Add hash-pinned Dockerfile.lint and make script/lint Docker-only #107

New Issue

2026-09-04T00:02:04+02:00

clawbot commented

2026-09-04 00:02:04 +02:00

Sub-issue 1 of 2, split out of issue #104 because #104 as written could not be completed inside a single agent run. This is the mechanical half; the verification half is tracked separately.

Owner ruling (sneak, 2026-08-09): every lint run happens inside a Docker container, invoked through the script/ entrypoint. Reference implementation is sneak/homoicon — copy its shape.

Current state (`next`)

script/lint runs golangci-lint run on the host, falling back to nix-shell -p pkg-config vips libheif golangci-lint git --run. That host path is what allowed a lint run in this repo to report findings whose paths pointed into a different agent's worktree. There is no Dockerfile.lint at the repo root today.

Definition of done

Root Dockerfile.lint, FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240, which COPYs the repo in and runs golangci-lint run --config .golangci.yml ./... as a build step — a successful build IS a clean lint.
script/lint reduced to building that image. No host golangci-lint invocation and no nix-shell lint path remains anywhere.
make lint and make check still green.

Out of scope

Proving the gate actually executes the linter (layer-cache defeat, negative control) — that is sub-issue 2. Do not close #104 from this PR.

Constraints

The image reference MUST stay hash-pinned. An unpinned image is an automatic fail per REPO_POLICIES.md.
Base branch is next, not main.

Sub-issue 1 of 2, split out of [issue #104](https://git.eeqj.de/sneak/pixa/issues/104) because #104 as written could not be completed inside a single agent run. This is the mechanical half; the verification half is tracked separately. Owner ruling (sneak, 2026-08-09): every lint run happens inside a Docker container, invoked through the `script/` entrypoint. Reference implementation is `sneak/homoicon` — copy its shape. ## Current state (`next`) `script/lint` runs `golangci-lint run` on the host, falling back to `nix-shell -p pkg-config vips libheif golangci-lint git --run`. That host path is what allowed a lint run in this repo to report findings whose paths pointed into a *different agent's worktree*. There is no `Dockerfile.lint` at the repo root today. ## Definition of done 1. Root `Dockerfile.lint`, `FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240`, which COPYs the repo in and runs `golangci-lint run --config .golangci.yml ./...` **as a build step** — a successful build IS a clean lint. 2. `script/lint` reduced to building that image. No host `golangci-lint` invocation and no nix-shell lint path remains anywhere. 3. `make lint` and `make check` still green. ## Out of scope Proving the gate actually executes the linter (layer-cache defeat, negative control) — that is sub-issue 2. Do not close #104 from this PR. ## Constraints - The image reference MUST stay hash-pinned. An unpinned image is an automatic fail per REPO_POLICIES.md. - Base branch is `next`, not `main`.

clawbot added this to the 1.0.0 milestone 2026-09-04 00:02:04 +02:00

clawbot referenced this issue

2026-09-04 00:02:29 +02:00

Prove the Docker lint gate actually lints: defeat layer cache + negative control #108

clawbot referenced this issue

2026-09-04 00:02:31 +02:00

Run all linting in Docker via Dockerfile.lint + script/lint #104

clawbot commented

2026-09-05 11:32:53 +02:00

Closed at sneak's instruction, 2026-09-05: this was opened by an agent running on another machine outside the managed fleet, under superseded rules. Reopen if the content is wanted.

Model: fable-5-1

Closed at sneak's instruction, 2026-09-05: this was opened by an agent running on another machine outside the managed fleet, under superseded rules. Reopen if the content is wanted. Model: fable-5-1

clawbot closed this issue

2026-09-05 11:32:53 +02:00

clawbot referenced this issue

2026-09-21 09:27:26 +02:00

Run all linting in Docker via Dockerfile.lint + script/lint #104

Sign in to join this conversation.