2026-04-26 - 2026-10-26
Overview
43 Pull requests merged by 2 users
Merged
#132 Allow homoicon's local copy of sobek in the canonical .golangci.yml
Merged
#131 Keep modules, lint cache and system packages in check builds (closes #130)
Merged
#129 Keep Go's build cache in check builds (closes #113)
Merged
#127 Install the pinned node when the installed one is another major version (closes #118)
Merged
#126 Tag the image build in the checklist's script/cibuild item (closes #125)
Merged
#124 Stop the lint and test builds writing an image (closes #123)
Merged
#121 Set a time limit on the canonical check job (closes #120)
Merged
#122 Make the canonical package.json private instead of declaring MIT (closes #119)
Merged
#117 Fetch history and tags in the canonical workflow (closes #110)
Merged
#116 Refresh apt package lists once in script/bootstrap (closes #115)
Merged
#114 Say that a build from a linked worktree needs the version passed in (closes #111)
Merged
#109 Cancel replaced CI runs and drop the checkout token (closes #107)
Merged
#108 Disable canonicalheader in the canonical .golangci.yml (closes #105)
Merged
#106 Say where a repository's own .gitignore and .editorconfig entries go (closes #103)
Merged
#102 Assign the image tag on its own line in script/ (closes #101)
Merged
#99 Fold the August fleet findings into the policies, or drop them (closes #62)
Merged
#97 Say which Dockerfile stages run script/bootstrap (closes #90)
Merged
#100 Merge TODO.md with git's union merge (closes #98)
Merged
#96 Keep a submodule's own .git/config out of the build context (closes #88)
Merged
#95 Install lint-phase libraries with apt-get, not apk (closes #83)
Merged
#94 Let fx own signals and the exit code in the server example (closes #86)
Merged
#91 Pin host Go tools by commit hash with go install (closes #37)
Merged
#93 Ignore hardware-backed SSH key files in the canonical ignore files (closes #81)
Merged
#92 Give package.json the MIT license field (closes #76)
Merged
#89 Keep agent guidance in one root AGENTS.md (closes #31)
Merged
#87 Rewrite the -count=1 note to match the current files (closes #77)
Merged
#84 Fall back to dev when git describe prints nothing (closes #74)
Merged
#85 Keep each submodule's git config out of the build context (closes #75)
Merged
#82 Fix git ownership and -race in the canonical Go Dockerfile (closes #73)
Merged
#79 Pin golangci-lint v2.14.0; disable exhaustruct_v5 (closes #65)
Merged
#80 Cover more secret shapes in the canonical .gitignore (closes #38)
Merged
#70 Derive the image version from git; send .git without its config (closes #69, closes #71)
Merged
#67 Read the architecture at run time, not via a Buildarch ldflag (closes #66)
Merged
#55 Migrate canonical .golangci.yml to gomodguard_v2, with a block list
Merged
#34 Milestone next: check-cache busting, build-context hygiene, lint in a container
Merged
#45 Add -count=1 to the canonical Go make test example
Merged
#59 Enable depguard so a non-test file cannot import test support
Merged
#49 Scope the .golangci.yml agent prohibition to vendored copies
Merged
#54 Require thin cmd/ entrypoints: all logic in internal/ or pkg/
Merged
#42 Raise org-wide make test cap to 60s, backstop timeout to 90s
Merged
#24 Set canonical .golangci.yml to the org-standard v2 config (golangci-lint v2.12.2)
Merged
#23 Adopt scripts-to-rule-them-all: script/ entrypoints, Makefile shims, policy update
Merged
#22 TODO
2 Pull requests proposed by 1 user
Proposed
#68 next → main: version from git, golangci-lint v2.14.0, Dockerfile and ignore-file fixes
Proposed
#135 Keep a Python test phase's lockfile install in check builds
57 Issues closed from 1 user
Closed
#134 Canonical .golangci.yml: accept homoicon's local replace of sobek
Closed
#130 May Go's module download cache survive between check builds too?
Closed
#113 DECISION: does the 60-second make test cap include building the test phase?
Closed
#118 yarn 1.22.22 prints deprecation warning DEP0169 under node 24 during yarn install
Closed
#125 The new-repository checklist gives script/cibuild an untagged image build
Closed
#123 The lint and test builds write an image nobody uses, costing about 16 seconds of the 60-second cap
Closed
#120 The canonical check workflow sets no time limit on its job
Closed
#119 Canonical package.json declares MIT in every repository that copies it
Closed
#110 The canonical workflow does not fetch tags, though the policy says a tag-derived version needs them
Closed
#115 Canonical script/bootstrap runs apt-get install without refreshing the package lists
Closed
#111 Say what a build from a linked worktree must do about the version
Closed
#107 Canonical workflow lacks a concurrency block and leaves the CI token in .git/config
Closed
#105 canonicalheader in the canonical .golangci.yml misses findings at random
Closed
#112 Go build cache mounts in the canonical Go Dockerfile, with -count=1 in its test phase
Closed
#101 script/ files pass the image tag through an inline command substitution, against their own rule
Closed
#103 Canonical .gitignore has no place for a repository's own build outputs
Closed
#104 Say that a re-vendor keeps a repository's own .gitignore and .editorconfig entries
Closed
#62 Fold the August fleet findings into the policies, or drop them
Closed
#90 REPO_POLICIES.md says Dockerfiles run script/bootstrap, but the canonical Go Dockerfile never does
Closed
#98 Every merge to next makes the other open PRs conflict in TODO.md
Closed
#88 Canonical .dockerignore: a submodule named config loses its git directory, and a submodule's own .git/config still ships
Closed
#83 Canonical Dockerfile note installs lint-phase libraries with apk, but the golangci-lint image is Debian
Closed
#86 Go HTTP server conventions: the lifecycle example drops the exit code, double-handles signals, and exits from a goroutine
Closed
#37 DECISION NEEDED: should pinned Go tools be go install-with-commit-pin, or tracked as go.mod tool dependencies?
Closed
#81 Canonical ignore files miss the SSH key files for hardware-backed keys
Closed
#76 make check prints the yarn warning "package.json: No license field"
Closed
#31 DECISION NEEDED: canonical REPO_POLICIES.md is missing the in-repo memory bullet that stale vendored copies still carry — retired, or lost?
Closed
#77 REPO_POLICIES.md still names CHECK_EPOCH, a mechanism that no longer exists
Closed
#74 Styleguide Makefile stamps an empty version outside a git checkout
Closed
#75 Canonical .dockerignore keeps out .git/config but not a submodule's config
Closed
#73 Canonical Go Dockerfile example: git refuses a checkout owned by another user, and -race cannot run on the alpine test image
Closed
#65 Canonical golangci-lint pin cannot lint Go 1.27 modules; its successors enable exhaustruct_v5, which the canonical config does not disable
Closed
#38 SECURITY: canonical .gitignore misses common secret shapes (*.env, .envrc, *.p12/*.pfx, extensionless SSH keys)
Closed
#60 PROPAGATION: roll the new canonical .golangci.yml bytes (gomodguard_v2 migration) into every consuming repository
Closed
#39 PROPAGATION: roll the Go tooling fixes (#28 bootstrap version enforcement, #30 lint cache/lock isolation) into every Go repo — as ONE commit per repo
Closed
#35 PROPAGATION: roll the Docker build-context trio (#26 CHECK_EPOCH, #29 .dockerignore secrets, #27 .claude/) into every consuming repo — as ONE commit per repo
Closed
#48 next still carries the pre-ruling 20s/30s test budget, so PR 34 will revert the org-wide ruling when it rebases
Closed
#44 Canonical Go make test example omits -count=1, shipping a false green to every repo
Closed
#71 Version stamp follow-up: keep .git/config out of the build context; a bare docker build must succeed
Closed
#69 Version stamp: the build derives the version from git; .git is no longer excluded
Closed
#66 Remove buildarch from the Go styleguide and HTTP server conventions: read the architecture at run time
Closed
#63 Run every build, test and lint step in the Dockerfiles at nice -n 19
Closed
#36 Operational consequence of CHECK_EPOCH: every check layer is unreusable by construction, so builder-cache growth is unbounded across the fleet
Closed
#33 DECISION NEEDED: canonical script/bootstrap pins NODE_VERSION and YARN_VERSION but policy tells it to skip on any version found — the pins are decorative
Closed
#46 Decision: vmsetup and secpol are tracked projects with no repo on the instance
Closed
#25 canonical .golangci.yml emits a gomodguard deprecation warning under golangci-lint v2.12+
Closed
#27 canonical .dockerignore omits .claude/, so agent worktrees land in the Docker build context
Closed
#28 script/bootstrap installs the pinned golangci-lint only if missing, so version pins are inert on any machine that already has the tool
Closed
#29 SECURITY: canonical .dockerignore does not exclude .env, *.pem or *.key, so local secrets ship into the Docker build context
Closed
#30 script/lint shares one golangci-lint cache across all concurrent sessions, producing cross-contaminated results
Closed
#26 script/cibuild reports a green it did not earn: Docker serves the make check layer from cache
Closed
#40 All linting must run in Docker: canonicalise homoicon's Dockerfile.lint + script/lint pattern
Closed
#57 PROPAGATION: roll the -count=1 Go test-cache fix (#44) into every consuming Go repo — as ONE commit per repo
Closed
#56 Dockerfile.lint has no .git, so gitignore-honouring linters walk a different file set than they do locally
Closed
#32 Go test cache is a second, independent source of unearned greens: canonical make test lacks -count=1
Closed
#52 REPO_POLICIES: carve out capability-URL services from "when in doubt, harden"
Closed
#41 Test-time cap: is 60s the new org-wide ceiling, or a dnswatcher divergence?
64 Issues created by 1 user
Opened
#25 canonical .golangci.yml emits a gomodguard deprecation warning under golangci-lint v2.12+
Opened
#26 script/cibuild reports a green it did not earn: Docker serves the make check layer from cache
Opened
#27 canonical .dockerignore omits .claude/, so agent worktrees land in the Docker build context
Opened
#28 script/bootstrap installs the pinned golangci-lint only if missing, so version pins are inert on any machine that already has the tool
Opened
#29 SECURITY: canonical .dockerignore does not exclude .env, *.pem or *.key, so local secrets ship into the Docker build context
Opened
#30 script/lint shares one golangci-lint cache across all concurrent sessions, producing cross-contaminated results
Opened
#31 DECISION NEEDED: canonical REPO_POLICIES.md is missing the in-repo memory bullet that stale vendored copies still carry — retired, or lost?
Opened
#32 Go test cache is a second, independent source of unearned greens: canonical make test lacks -count=1
Opened
#33 DECISION NEEDED: canonical script/bootstrap pins NODE_VERSION and YARN_VERSION but policy tells it to skip on any version found — the pins are decorative
Opened
#35 PROPAGATION: roll the Docker build-context trio (#26 CHECK_EPOCH, #29 .dockerignore secrets, #27 .claude/) into every consuming repo — as ONE commit per repo
Opened
#36 Operational consequence of CHECK_EPOCH: every check layer is unreusable by construction, so builder-cache growth is unbounded across the fleet
Opened
#37 DECISION NEEDED: should pinned Go tools be go install-with-commit-pin, or tracked as go.mod tool dependencies?
Opened
#38 SECURITY: canonical .gitignore misses common secret shapes (*.env, .envrc, *.p12/*.pfx, extensionless SSH keys)
Opened
#39 PROPAGATION: roll the Go tooling fixes (#28 bootstrap version enforcement, #30 lint cache/lock isolation) into every Go repo — as ONE commit per repo
Opened
#40 All linting must run in Docker: canonicalise homoicon's Dockerfile.lint + script/lint pattern
Opened
#41 Test-time cap: is 60s the new org-wide ceiling, or a dnswatcher divergence?
Opened
#44 Canonical Go make test example omits -count=1, shipping a false green to every repo
Opened
#46 Decision: vmsetup and secpol are tracked projects with no repo on the instance
Opened
#48 next still carries the pre-ruling 20s/30s test budget, so PR 34 will revert the org-wide ruling when it rebases
Opened
#51 issue-to-pr workers break the no-scripted-search-and-replace and no-raw-go-tools rules at a measured 3-in-4 rate
Opened
#52 REPO_POLICIES: carve out capability-URL services from "when in doubt, harden"
Opened
#56 Dockerfile.lint has no .git, so gitignore-honouring linters walk a different file set than they do locally
Opened
#57 PROPAGATION: roll the -count=1 Go test-cache fix (#44) into every consuming Go repo — as ONE commit per repo
Opened
#60 PROPAGATION: roll the new canonical .golangci.yml bytes (gomodguard_v2 migration) into every consuming repository
Opened
#61 Test recipe reruns a hung suite, so a hang costs the 90s backstop twice and can exceed the 5 minute build limit
Opened
#62 Fold the August fleet findings into the policies, or drop them
Opened
#63 Run every build, test and lint step in the Dockerfiles at nice -n 19
Opened
#65 Canonical golangci-lint pin cannot lint Go 1.27 modules; its successors enable exhaustruct_v5, which the canonical config does not disable
Opened
#66 Remove buildarch from the Go styleguide and HTTP server conventions: read the architecture at run time
Opened
#69 Version stamp: the build derives the version from git; .git is no longer excluded
Opened
#71 Version stamp follow-up: keep .git/config out of the build context; a bare docker build must succeed
Opened
#72 Version-stamp convention: follow-ups from the rollout, and one pinning question
Opened
#73 Canonical Go Dockerfile example: git refuses a checkout owned by another user, and -race cannot run on the alpine test image
Opened
#74 Styleguide Makefile stamps an empty version outside a git checkout
Opened
#75 Canonical .dockerignore keeps out .git/config but not a submodule's config
Opened
#76 make check prints the yarn warning "package.json: No license field"
Opened
#77 REPO_POLICIES.md still names CHECK_EPOCH, a mechanism that no longer exists
Opened
#78 PROPAGATION: re-vendor the current canonical files from main into every consuming repository
Opened
#81 Canonical ignore files miss the SSH key files for hardware-backed keys
Opened
#83 Canonical Dockerfile note installs lint-phase libraries with apk, but the golangci-lint image is Debian
Opened
#86 Go HTTP server conventions: the lifecycle example drops the exit code, double-handles signals, and exits from a goroutine
Opened
#88 Canonical .dockerignore: a submodule named config loses its git directory, and a submodule's own .git/config still ships
Opened
#90 REPO_POLICIES.md says Dockerfiles run script/bootstrap, but the canonical Go Dockerfile never does
Opened
#98 Every merge to next makes the other open PRs conflict in TODO.md
Opened
#101 script/ files pass the image tag through an inline command substitution, against their own rule
Opened
#103 Canonical .gitignore has no place for a repository's own build outputs
Opened
#104 Say that a re-vendor keeps a repository's own .gitignore and .editorconfig entries
Opened
#105 canonicalheader in the canonical .golangci.yml misses findings at random
Opened
#107 Canonical workflow lacks a concurrency block and leaves the CI token in .git/config
Opened
#110 The canonical workflow does not fetch tags, though the policy says a tag-derived version needs them
Opened
#111 Say what a build from a linked worktree must do about the version
Opened
#112 Go build cache mounts in the canonical Go Dockerfile, with -count=1 in its test phase
Opened
#113 DECISION: does the 60-second make test cap include building the test phase?
Opened
#115 Canonical script/bootstrap runs apt-get install without refreshing the package lists
Opened
#118 yarn 1.22.22 prints deprecation warning DEP0169 under node 24 during yarn install
Opened
#119 Canonical package.json declares MIT in every repository that copies it
Opened
#120 The canonical check workflow sets no time limit on its job
Opened
#123 The lint and test builds write an image nobody uses, costing about 16 seconds of the 60-second cap
Opened
#125 The new-repository checklist gives script/cibuild an untagged image build
Opened
#128 REPO_POLICIES: a package does what its name says; shared code goes in a third package
Opened
#130 May Go's module download cache survive between check builds too?
Opened
#133 Check builds may keep the Python package install from the lockfile
Opened
#134 Canonical .golangci.yml: accept homoicon's local replace of sobek
Opened
#136 question: rewrite REPO_POLICIES.md sentence by sentence on Fable?