sneak/prompts#78: sneak/prompts has changed the canonical files this repository vendors. Re-vendor them once, from sneak/prompts commit dd4027b (dd4027b907), fetching each file from https://git.eeqj.de/sneak/prompts/raw/commit/dd4027b907ef99cdc3187c215cc4d610b7a11efc/<path>.
Files this repository vendors now: .dockerignore .editorconfig .gitea/workflows/check.yml .gitignore .golangci.yml .prettierignore .prettierrc REPO_POLICIES.md. REPO_POLICIES.md comes from prompts/REPO_POLICIES.md at that commit: the root REPO_POLICIES.md there is a symlink, and its raw URL returns only the link's target path. That repository's own .gitattributes and TODO.md are not canonical.
What changed that matters here:
golangci-lint is v2.14.0 (golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f). The lint phase digest and .golangci.yml change in one commit, since v2.12.2 rejects the new file; the go directive may name at most Go 1.27.
The Go Dockerfile example: the test phase uses the Debian Go image so -race works; the stage that compiles installs git, trusts /src with git config --system --add safe.directory /src, and fails when .git is present but no version comes out.
Host Go tools are installed with go install pinned to a commit, never as go.mod tool dependencies.
The image version comes from git describe inside the build: .dockerignore sends .git without its own or any submodule's config. CHECK_EPOCH is gone; every docker build in script/ passes --no-cache.
.gitignore and .dockerignore keep out more secret files, hardware-backed SSH keys included.
Agent guidance lives in one root AGENTS.md; a committed file or directory named for one agent tool has its content moved there and is deleted.
Definition of done
Every vendored canonical file is its copy at that commit, fetched rather than hand-edited, plus only the entries item 3 keeps. A canonical file the policies require and this repository lacks is added the same way.
Dockerfile, Makefile and script/ follow REPO_POLICIES.md as of that commit, including the gate phases and the version step.
This repository's own entries are carried forward: the deny entries of the test-support depguard rule in .golangci.yml, anchored host-built artifacts in .dockerignore, and its language's entries in .gitignore and .editorconfig, kept after the canonical content. .gitignore is a base each repository extends for its language: a Go repository keeps at least *.log, *.out, *.test and its binaries (prompts/CODE_STYLEGUIDE_GO.md), and its .editorconfig keeps tabs for *.go. (Corrected 2026-10-06: the first version of this item dropped those entries.)
Findings the new files raise are fixed in the code in the same PR; no vendored file is loosened.
make lint runs with no deprecation warnings, and make check passes.
One reviewed PR against next. Closing this issue ticks this repository on sneak/prompts#78.
Model: opus-5-5
https://git.eeqj.de/sneak/prompts/issues/78: `sneak/prompts` has changed the canonical files this repository vendors. Re-vendor them once, from `sneak/prompts` commit `dd4027b` (https://git.eeqj.de/sneak/prompts/commit/dd4027b907ef99cdc3187c215cc4d610b7a11efc), fetching each file from `https://git.eeqj.de/sneak/prompts/raw/commit/dd4027b907ef99cdc3187c215cc4d610b7a11efc/<path>`.
Files this repository vendors now: `.dockerignore .editorconfig .gitea/workflows/check.yml .gitignore .golangci.yml .prettierignore .prettierrc REPO_POLICIES.md`. `REPO_POLICIES.md` comes from `prompts/REPO_POLICIES.md` at that commit: the root `REPO_POLICIES.md` there is a symlink, and its raw URL returns only the link's target path. That repository's own `.gitattributes` and `TODO.md` are not canonical.
What changed that matters here:
- golangci-lint is v2.14.0 (`golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f`). The lint phase digest and `.golangci.yml` change in one commit, since v2.12.2 rejects the new file; the `go` directive may name at most Go 1.27.
- The Go `Dockerfile` example: the test phase uses the Debian Go image so `-race` works; the stage that compiles installs `git`, trusts `/src` with `git config --system --add safe.directory /src`, and fails when `.git` is present but no version comes out.
- Host Go tools are installed with `go install` pinned to a commit, never as `go.mod` tool dependencies.
- The image version comes from `git describe` inside the build: `.dockerignore` sends `.git` without its own or any submodule's `config`. `CHECK_EPOCH` is gone; every `docker build` in `script/` passes `--no-cache`.
- `.gitignore` and `.dockerignore` keep out more secret files, hardware-backed SSH keys included.
- Agent guidance lives in one root `AGENTS.md`; a committed file or directory named for one agent tool has its content moved there and is deleted.
## Definition of done
1. Every vendored canonical file is its copy at that commit, fetched rather than hand-edited, plus only the entries item 3 keeps. A canonical file the policies require and this repository lacks is added the same way.
2. `Dockerfile`, `Makefile` and `script/` follow `REPO_POLICIES.md` as of that commit, including the gate phases and the version step.
3. This repository's own entries are carried forward: the `deny` entries of the `test-support` depguard rule in `.golangci.yml`, anchored host-built artifacts in `.dockerignore`, and its language's entries in `.gitignore` and `.editorconfig`, kept after the canonical content. `.gitignore` is a base each repository extends for its language: a Go repository keeps at least `*.log`, `*.out`, `*.test` and its binaries (`prompts/CODE_STYLEGUIDE_GO.md`), and its `.editorconfig` keeps tabs for `*.go`. (Corrected 2026-10-06: the first version of this item dropped those entries.)
4. Findings the new files raise are fixed in the code in the same PR; no vendored file is loosened.
5. `make lint` runs with no deprecation warnings, and `make check` passes.
6. One reviewed PR against `next`. Closing this issue ticks this repository on https://git.eeqj.de/sneak/prompts/issues/78.
Model: opus-5-5
clawbot
self-assigned this 2026-10-06 01:30:05 +02:00
Plan: re-vendor from sneak/prompts commit e3f79c4 (e3f79c49da), the head of its next, in place of dd4027b. It holds everything listed above plus the ruling on sneak/prompts#113 that Go's compile cache may survive between check builds (sneak/prompts#129):
script/lint, script/test, script/cibuild and script/docker pass a new CACHEBUST build argument on every run in place of --no-cache, and every Dockerfile stage declares ARG CACHEBUST first, in the same commit.
The steps that compile mount Go's build cache only; both go test runs carry -count=1.
The definition of done above stands, with the commit changed. If make test still takes over 60 seconds on a second run with the cache kept, that goes back to sneak on sneak/prompts#113.
Model: opus-5-5
Plan: re-vendor from `sneak/prompts` commit `e3f79c4` (https://git.eeqj.de/sneak/prompts/commit/e3f79c49daf7cc5b29134427db4ae7298a4a63c0), the head of its `next`, in place of `dd4027b`. It holds everything listed above plus the ruling on https://git.eeqj.de/sneak/prompts/issues/113 that Go's compile cache may survive between check builds (https://git.eeqj.de/sneak/prompts/pulls/129):
- `script/lint`, `script/test`, `script/cibuild` and `script/docker` pass a new `CACHEBUST` build argument on every run in place of `--no-cache`, and every `Dockerfile` stage declares `ARG CACHEBUST` first, in the same commit.
- The steps that compile mount Go's build cache only; both `go test` runs carry `-count=1`.
The definition of done above stands, with the commit changed. If `make test` still takes over 60 seconds on a second run with the cache kept, that goes back to sneak on https://git.eeqj.de/sneak/prompts/issues/113.
Model: opus-5-5
Built as planned above in #276. Where it departs from the definition of done is listed in its body: the workflow keeps script/docker-smoke while #203 is open, and .dockerignore keeps the local config file patterns.
Model: opus-5-5
Built as planned above in https://git.eeqj.de/sneak/pixa/pulls/276. Where it departs from the definition of done is listed in its body: the workflow keeps `script/docker-smoke` while https://git.eeqj.de/sneak/pixa/issues/203 is open, and `.dockerignore` keeps the local config file patterns.
Model: opus-5-5
Reopened: sneak/prompts has changed the files this repository vendors again, on sneak's ruling at sneak/prompts#130 (comment). Re-vendor from sneak/prompts commit 0653579 (065357920a, from sneak/prompts#131), on top of e3f79c4, vendored in #276.
What changes here:
REPO_POLICIES.md and script/lint, script/test, script/cibuild, script/docker: their copies at that commit.
Dockerfile: in each stage, the step that installs system packages (libvips-dev and the rest) and the module download (WORKDIR /src, COPY go.mod go.sum ./, RUN go mod download) move above ARG CACHEBUST; every step that lints, tests or compiles stays below it. golangci-lint run also mounts /root/.cache/golangci-lint. Docker then keeps the packages and modules until the base image, the install line, go.mod or go.sum change.
Done when: the definition of done above holds with the commit changed to 0653579; with every cache warm, a planted lint finding and a planted failing test each still fail the next check build; one reviewed PR against next. If make test still takes over 60 seconds on a second run, that goes back to sneak on sneak/prompts#113.
Model: opus-5-5
Reopened: `sneak/prompts` has changed the files this repository vendors again, on sneak's ruling at https://git.eeqj.de/sneak/prompts/issues/130#issuecomment-144933. Re-vendor from `sneak/prompts` commit `0653579` (https://git.eeqj.de/sneak/prompts/commit/065357920a0a09bd736bf33d4cb5ce935fdc2328, from https://git.eeqj.de/sneak/prompts/pulls/131), on top of `e3f79c4`, vendored in https://git.eeqj.de/sneak/pixa/pulls/276.
What changes here:
- `REPO_POLICIES.md` and `script/lint`, `script/test`, `script/cibuild`, `script/docker`: their copies at that commit.
- `Dockerfile`: in each stage, the step that installs system packages (`libvips-dev` and the rest) and the module download (`WORKDIR /src`, `COPY go.mod go.sum ./`, `RUN go mod download`) move above `ARG CACHEBUST`; every step that lints, tests or compiles stays below it. `golangci-lint run` also mounts `/root/.cache/golangci-lint`. Docker then keeps the packages and modules until the base image, the install line, `go.mod` or `go.sum` change.
**Done when:** the definition of done above holds with the commit changed to `0653579`; with every cache warm, a planted lint finding and a planted failing test each still fail the next check build; one reviewed PR against `next`. If `make test` still takes over 60 seconds on a second run, that goes back to sneak on https://git.eeqj.de/sneak/prompts/issues/113.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
sneak/prompts#78:
sneak/promptshas changed the canonical files this repository vendors. Re-vendor them once, fromsneak/promptscommitdd4027b(dd4027b907), fetching each file fromhttps://git.eeqj.de/sneak/prompts/raw/commit/dd4027b907ef99cdc3187c215cc4d610b7a11efc/<path>.Files this repository vendors now:
.dockerignore .editorconfig .gitea/workflows/check.yml .gitignore .golangci.yml .prettierignore .prettierrc REPO_POLICIES.md.REPO_POLICIES.mdcomes fromprompts/REPO_POLICIES.mdat that commit: the rootREPO_POLICIES.mdthere is a symlink, and its raw URL returns only the link's target path. That repository's own.gitattributesandTODO.mdare not canonical.What changed that matters here:
golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f). The lint phase digest and.golangci.ymlchange in one commit, since v2.12.2 rejects the new file; thegodirective may name at most Go 1.27.Dockerfileexample: the test phase uses the Debian Go image so-raceworks; the stage that compiles installsgit, trusts/srcwithgit config --system --add safe.directory /src, and fails when.gitis present but no version comes out.go installpinned to a commit, never asgo.modtool dependencies.git describeinside the build:.dockerignoresends.gitwithout its own or any submodule'sconfig.CHECK_EPOCHis gone; everydocker buildinscript/passes--no-cache..gitignoreand.dockerignorekeep out more secret files, hardware-backed SSH keys included.AGENTS.md; a committed file or directory named for one agent tool has its content moved there and is deleted.Definition of done
Dockerfile,Makefileandscript/followREPO_POLICIES.mdas of that commit, including the gate phases and the version step.denyentries of thetest-supportdepguard rule in.golangci.yml, anchored host-built artifacts in.dockerignore, and its language's entries in.gitignoreand.editorconfig, kept after the canonical content..gitignoreis a base each repository extends for its language: a Go repository keeps at least*.log,*.out,*.testand its binaries (prompts/CODE_STYLEGUIDE_GO.md), and its.editorconfigkeeps tabs for*.go. (Corrected 2026-10-06: the first version of this item dropped those entries.)make lintruns with no deprecation warnings, andmake checkpasses.next. Closing this issue ticks this repository on sneak/prompts#78.Model: opus-5-5
Plan: re-vendor from
sneak/promptscommite3f79c4(e3f79c49da), the head of itsnext, in place ofdd4027b. It holds everything listed above plus the ruling on sneak/prompts#113 that Go's compile cache may survive between check builds (sneak/prompts#129):script/lint,script/test,script/cibuildandscript/dockerpass a newCACHEBUSTbuild argument on every run in place of--no-cache, and everyDockerfilestage declaresARG CACHEBUSTfirst, in the same commit.go testruns carry-count=1.The definition of done above stands, with the commit changed. If
make teststill takes over 60 seconds on a second run with the cache kept, that goes back to sneak on sneak/prompts#113.Model: opus-5-5
Built as planned above in #276. Where it departs from the definition of done is listed in its body: the workflow keeps
script/docker-smokewhile #203 is open, and.dockerignorekeeps the local config file patterns.Model: opus-5-5
Reopened:
sneak/promptshas changed the files this repository vendors again, on sneak's ruling at sneak/prompts#130 (comment). Re-vendor fromsneak/promptscommit0653579(065357920a, from sneak/prompts#131), on top ofe3f79c4, vendored in #276.What changes here:
REPO_POLICIES.mdandscript/lint,script/test,script/cibuild,script/docker: their copies at that commit.Dockerfile: in each stage, the step that installs system packages (libvips-devand the rest) and the module download (WORKDIR /src,COPY go.mod go.sum ./,RUN go mod download) move aboveARG CACHEBUST; every step that lints, tests or compiles stays below it.golangci-lint runalso mounts/root/.cache/golangci-lint. Docker then keeps the packages and modules until the base image, the install line,go.modorgo.sumchange.Done when: the definition of done above holds with the commit changed to
0653579; with every cache warm, a planted lint finding and a planted failing test each still fail the next check build; one reviewed PR againstnext. Ifmake teststill takes over 60 seconds on a second run, that goes back to sneak on sneak/prompts#113.Model: opus-5-5
clawbot referenced this issue2026-10-19 06:12:53 +02:00