clawbot
9e4d3fdb54
check / check (push) Successful in 2m0s
backend/script/lint compared .golangci.yml with its pinned sha256 and, on any failure, said to restore the file from sneak/prompts. Once the org standard has legitimately changed, that advice loops: the copied file is right and GOLANGCI_CONFIG_SHA256 is stale. On a mismatch the script now says to compare the file with the org standard, restore it if they differ, and update GOLANGCI_CONFIG_SHA256 if they are the same; it still prints both hashes. A missing .golangci.yml, and a sha256sum that is missing or prints no hash, get their own messages instead of being reported as a mismatch. Each failure still exits 1. .golangci.yml is unchanged. Model: opus-5-5
51 lines
2.1 KiB
Bash
Executable File
51 lines
2.1 KiB
Bash
Executable File
#!/bin/sh
|
|
# script/lint: run golangci-lint over the backend. This runs inside the
|
|
# lint stage of the root Dockerfile, whose digest-pinned golangci-lint
|
|
# image provides the linter; nothing installs golangci-lint on the host.
|
|
# From a checkout, run `make lint` at the repo root, which builds that
|
|
# stage.
|
|
#
|
|
# .golangci.yml is standardized org-wide and must never be edited here
|
|
# (REPO_POLICIES.md). Its last silent drift replaced the v2 schema with
|
|
# v1 keys, which left every threshold in the file inert while the build
|
|
# stayed green. So the file is first checked against the canonical
|
|
# copy's sha256: a local comparison, no network, nothing unpinned.
|
|
set -eu
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
|
|
|
# The sha256 of the org standard .golangci.yml. When that file changes in
|
|
# sneak/prompts and is copied here again, this changes with it.
|
|
GOLANGCI_CONFIG_SHA256="a79b63a254602a5318db5d0e9a06bc71b84bf0c1d896305229d8bfed1d1b1776"
|
|
|
|
main() {
|
|
cd "$ROOT"
|
|
if [ ! -f .golangci.yml ]; then
|
|
echo "backend/.golangci.yml is missing. Copy the org standard verbatim" >&2
|
|
echo "from https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml" >&2
|
|
exit 1
|
|
fi
|
|
actual="$(sha256sum .golangci.yml | cut -d' ' -f1)"
|
|
if [ -z "$actual" ]; then
|
|
echo "sha256sum is missing or printed no hash, so" >&2
|
|
echo "backend/.golangci.yml could not be checked." >&2
|
|
exit 1
|
|
fi
|
|
if [ "$actual" != "$GOLANGCI_CONFIG_SHA256" ]; then
|
|
echo "backend/.golangci.yml does not match GOLANGCI_CONFIG_SHA256" >&2
|
|
echo "in backend/script/lint." >&2
|
|
echo " expected $GOLANGCI_CONFIG_SHA256" >&2
|
|
echo " actual $actual" >&2
|
|
echo "Compare it with the org standard," >&2
|
|
echo "https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml" >&2
|
|
echo "- If they differ, it was edited here: restore the org standard" >&2
|
|
echo " verbatim. Do not edit it." >&2
|
|
echo "- If they are the same, the org standard changed: set" >&2
|
|
echo " GOLANGCI_CONFIG_SHA256 in backend/script/lint to the actual hash." >&2
|
|
exit 1
|
|
fi
|
|
golangci-lint run ./...
|
|
}
|
|
|
|
main "$@"
|