sneak/prompts
1
0
Fork 0
Code Issues 4 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Compare commits

base: sneak/prompts:c5eb879140f754fddd45d388e32d13a269b969fa
Branches Tags
sneak/prompts:main sneak/prompts:next sneak/prompts:golangci-lint-v2.13.2 sneak/prompts:issue-52-capability-url-carveout sneak/prompts:policy/name-the-gate-for-repo-type-checks sneak/prompts:fix/25-gomodguard-v2 sneak/prompts:lint-policy-reconcile
..
compare: sneak/prompts:ade2b6211b76c27ac2b1744a1d1dc79cb58ed64c
Branches Tags
sneak/prompts:next sneak/prompts:main sneak/prompts:golangci-lint-v2.13.2 sneak/prompts:issue-52-capability-url-carveout sneak/prompts:policy/name-the-gate-for-repo-type-checks sneak/prompts:fix/25-gomodguard-v2 sneak/prompts:lint-policy-reconcile
2 Commits
c5eb879140 .. ade2b6211b
Author SHA1 Message Date
sneak ade2b6211b Pin host Go tools by commit hash with go install (closes #37)
check / check (push) Failing after 1s
Details 
Writes sneak's 2026-09-09 ruling into the script/bootstrap bullet of
REPO_POLICIES.md: a Go tool a repo needs on the host is installed with
go install pinned to a commit hash, never tracked as a go.mod tool
dependency or through a tools.go file. golangci-lint is unchanged; it
stays pinned only by its image digest.

Model: opus-5-5
 2026-10-04 07:16:05 +00:00
clawbot 567944f8d8 Ignore hardware-backed SSH key files in the canonical ignore files (closes #81)
check / check (push) Failing after 2s
Details 
`ssh-keygen` names the private key of a key backed by a hardware security key `id_ecdsa_sk` or `id_ed25519_sk`. The canonical `.gitignore` and `.dockerignore` listed only `id_rsa`, `id_dsa`, `id_ecdsa` and `id_ed25519`, so a repository could commit these files or copy them into an image.

Both names are added beside their plain counterparts in each file's own style: unanchored in `.gitignore`, `**/`-prefixed in `.dockerignore`, case-folded with character ranges in both. A pattern matches the whole file name, so the `.pub` halves stay trackable and still reach the build context.

Model: opus-5-5
 2026-10-04 09:14:52 +02:00
3 changed files with 8 additions and 0 deletions
Expand all files Collapse all files
.dockerignore
+2
View File
@@ -44,7 +44,9 @@
**/[iI][dD]_[rR][sS][aA]
**/[iI][dD]_[dD][sS][aA]
**/[iI][dD]_[eE][cC][dD][sS][aA]
**/[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
**/[iI][dD]_[eE][dD]25519
**/[iI][dD]_[eE][dD]25519_[sS][kK]
# Dependencies: restored inside the image, never copied in.
**/node_modules
.gitignore
+2
View File
@@ -42,4 +42,6 @@ node_modules/
[iI][dD]_[rR][sS][aA]
[iI][dD]_[dD][sS][aA]
[iI][dD]_[eE][cC][dD][sS][aA]
[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
[iI][dD]_[eE][dD]25519
[iI][dD]_[eE][dD]25519_[sS][kK]
TODO.md
+4
View File
@@ -25,6 +25,10 @@ fmt-check, and commit.
is pinned (issue 37): installed with `go install` pinned to a commit hash,
never tracked as a `go.mod` tool dependency or through a `tools.go` file.
golangci-lint is unaffected, since no repo installs it on the host.
- 2026-10-04: The canonical `.gitignore` and `.dockerignore` now also keep out
`id_ecdsa_sk` and `id_ed25519_sk`, the private key files `ssh-keygen` writes
for keys backed by a hardware security key (issue 81). Their `.pub` halves
stay trackable.
- 2026-10-04: `package.json` now has `"license": "MIT"`, matching `LICENSE`, so
yarn no longer prints "No license field" when `script/bootstrap` runs it
inside the Docker phases (issue 76). That was the only yarn warning there.