next into main #73

Merged

sneak merged 4 commits from next into main 2026-09-29 12:04:31 +02:00

Conversation 0 Commits 4 Files Changed 10

+178 -45

4 Commits

Author	SHA1	Message	Date
sneak	7dfb3b8c32	Merge branch 'main' into next	2026-09-29 12:04:10 +02:00
clawbot	a5ca73c585	Container sets up its own data directory (closes #75) (#76) ... Closes #75. `bin/entrypoint.sh`, which already runs as root, now makes the data directory usable before the backend starts: it creates `DATA_DIR` if missing, gives it and `/data` to the `netwatch` user (`chown -R`), and sets mode 750 on both, the mode the backend gives a directory it creates. The backend still runs as `netwatch`. The README "Running under upaas" section loses its first-run step that created and chowned the host directory and names only the path to mount. The Dockerfile's build-time `mkdir` and `chown` of `/data` are gone, since the entrypoint now does this on every start. What the diff does not show: - The host directory mounted at `/data` ends up owned by uid 1000 with mode 750, and everything under `DATA_DIR` is chowned to uid 1000 on every start. - If the directory cannot be created or chowned, the container stops with that tool's error before either process starts. Recorded runs with `--mount type=bind`: an empty directory owned by root (mode 755, and again mode 700), and one holding a `reports` directory and report file owned by uid 1001 with mode 700. Each time the container turned healthy, `netwatch-server` ran as `netwatch`, and a posted report was written to `DATA_DIR`; a second start on the root-owned and the uid 1001 directories did the same. Judgement call: `/data` itself is given to `netwatch` as well as `DATA_DIR`, so the backend can reach `DATA_DIR` inside a host directory with mode 700. Model: opus-5-5 Reviewed-on: #76 Co-authored-by: clawbot <35+clawbot@noreply.example.org>	2026-09-29 12:03:59 +02:00
clawbot	f423768975	cibuild: the org model, which runs every check uncached (closes #37) ... script/cibuild was a plain docker build ., so on a tree Docker had seen before every check step came from the build cache and the build still passed. It is now the org model from sneak/prompts, byte for byte: script/bootstrap, script/check, then docker build --no-cache with the git describe version as the VERSION build argument. The workflow puts ~/.local/bin, where bootstrap links what it installs, on the step's PATH. Bootstrap now installs its pinned node when the installed one is older than 22.12.0, the oldest the frontend's dependencies accept (puppeteer-core's engines field), as it already does for Go against backend/go.mod. Model: opus-5-5	2026-09-29 11:55:52 +02:00
clawbot	c226ceee01	chore(backend): re-vendor .golangci.yml with gomodguard_v2 (closes #41) ... golangci-lint v2.12 deprecates gomodguard, which the org .golangci.yml reached through "default: all", so every lint run printed a deprecation warning. backend/.golangci.yml is now the current copy from sneak/prompts, fetched unedited: gomodguard is disabled and gomodguard_v2 enabled with the org block list. The new file also turns depguard on with its test-support rule, which forbids net/http/httptest outside test code. netwatch has no test-support packages of its own to add to that rule, so the file is identical to the canonical one. backend/script/lint checks the new sha256. The backend raises no findings under the new rules. Model: opus-5-5	2026-09-29 10:56:00 +02:00