Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 clawbot
|
c1b469d2d0 |
No files matched your search
+4
-7
@@ -35,12 +35,6 @@
|
||||
# `services/api/.claude/` and must add its own anchored entry.
|
||||
.claude
|
||||
|
||||
# yarn's install state and cache stay out, and its release file stays
|
||||
# in. Docker obeys the last matching line, so these two lines sit above
|
||||
# the secret patterns, which must win under .yarn/releases/.
|
||||
.yarn/*
|
||||
!.yarn/releases
|
||||
|
||||
# Environment files. `*.env` covers bare `.env` and the `prod.env`
|
||||
# convention. Re-include a committed template with a negation if the
|
||||
# build needs one: `!docs/example.env`.
|
||||
@@ -61,8 +55,11 @@
|
||||
**/[iI][dD]_[eE][dD]25519
|
||||
**/[iI][dD]_[eE][dD]25519_[sS][kK]
|
||||
|
||||
# Dependencies: restored inside the image, never copied in.
|
||||
# Dependencies: restored inside the image, never copied in. yarn's install
|
||||
# state and cache stay out, and its release file stays in.
|
||||
**/node_modules
|
||||
.yarn/*
|
||||
!.yarn/releases
|
||||
|
||||
# OS metadata.
|
||||
**/.DS_Store
|
||||
|
||||
+3
-3
@@ -22,9 +22,9 @@ node_modules/
|
||||
.yarn/*
|
||||
!.yarn/releases
|
||||
|
||||
# Secrets. Unanchored, so each matches at every depth. Matching is
|
||||
# case-sensitive on Linux, so names use character ranges rather than a
|
||||
# lowercase form that misses `Server.Key`.
|
||||
# Secrets. Unanchored like every entry above, so each matches at every
|
||||
# depth. Matching is case-sensitive on Linux, so names use character
|
||||
# ranges rather than a lowercase form that misses `Server.Key`.
|
||||
|
||||
# Environment files. `*.env` covers bare `.env` and the `prod.env`
|
||||
# convention. Only the templates `example.env` and `sample.env` are
|
||||
|
||||
+2
-2
@@ -6,8 +6,8 @@
|
||||
# system packages. script/ passes a new value on every build. That value
|
||||
# reruns every RUN step below the ARG line, and the install step keeps
|
||||
# its layer. node and yarn come from the distribution, which is trusted,
|
||||
# so they need no version and no hash. That yarn only starts the release
|
||||
# file in .yarn/releases/, so every stage copies that file and
|
||||
# so they need no version and no hash. That yarn hands the work to the
|
||||
# release file in .yarn/releases/, so every stage copies that file and
|
||||
# .yarnrc.yml before it runs script/bootstrap.
|
||||
#
|
||||
# alpine 3.24.3, 2026-11-04
|
||||
|
||||
@@ -172,8 +172,7 @@ share, and evolve prompts across projects.
|
||||
The repository is a collection of Markdown files organized in the `prompts/`
|
||||
subdirectory. Each file contains one or more related prompts or policy
|
||||
documents. There is no build step or runtime component; the prompts are consumed
|
||||
by copying them into other projects or referencing them directly. `examples/`
|
||||
holds the example `Dockerfile` files that `prompts/REPO_POLICIES.md` links to.
|
||||
by copying them into other projects or referencing them directly.
|
||||
|
||||
## Template Repos
|
||||
|
||||
|
||||
@@ -21,23 +21,6 @@ fmt-check, and commit.
|
||||
|
||||
# Completed Steps
|
||||
|
||||
- 2026-11-09: Compacted `prompts/REPO_POLICIES.md` from 1,165 lines and 8,556
|
||||
words to 982 lines and 7,281 words
|
||||
(https://git.eeqj.de/sneak/prompts/issues/158). Every rule keeps its meaning.
|
||||
The rules now sit under headings, the pinning rule first. Each rule that was
|
||||
stated in several places is stated once. The Makefile copies of the Go and
|
||||
Python test commands are gone, because the `Dockerfile` examples carry the
|
||||
same commands. Both checklists name the `.golangci.yml` section.
|
||||
- 2026-11-07: Go code is now formatted with `gofmt` and then `golines -m 77`
|
||||
(https://git.eeqj.de/sneak/prompts/issues/160). `prompts/REPO_POLICIES.md`
|
||||
says how `script/fmt`, `script/fmt-check` and `script/bootstrap` do it and
|
||||
pins `golines`. The Go style guide and both checklists say the same. `lll`
|
||||
stays at 88, since `golines` leaves long strings and comments as they are.
|
||||
- 2026-11-06: The pinning rule in `prompts/REPO_POLICIES.md` now opens with its
|
||||
scope: what we download and install ourselves in scripts and Dockerfiles
|
||||
(https://git.eeqj.de/sneak/prompts/issues/154). Distribution packages are
|
||||
outside the rule, and updating and upgrading them is allowed. Both checklists
|
||||
say the same.
|
||||
- 2026-11-04: Each repository now commits yarn 4 and installs with
|
||||
`yarn install --immutable` (https://git.eeqj.de/sneak/prompts/issues/149), on
|
||||
sneak's ruling at
|
||||
@@ -53,13 +36,6 @@ fmt-check, and commit.
|
||||
and yarn.
|
||||
- Both checklists give the steps, and the ignore files keep yarn's install
|
||||
state out of git and the build context.
|
||||
- 2026-11-04: An agent whose work is confined to one package may run `go test`
|
||||
directly on that package's suite, or on individual tests in it, while
|
||||
iterating (https://git.eeqj.de/sneak/prompts/issues/51), on sneak's ruling at
|
||||
https://git.eeqj.de/sneak/prompts/issues/51#issuecomment-167600. The full
|
||||
`make check` is still required before every push, and the `Makefile` gains
|
||||
nothing. The rule on Docker now names the lint and test gates, because a run
|
||||
while iterating is not one.
|
||||
- 2026-11-04: node, yarn, npm, python, pip and venv now come from the
|
||||
distribution with no version and no hash
|
||||
(https://git.eeqj.de/sneak/prompts/issues/146), on sneak's ruling at
|
||||
|
||||
@@ -1,8 +0,0 @@
|
||||
FROM golangci/golangci-lint@sha256:... AS lint
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends libvips-dev \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
WORKDIR /src
|
||||
COPY go.mod go.sum ./
|
||||
RUN go mod download
|
||||
ARG CACHEBUST
|
||||
@@ -1,85 +0,0 @@
|
||||
# In every stage ARG CACHEBUST comes right after the steps that install
|
||||
# system packages and download Go's modules, or right after FROM in a
|
||||
# stage with neither, and every step that lints, tests or compiles
|
||||
# comes after it. script/ passes a new value on every build, which
|
||||
# reruns every RUN step after it. Docker keeps the layers above it
|
||||
# until the base image, their own lines or go.mod and go.sum change.
|
||||
# The steps that compile mount Go's build cache, and golangci-lint run
|
||||
# also mounts golangci-lint's; both survive from build to build.
|
||||
|
||||
# Lint phase
|
||||
# golangci/golangci-lint:v2.x.x, YYYY-MM-DD
|
||||
FROM golangci/golangci-lint@sha256:... AS lint
|
||||
WORKDIR /src
|
||||
COPY go.mod go.sum ./
|
||||
RUN go mod download
|
||||
ARG CACHEBUST
|
||||
COPY . .
|
||||
RUN --mount=type=cache,target=/root/.cache/go-build \
|
||||
--mount=type=cache,target=/root/.cache/golangci-lint \
|
||||
golangci-lint run --config .golangci.yml ./...
|
||||
|
||||
# Test phase. -race needs cgo and so a C compiler, which the Debian Go
|
||||
# image ships and the alpine one does not. -count=1 because the mounted
|
||||
# cache also holds test results, which go test would otherwise replay.
|
||||
# A first run that timed out gets no rerun, because a rerun would only
|
||||
# wait for the same hang.
|
||||
# golang:1.x, YYYY-MM-DD
|
||||
FROM golang@sha256:... AS test
|
||||
WORKDIR /src
|
||||
COPY go.mod go.sum ./
|
||||
RUN go mod download
|
||||
ARG CACHEBUST
|
||||
COPY . .
|
||||
RUN --mount=type=cache,target=/root/.cache/go-build \
|
||||
status=0; \
|
||||
output=$(go test -count=1 -timeout 90s -race -cover ./... 2>&1) || status=$?; \
|
||||
printf '%s\n' "$output"; \
|
||||
test "$status" -eq 0 && exit 0; \
|
||||
case "$output" in \
|
||||
*"panic: test timed out"*|*"*** Test killed"*) exit 1 ;; \
|
||||
esac; \
|
||||
echo "--- Rerunning with -v for details ---"; \
|
||||
go test -count=1 -timeout 90s -race -v ./...; \
|
||||
exit 1
|
||||
|
||||
# Build stage. Nothing is wanted from either phase above; the copies
|
||||
# are what make BuildKit build them first, so nothing after them can
|
||||
# run unless lint and test passed.
|
||||
# golang:1.x-alpine, YYYY-MM-DD
|
||||
FROM golang@sha256:... AS builder
|
||||
# git comes from the base image's own distribution package index, which
|
||||
# is trusted, so it needs no version and no hash.
|
||||
RUN apk add --no-cache git
|
||||
WORKDIR /src
|
||||
COPY go.mod go.sum ./
|
||||
RUN go mod download
|
||||
ARG CACHEBUST
|
||||
COPY --from=lint /src/go.sum /dev/null
|
||||
COPY --from=test /src/go.sum /dev/null
|
||||
# A tar-stream context keeps the sender's file owners, which git refuses.
|
||||
RUN git config --system --add safe.directory /src
|
||||
COPY . .
|
||||
|
||||
# The VERSION build arg when one is given, otherwise
|
||||
# `git describe --tags --always` on the .git in the build context. With
|
||||
# .git present, a version that is still empty, dev or unknown fails the
|
||||
# build: git is missing or could not read the checkout.
|
||||
ARG VERSION
|
||||
RUN --mount=type=cache,target=/root/.cache/go-build \
|
||||
VERSION="${VERSION:-$(git describe --tags --always)}"; \
|
||||
if [ -e .git ]; then \
|
||||
case "$VERSION" in ""|dev|unknown) \
|
||||
echo "version is '$VERSION' although .git is present" >&2; \
|
||||
exit 1 ;; \
|
||||
esac; \
|
||||
fi; \
|
||||
CGO_ENABLED=0 go build -trimpath \
|
||||
-ldflags="-s -w -X main.Version=${VERSION}" \
|
||||
-o /app ./cmd/app/
|
||||
|
||||
# Runtime stage, and the last one
|
||||
FROM alpine@sha256:...
|
||||
ARG CACHEBUST
|
||||
COPY --from=builder /app /usr/local/bin/app
|
||||
ENTRYPOINT ["app"]
|
||||
@@ -1,24 +0,0 @@
|
||||
# Test phase. Both pytest runs share one 90-second timeout, so a hang
|
||||
# uses it once and gets no rerun.
|
||||
# debian:trixie-slim, YYYY-MM-DD
|
||||
FROM debian@sha256:... AS test
|
||||
# Python, pip and venv come from the distribution, which is trusted, so
|
||||
# they need no version and no hash. make and git are base tools that
|
||||
# script/bootstrap installs when they are missing. Installed here, they
|
||||
# stay in their own layer when script/ changes.
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends ca-certificates make git \
|
||||
python3 python3-venv \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
# script/bootstrap installs pipenv in a virtual environment at
|
||||
# $HOME/.pipenv, and the tests below run that pipenv.
|
||||
ENV PATH=/root/.pipenv/bin:$PATH
|
||||
WORKDIR /app
|
||||
COPY script/ script/
|
||||
COPY Pipfile Pipfile.lock ./
|
||||
RUN script/bootstrap
|
||||
ARG CACHEBUST
|
||||
COPY . .
|
||||
RUN timeout 90 sh -c 'pipenv run pytest || { \
|
||||
echo "--- Rerunning with -v for details ---"; \
|
||||
pipenv run pytest -v; exit 1; }'
|
||||
@@ -1,16 +1,13 @@
|
||||
---
|
||||
title: Code Styleguide — Go
|
||||
last_modified: 2026-11-07
|
||||
last_modified: 2026-10-18
|
||||
---
|
||||
|
||||
1. Format Go code with `gofmt` and then `golines -m 77`, through `make fmt`.
|
||||
Don't commit anything `make fmt` would change. The only exception is when
|
||||
committing things that aren't yet syntactically valid, which should only
|
||||
happen pre-v0.0.1 or on a non-`main` branch.
|
||||
1. Try to hard wrap long lines at 77 characters or less.
|
||||
|
||||
1. Hard wrap long lines at 77 characters or less. `golines` does this for code.
|
||||
Wrap comments and long string literals by hand, since `golines` leaves them
|
||||
as they are.
|
||||
1. Don't commit anything that hasn't been `go fmt`'d. The only exception is
|
||||
when committing things that aren't yet syntactically valid, which should
|
||||
only happen pre-v0.0.1 or on a non-`main` branch.
|
||||
|
||||
1. Even if you are planning to deal with only positive integers, use
|
||||
`int`/`int64` types instead of `uint`/`uint64` types. This is for
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Existing Repo Checklist
|
||||
last_modified: 2026-11-09
|
||||
last_modified: 2026-11-04
|
||||
---
|
||||
|
||||
Use this checklist when beginning work in a repo that may not yet conform to our
|
||||
@@ -71,8 +71,8 @@ with your task.
|
||||
also mounts golangci-lint's
|
||||
(`--mount=type=cache,target=/root/.cache/golangci-lint`), and no step
|
||||
mounts anything else; both `go test` runs carry `-count=1`; a first run
|
||||
that timed out gets no rerun, as in `examples/go.Dockerfile` in the
|
||||
`prompts` repo
|
||||
that timed out gets no rerun, as in the canonical Go `Dockerfile` in
|
||||
`REPO_POLICIES.md`
|
||||
- [ ] Python: a `test` phase that installs its packages from `Pipfile.lock` does
|
||||
it above `ARG CACHEBUST`, with `COPY script/ script/`,
|
||||
`COPY Pipfile Pipfile.lock ./` and `RUN script/bootstrap`. When
|
||||
@@ -92,8 +92,8 @@ with your task.
|
||||
installs no Python, because a step above it already did. `Pipfile` names no
|
||||
`python_version`, because `--deploy` stops when the distribution's Python
|
||||
differs from it. The tests run after `ARG CACHEBUST`, and every other stage
|
||||
installs its Python packages after it, as in
|
||||
`examples/python-test-phase.Dockerfile` in the `prompts` repo
|
||||
installs its Python packages after it, as in the Python `test` phase example
|
||||
in `REPO_POLICIES.md`
|
||||
|
||||
- [ ] The gate phases invoke their tools directly, never through `make lint` or
|
||||
`script/test` — those are themselves a `docker build` and would recurse
|
||||
@@ -163,18 +163,17 @@ with your task.
|
||||
- [ ] Go: `go.mod`, `go.sum`, `.golangci.yml` (fetch from
|
||||
`https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and,
|
||||
in the same commit, set the lint phase digest to the one named in the
|
||||
`.golangci.yml` section of `REPO_POLICIES.md`)
|
||||
`.golangci.yml` paragraph of `REPO_POLICIES.md`)
|
||||
- [ ] JS: `package.json`, `yarn.lock`, `.yarnrc.yml`, `.yarn/releases/`,
|
||||
`.gitattributes`, `.prettierrc`, `.prettierignore` (fetch the last two
|
||||
from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.prettierrc`
|
||||
and
|
||||
`.prettierrc`, `.prettierignore` (fetch the last two from
|
||||
`https://git.eeqj.de/sneak/prompts/raw/branch/main/.prettierrc` and
|
||||
`https://git.eeqj.de/sneak/prompts/raw/branch/main/.prettierignore`).
|
||||
- [ ] Any repository with `yarn.lock`: that file is in yarn 4's format. If
|
||||
its second line says `yarn lockfile v1`, convert it with the steps
|
||||
below. Do them in one commit with the re-vendored scripts, because
|
||||
yarn 1 ignores `--immutable` and exits 0 on a tree with no
|
||||
`.yarnrc.yml`. Run them with any distribution's node and yarn, and use
|
||||
`yarnpkg` on Debian and Ubuntu.
|
||||
- [ ] JS: `yarn.lock` is in yarn 4's format. If its second line says
|
||||
`yarn lockfile v1`, convert it with the steps below. Do them in one
|
||||
commit with the re-vendored scripts, because yarn 1 ignores
|
||||
`--immutable` and exits 0 on a tree with no `.yarnrc.yml`. Run them
|
||||
with any distribution's node and yarn, and use `yarnpkg` on Debian and
|
||||
Ubuntu.
|
||||
1. Read the version from `yarnPath` in
|
||||
`https://git.eeqj.de/sneak/prompts/raw/branch/main/.yarnrc.yml`.
|
||||
2. Run `yarn set version <version>`. It writes
|
||||
@@ -188,14 +187,12 @@ with your task.
|
||||
`npmMinimalAgeGate` from `.yarnrc.yml`. The conversion wrote them.
|
||||
They allow install scripts, any git repository and packages of any
|
||||
age, which yarn otherwise refuses.
|
||||
6. In `package.json`, name any package that must run its install script,
|
||||
6. Name any package that must run its install script in `package.json`,
|
||||
as `"dependenciesMeta": { "<name>": { "built": true } }`, and run
|
||||
`yarn install` again.
|
||||
7. Add `.yarn/*` and `!.yarn/releases` above the secret patterns in
|
||||
`.gitignore` and `.dockerignore`. Docker obeys the last matching
|
||||
line, and the secret patterns must win. Add `.yarn/` to
|
||||
`.prettierignore`, and `.yarn/releases/** binary` to
|
||||
`.gitattributes`.
|
||||
7. Add `.yarn/*` and `!.yarn/releases` to `.gitignore` and
|
||||
`.dockerignore`, `.yarn/` to `.prettierignore`, and
|
||||
`.yarn/releases/** binary` to `.gitattributes`.
|
||||
8. Run `yarn install --immutable`. It must pass and change nothing.
|
||||
- [ ] Python: `pyproject.toml`
|
||||
- [ ] Docs/writing: `.prettierrc`, `.prettierignore` (same URLs as above)
|
||||
@@ -234,9 +231,8 @@ with your task.
|
||||
- [ ] `script/bootstrap` installs node, yarn and the node packages only when
|
||||
`yarn.lock` is in the tree. node and yarn come from the distribution when
|
||||
they are missing. It installs the node packages with
|
||||
`yarn install --immutable`. The distribution's yarn only starts the
|
||||
release file that `yarnPath` in `.yarnrc.yml` names, and that file does
|
||||
the work.
|
||||
`yarn install --immutable`. Whichever yarn the distribution packages hands
|
||||
the work to the release file that `yarnPath` in `.yarnrc.yml` names.
|
||||
- [ ] A `Dockerfile` stage that needs yarn may start from any distribution that
|
||||
packages node and yarn. It copies `package.json`, `yarn.lock`,
|
||||
`.yarnrc.yml` and `.yarn/releases/` before it runs `script/bootstrap`. A
|
||||
@@ -259,34 +255,29 @@ with your task.
|
||||
|
||||
# Formatting
|
||||
|
||||
- [ ] Platform-standard formatter is configured (`black`, `prettier`, and for Go
|
||||
`gofmt` then `golines -m 77`)
|
||||
- [ ] Default formatter config, except four-space indents (not Go),
|
||||
`proseWrap: always` for Markdown, and the Go 77-column limit
|
||||
- [ ] Go: `script/bootstrap` installs `golines` with `go install` pinned to a
|
||||
commit hash; `script/fmt-check` fails when `gofmt` or `golines -m 77`
|
||||
would change a file
|
||||
- [ ] Platform-standard formatter is configured (`black`, `prettier`, `go fmt`)
|
||||
- [ ] Default formatter config, only exception: four-space indents (except Go)
|
||||
- [ ] All files pass `make fmt-check`
|
||||
|
||||
# Git Hygiene
|
||||
|
||||
- [ ] Pre-commit hook is installed (`make hooks`)
|
||||
- [ ] No secrets in the repo (`.env`, keys, credentials)
|
||||
- [ ] No mutable references (tags, `@latest`) to what the repo downloads and
|
||||
installs itself in scripts and Dockerfiles — all pinned by cryptographic
|
||||
hash with version/date comment. Distribution packages are outside this
|
||||
rule. They need no version and no hash, and updating and upgrading them is
|
||||
fine too. In a `Dockerfile`, the distribution is the pinned base image's.
|
||||
On a host, it is the host's, and the host's package manager stands for it,
|
||||
nix and brew included. A package source that a `Dockerfile` adds itself is
|
||||
not the distribution's own, so its packages are pinned
|
||||
- [ ] No mutable references in Dockerfiles or scripts (tags, `@latest`) — all
|
||||
pinned by cryptographic hash with version/date comment. The one exception
|
||||
is a package from the distribution's own package index, which needs no
|
||||
version and no hash. Pulling that index is also allowed. In a
|
||||
`Dockerfile`, the distribution is the pinned base image's. On a host, it
|
||||
is the host's, and the host's package manager stands for it, nix and brew
|
||||
included. A package source that a `Dockerfile` adds itself does not get
|
||||
this exception
|
||||
- [ ] node, yarn, npm, python, pip and venv come from the distribution wherever
|
||||
possible, never from nvm, pyenv, corepack or `npm install -g yarn`. If the
|
||||
distribution's version is too old, use a newer distribution. node means
|
||||
the distribution's newest Node package, such as `nodejs-current` on Alpine
|
||||
3.24
|
||||
- [ ] yarn's release file is in git under `.yarn/releases/`, written once by
|
||||
`yarn set version` with an exact version (repositories with `yarn.lock`)
|
||||
`yarn set version` with an exact version
|
||||
- [ ] Using `yarn`, not `npm` (JS projects)
|
||||
|
||||
# Directory Structure
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: New Repo Checklist
|
||||
last_modified: 2026-11-09
|
||||
last_modified: 2026-11-04
|
||||
---
|
||||
|
||||
Use this checklist when creating a new repository from scratch. Follow the steps
|
||||
@@ -138,8 +138,8 @@ Template files can be fetched from:
|
||||
also mounts golangci-lint's
|
||||
(`--mount=type=cache,target=/root/.cache/golangci-lint`), and no step
|
||||
mounts anything else; both `go test` runs carry `-count=1`; a first run
|
||||
that timed out gets no rerun, as in `examples/go.Dockerfile` in the
|
||||
`prompts` repo
|
||||
that timed out gets no rerun, as in the canonical Go `Dockerfile` in
|
||||
`REPO_POLICIES.md`
|
||||
- Python: a `test` phase that installs its packages from `Pipfile.lock` does
|
||||
it above `ARG CACHEBUST`, with `COPY script/ script/`,
|
||||
`COPY Pipfile Pipfile.lock ./` and `RUN script/bootstrap`. When
|
||||
@@ -160,8 +160,8 @@ Template files can be fetched from:
|
||||
because a step above it already did. `Pipfile` names no
|
||||
`python_version`, because `--deploy` stops when the distribution's
|
||||
Python differs from it. The tests run after `ARG CACHEBUST`, and every
|
||||
other stage installs its Python packages after it, as in
|
||||
`examples/python-test-phase.Dockerfile` in the `prompts` repo
|
||||
other stage installs its Python packages after it, as in the Python
|
||||
`test` phase example in `REPO_POLICIES.md`
|
||||
|
||||
- Server: the final stage builds and runs the application
|
||||
- Non-server: the final stage brings up the dev environment
|
||||
@@ -178,12 +178,11 @@ Template files can be fetched from:
|
||||
- [ ] Go: `go mod init sneak.berlin/go/<name>`, `.golangci.yml` (fetch from
|
||||
`https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and,
|
||||
in the same commit, set the lint phase digest to the one named in the
|
||||
`.golangci.yml` section of `REPO_POLICIES.md`)
|
||||
- [ ] JS, or any repository that runs prettier through yarn: make the first
|
||||
`yarn.lock` with the steps below. `script/bootstrap` installs no yarn
|
||||
until `yarn.lock` exists, so run them with any distribution's node and
|
||||
yarn, such as Alpine's (`apk add nodejs-current yarn`). Use `yarnpkg`
|
||||
on Debian and Ubuntu.
|
||||
`.golangci.yml` paragraph of `REPO_POLICIES.md`)
|
||||
- [ ] JS: make the first `yarn.lock` with the steps below.
|
||||
`script/bootstrap` installs no yarn until `yarn.lock` exists, so run
|
||||
them with any distribution's node and yarn, such as Alpine's
|
||||
(`apk add nodejs-current yarn`). Use `yarnpkg` on Debian and Ubuntu.
|
||||
1. Read the version from `yarnPath` in
|
||||
`https://git.eeqj.de/sneak/prompts/raw/branch/main/.yarnrc.yml`.
|
||||
2. Run `yarn set version <version>`. It writes
|
||||
@@ -211,9 +210,9 @@ are thin shims calling them. Model scripts:
|
||||
- It installs node, yarn and the node packages only when `yarn.lock` is in
|
||||
the tree. node and yarn come from that package manager when they are
|
||||
missing.
|
||||
- It installs the node packages with `yarn install --immutable`. The
|
||||
distribution's yarn only starts the release file that `yarnPath` in
|
||||
`.yarnrc.yml` names, and that file does the work.
|
||||
- It installs the node packages with `yarn install --immutable`. Whichever
|
||||
yarn the distribution packages hands the work to the release file that
|
||||
`yarnPath` in `.yarnrc.yml` names.
|
||||
- A non-server repo's development environment stage runs it, with only
|
||||
system packages installed inline above it.
|
||||
- A gate phase or the build stage installs what its base image lacks, either
|
||||
@@ -233,11 +232,9 @@ are thin shims calling them. Model scripts:
|
||||
which writes no image. No lint verdict may come from a host invocation of
|
||||
the linter.
|
||||
- [ ] `script/fmt` / `make fmt` — formats code (writes; native, never in a
|
||||
container). Go code gets `gofmt`, then `golines -m 77`.
|
||||
container)
|
||||
- [ ] `script/fmt-check` / `make fmt-check` — checks formatting (read-only;
|
||||
native). Fails when `gofmt` or `golines -m 77` would change a Go file.
|
||||
- [ ] Go: `script/bootstrap` installs `golines` with `go install` pinned to a
|
||||
commit hash
|
||||
native)
|
||||
- [ ] `script/check` / `make check` — runs `test`, `lint`, `fmt-check`; must not
|
||||
modify files
|
||||
- [ ] `script/projectname` — outputs the project name (used by `script/docker`
|
||||
@@ -287,20 +284,19 @@ are thin shims calling them. Model scripts:
|
||||
final stage is missing its `COPY --from=` edge to the gate phases.
|
||||
- [ ] No secrets in repo, and none in the build context: enumerate a probe image
|
||||
rather than reading `.dockerignore`
|
||||
- [ ] No mutable references to what the repo downloads and installs itself in
|
||||
scripts and Dockerfiles. Distribution packages are outside this rule. They
|
||||
need no version and no hash, and updating and upgrading them is fine too.
|
||||
In a `Dockerfile`, the distribution is the pinned base image's. On a host,
|
||||
it is the host's, and the host's package manager stands for it, nix and
|
||||
brew included. A package source that a `Dockerfile` adds itself is not the
|
||||
distribution's own, so its packages are pinned
|
||||
- [ ] No mutable image/package references. The one exception is a package from
|
||||
the distribution's own package index, which needs no version and no hash.
|
||||
Pulling that index is also allowed. In a `Dockerfile`, the distribution is
|
||||
the pinned base image's. On a host, it is the host's, and the host's
|
||||
package manager stands for it, nix and brew included. A package source
|
||||
that a `Dockerfile` adds itself does not get this exception
|
||||
- [ ] node, yarn, npm, python, pip and venv come from the distribution wherever
|
||||
possible, never from nvm, pyenv, corepack or `npm install -g yarn`. If the
|
||||
distribution's version is too old, use a newer distribution. node means
|
||||
the distribution's newest Node package, such as `nodejs-current` on Alpine
|
||||
3.24
|
||||
- [ ] yarn's release file is in git under `.yarn/releases/`, written once by
|
||||
`yarn set version` with an exact version (repositories with `yarn.lock`)
|
||||
`yarn set version` with an exact version
|
||||
- [ ] No unnecessary files in repo root
|
||||
- [ ] All dates written as YYYY-MM-DD
|
||||
|
||||
|
||||
+1089
-934
File diff suppressed because it is too large.
Load diff
+5
-5
@@ -4,10 +4,10 @@
|
||||
# installed tools are skipped. Base tools, node and yarn come from nix,
|
||||
# apt, brew, or apk (detected in that order), with no version and no
|
||||
# hash, because the distribution is trusted. It installs node, yarn and
|
||||
# the node packages only when yarn.lock is in the tree. The
|
||||
# distribution's yarn only starts the release file that yarnPath in
|
||||
# .yarnrc.yml names, and that file does the work. So git pins the yarn
|
||||
# that runs. Assumes nothing is present.
|
||||
# the node packages only when yarn.lock is in the tree. Whichever yarn
|
||||
# the distribution packages hands the work to the release file that
|
||||
# yarnPath in .yarnrc.yml names, so git pins the yarn that runs. Assumes
|
||||
# nothing is present.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
@@ -80,7 +80,7 @@ main() {
|
||||
|
||||
# A Dockerfile stage that needs no yarn copies no yarn.lock.
|
||||
if [ -f yarn.lock ]; then
|
||||
if missing node; then pkg_install nodejs_latest nodejs node nodejs-current; fi
|
||||
if missing node; then pkg_install nodejs nodejs node nodejs-current; fi
|
||||
if missing yarn && missing yarnpkg; then
|
||||
pkg_install yarn yarnpkg yarn yarn
|
||||
fi
|
||||
|
||||
Reference in new issue
Block a user