Pin host Go tools by commit hash with go install (closes #37)

Writes sneak's 2026-09-09 ruling ("commit pinned installation, not pulled into deps") into the `prompts/REPO_POLICIES.md` bullet that says `script/bootstrap` installs a pinned tool by comparing versions: a Go tool a repo needs on the host is installed with `go install` pinned to a commit hash, naming the tool's main package, and is never tracked as a `go.mod` tool dependency or through a `tools.go` file, either of which pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`. golangci-lint is unchanged: no repo installs it on the host, and it stays pinned by its image digest. Model: opus-5-5
2026-10-04 09:49:13 +02:00
parent 567944f8d8
commit c43c1f4bca
2 changed files with 9 additions and 0 deletions
@@ -495,6 +495,11 @@ style conventions are in separate documents:

    Keep it POSIX sh: no arrays, no `[[`, no `grep -P`.

+    A Go tool a repo needs on the host is installed with `go install` pinned to
+    a commit hash (`go install <package>@<commit hash>`). It is never tracked as
+    a `go.mod` tool dependency or through a `tools.go` file, either of which
+    pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`.
+
 - When pinning images or packages by hash, add a comment above the reference
  with the version and date (YYYY-MM-DD).