sneak
8dc46af6b7
check / check (push) Successful in 2m36s
golangci-lint now runs only inside a container, never on the host. script/lint builds a hash-pinned root Dockerfile.lint; the nix-shell and host golangci-lint paths are gone. A per-run CACHEBUST build-arg is folded into the lint step's cache key, so the linter re-executes on every run and an unchanged tree cannot return a cached success having linted nothing; script/lint fails a build that did not run the linter. Dockerfile's lint stage runs golangci-lint directly, since make lint now builds a container and there is no Docker inside a build. It is the same image and config. golangci-lint config verify is left out: it fetches its schema over an unpinned live HTTPS call, which REPO_POLICIES.md forbids. Model: opus-4-8