4 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
clawbot	581dfa3b15	Fix git ownership and -race in the canonical Go Dockerfile (closes #73) ... The test phase ran go test -race on the alpine Go image, which has no C compiler, so cgo was off and the phase failed with "-race requires cgo" before running a test. It now uses the Debian Go image. A build context sent as a tar stream keeps the sender's file owners, so git in the stage that compiles refused the checkout and the version came out empty. That stage now runs git config --system --add safe.directory /src, and the policy text and both checklists say why. The apk add --no-cache git line is unchanged: its pinning waits on #72. Model: opus-5-5	2026-10-03 15:54:45 +00:00
clawbot	7ea5cdcdcd	Cover more secret shapes in the canonical .gitignore (closes #38) ... The canonical .gitignore matched only .env, .env.*, *.pem and *.key, so prod.env, .envrc, *.p12 and *.pfx bundles, and the SSH private keys id_rsa, id_dsa, id_ecdsa and id_ed25519 could be committed. The secrets section now covers the same shapes as the canonical .dockerignore, written to gitignore's own rules: unanchored, no **/ prefix, character ranges for case. example.env and sample.env stay trackable through negations, and the comment tells a repository to add its own negation for any other committed template. Judgement call: the existing entries were rewritten with character ranges, which only widens them, and the bare .env line is dropped because *.env covers it. Model: opus-5-5	2026-10-03 17:39:40 +02:00
clawbot	507a57e813	Derive the image version from git; send .git without its config (closes #69, closes #71) ... The canonical documents told every repo to exclude .git from the build context, default ARG VERSION to dev and never run git describe in a build stage, so an image built from a clone with no build argument reported dev. .dockerignore now sends .git but keeps out .git/config, which can hold a credential. The Dockerfile example installs git, takes the VERSION build argument when one is given and otherwise git describe --tags --always, and fails when .git exists but the version is empty, dev or unknown. The policy and both checklists state the rule in the same words, including that a plain docker build . with no build arguments must succeed. Model: opus-5-5	2026-10-02 04:38:10 +02:00
clawbot	2ae9391b26	Read the architecture at run time, not via a Buildarch ldflag (closes #66) ... The Go styleguide and the HTTP server conventions no longer pass the build architecture in through the Makefile. The Buildarch variable, globals field and BUILDARCH Makefile lines are removed from every example; the styleguide example prints runtime.GOARCH, and the logger's Identify logs "arch", runtime.GOARCH. The styleguide item gains one sentence saying so. Model: opus-5-5	2026-10-02 01:03:38 +02:00