sneak/pixa
1
0
Fork 0
Code Issues 13 Pull Requests 5 Actions 20 Packages Projects Releases Wiki Activity

Re-vendor the canonical files from sneak/prompts at e3f79c4 (closes #221)

Browse Source 
The vendored dotfiles, REPO_POLICIES.md and the standard scripts are
fetched from sneak/prompts commit e3f79c4, with pixa's own entries kept
after the standard part. The scripts pass a new CACHEBUST build argument
in place of --no-cache and every Dockerfile stage declares it first, so
every RUN step reruns while Go's build cache, mounted on the steps that
compile, is kept. The lint phase runs golangci-lint v2.14.0, the test
phase runs on the Debian Go image, and the build stage takes the version
as the policy gives it. The two new lint findings are fixed in the code.

Model: opus-5-5
This commit is contained in:
sneak
2026-10-15 19:48:05 +00:00
parent 16f9d1dfd1
commit e555bba5b9
19 changed files with 516 additions and 222 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TODO.md
+20 -1
View File
@@ -18,7 +18,7 @@
pre-1.0. No git tags exist. The `1.0.0` milestone is in progress; work lands on
`next`, and `main` receives only the milestone PR that the owner merges. `next`
is at the canonical `golangci-lint` v2.12.2 config and is green. Recent work
is at the canonical `golangci-lint` v2.14.0 config and is green. Recent work
extracted the internal/magic, internal/allowlist, internal/httpfetcher, and
internal/signature packages. The gosec findings from the 2026-07-06 survey are
resolved. The disk cache is now size-bounded with LRU eviction
@@ -56,6 +56,25 @@ P2: security: per-origin rate limiting
the cookie, as anyone can take a CSRF token from the login page. A logout that
cannot be saved answers 500. `session.NewManager`, which the tests use, keeps
the value in memory only; pixad uses `session.NewManagerWithDatabase`.
- 2026-10-15 the canonical files are re-vendored from `sneak/prompts` commit
`e3f79c4` (closes #221): `.dockerignore`, `.editorconfig`,
`.gitea/workflows/check.yml`, `.gitignore`, `.golangci.yml`,
`.prettierignore`, `.prettierrc`, `REPO_POLICIES.md` and the standard scripts
are its copies. pixa's own entries follow the standard part: `/bin`, `/data`
and the local config files in `.dockerignore`; Go's `*.log`, `*.out` and
`*.test`, `vendor/`, the binaries, `/data/`, `*.sqlite3` and the local config
files in `.gitignore`. The workflow keeps its `script/docker-smoke` step while
https://git.eeqj.de/sneak/pixa/issues/203 is open. The scripts pass a new
`CACHEBUST` build argument in place of `--no-cache`, and every `Dockerfile`
stage declares it first, so every `RUN` step still runs on every build while
Go's build cache, mounted on the steps that compile, is kept; both `go test`
runs keep `-count=1`. The lint and test builds write no image. The lint phase
runs golangci-lint v2.14.0, the test phase runs on the Debian Go image, and
the build stage marks `/src` safe for git. `script/bootstrap`, `script/fmt`
and `script/fmt-check` use the node on the `PATH` only when it has the pinned
major version. Of golangci-lint v2.14.0's two findings, an unused `nolint`
directive is removed, and gosec's new path check is marked as not applying to
the fixed config file locations.
- 2026-10-15 a cached file left empty or partial is no longer served, or fetched
again on every request (closes #252). Source and transformed image files, and
each transformed image's `.meta` file, are synced to disk before they are