

clawbot referenced this issue

2026-08-10 14:30:34 +02:00

TOP PRIORITY: consolidate all open PRs onto one next branch, one PR #48

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/netwatch#47