TODO.md: remove the work log, keep only open work (closes #167 )

Drop the Completed Steps log and the finished "commit this TODO.md" item. Git keeps the history. Model: opus-5-5
2026-11-11 00:06:04 +00:00
12 changed files with 825 additions and 1776 deletions
@@ -42,7 +42,7 @@ RUN script/bootstrap
 COPY . .
-RUN test/commit-upstream-policy-files.sh
+RUN timeout 90 test/update-policy.sh
 # Development environment, and the last stage: a plain `docker build .`
 # names no target and so builds this one. Nothing is wanted from the two
@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup test lint fmt fmt-check check docker hooks write-upstream-policy-files commit-upstream-policy-files
+.PHONY: bootstrap setup test lint fmt fmt-check check docker hooks update-policy
 # Makefile targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -31,8 +31,5 @@ docker:
 hooks:
 	@script/install-precommit
-write-upstream-policy-files:
+update-policy:
-	@script/write-upstream-policy-files
+	@script/update-policy
 commit-upstream-policy-files:
 	@script/commit-upstream-policy-files
@@ -119,7 +119,7 @@ alpine. We provide:
 - `script/test` —
  `docker build --build-arg CACHEBUST="$(date +%s)-$$" --target test --output type=cacheonly .`,
  building the `test` phase of the `Dockerfile`, which runs
-  `test/commit-upstream-policy-files.sh`, without writing an image
+  `test/update-policy.sh`, without writing an image
 - `script/lint` —
  `docker build --build-arg CACHEBUST="$(date +%s)-$$" --target lint --output type=cacheonly .`,
  building the `lint` phase, which runs prettier over the markdown files,
@@ -141,14 +141,9 @@ alpine. We provide:
  `script/check`
 - `script/install-precommit` — installs the git pre-commit hook (our own
  extension); `make hooks` shims to it
- `script/write-upstream-policy-files` — fetch the vendored policy files from
+- `script/update-policy` — fetch the vendored policy files from this repo,
-  this repo over HTTP and write them into a repo (our own extension). It writes
+  commit them and push (our own extension); it is for the repos that vendor them
-  into the repo given as its argument, or its own repo with no argument. It
+  and stops when run here
  stops when its target is this repo.
 - `script/commit-upstream-policy-files` — fetch the current
  `script/write-upstream-policy-files`, run it on its own repo and commit the
  result without pushing (our own extension). It is for the repos that vendor
  the policy files. It stops when run here.
 `make hooks` installs the pre-commit hook that runs `script/precommit`.
@@ -19,440 +19,8 @@ prompts/FIXUP_CLEAN.md (currently a near-empty stub) and prompts/FIXUP_REPORT.md
 (a rough draft). Write the missing content, run `make fmt` so they pass
 fmt-check, and commit.
 # Completed Steps
 - 2026-11-09: `script/write-upstream-policy-files` writes the vendored policy
  files into a repo over HTTP, itself and `script/commit-upstream-policy-files`
  among them (https://git.eeqj.de/sneak/prompts/issues/165).
  `make commit-upstream-policy-files` replaces `make update-policy`. It fetches
  the current `script/write-upstream-policy-files`, runs it and commits without
  pushing. The template repositories get both scripts in their own issues.
 - 2026-11-09: `script/update-policy` and `make update-policy` update a repo's
  vendored policy files with one command
  (https://git.eeqj.de/sneak/prompts/issues/162). They fetch the files from
  `prompts`, keep the repo's own entries, commit and push. The canonical
  `.dockerignore` now ends with the comment that the repo's own entries go
  below. The template repositories get the script in their own issues.
 - 2026-11-07: Go code is now formatted with `gofmt` and then `golines -m 77`
  (https://git.eeqj.de/sneak/prompts/issues/160). `prompts/REPO_POLICIES.md`
  says how `script/fmt`, `script/fmt-check` and `script/bootstrap` do it and
  pins `golines`. The Go style guide and both checklists say the same. `lll`
  stays at 88, since `golines` leaves long strings and comments as they are.
 - 2026-11-06: The pinning rule in `prompts/REPO_POLICIES.md` now opens with its
  scope: what we download and install ourselves in scripts and Dockerfiles
  (https://git.eeqj.de/sneak/prompts/issues/154). Distribution packages are
  outside the rule, and updating and upgrading them is allowed. Both checklists
  say the same.
 - 2026-11-04: Each repository now commits yarn 4 and installs with
  `yarn install --immutable` (https://git.eeqj.de/sneak/prompts/issues/149), on
  sneak's ruling at
  https://git.eeqj.de/sneak/prompts/issues/149#issuecomment-167558. Product
  repositories convert when they next have work. These changed:
    - This repository carries `.yarn/releases/yarn-4.18.1.cjs`, and its
      `yarn.lock` is in yarn 4's format.
    - `script/bootstrap` no longer stops on yarn's major version.
    - Node comes from the distribution's newest Node package, which on Alpine
      3.24 is `nodejs-current`.
    - A `Dockerfile` stage that needs yarn also copies `.yarnrc.yml` and
      `.yarn/releases/`, and may start from any distribution that packages node
      and yarn.
    - Both checklists give the steps, and the ignore files keep yarn's install
      state out of git and the build context.
 - 2026-11-04: An agent whose work is confined to one package may run `go test`
  directly on that package's suite, or on individual tests in it, while
  iterating (https://git.eeqj.de/sneak/prompts/issues/51), on sneak's ruling at
  https://git.eeqj.de/sneak/prompts/issues/51#issuecomment-167600. The full
  `make check` is still required before every push, and the `Makefile` gains
  nothing. The rule on Docker now names the lint and test gates, because a run
  while iterating is not one.
 - 2026-11-04: node, yarn, npm, python, pip and venv now come from the
  distribution with no version and no hash
  (https://git.eeqj.de/sneak/prompts/issues/146), on sneak's ruling at
  https://git.eeqj.de/sneak/prompts/issues/146#issuecomment-166033. Third-party
  packages stay pinned by hash. These changed:
    - `script/bootstrap` no longer uses nvm or corepack, and stops when yarn's
      major version is not 1.
    - `script/bootstrap` installs node, yarn and the node packages only when
      `yarn.lock` is in the tree.
    - `script/bootstrap`, `script/fmt` and `script/fmt-check` run `yarn` or
      `yarnpkg`, whichever is present.
    - This repository's `Dockerfile` starts from Alpine 3.24.
    - The Python `test` phase example starts from `debian:trixie-slim`.
    - A Python repository's `script/bootstrap` creates its virtual environment
      at `$HOME/.pipenv`, so it works on a host and in a `Dockerfile`.
    - `PIP_ONLY_BINARY=:all:` stops a package with no wheel, so pip downloads no
      build tools without a hash check.
 - 2026-11-04: Rewrote `prompts/REPO_POLICIES.md` sentence by sentence
  (https://git.eeqj.de/sneak/prompts/issues/136), on sneak's yes at
  https://git.eeqj.de/sneak/prompts/issues/136#issuecomment-165193. Every rule
  keeps its meaning and its place, and `must` and `should` stay as they were.
  Long sentences are split, comma-chained lists are now bulleted lists, and
  every reason stays. Code blocks, digests, URLs, file names, commands and
  quoted strings are unchanged.
 - 2026-11-03: The canonical golangci-lint is now v2.15.0, still built with
  go1.27.0, so the `go` directive rule is unchanged (issue 142). Repositories
  pick this up on their next re-vendor. Each item in the canonical
  `.golangci.yml` was tried on a scratch module. These changed:
    - `canonicalheader` is enabled again, because v2.15.0 fixes the random
      misses behind issue 105.
    - The `depguard` exemption covers only the files directly inside a directory
      whose name ends in `test`. It used to reach every directory below that one
      too. The name of the directory a repository is cloned into no longer
      counts.
    - `gomodguard_v2` also blocks `github.com/go-redis/redis/v9`, whose
      pre-releases can still be imported under that path.
    - `uniq-by-line` is now `false`, so a line that trips two linters reports
      both findings.
    - Three comments are corrected:
        - `exhaustruct` is listed as deprecated.
        - The test double is named `github.com/go-redis/redismock/v9`.
        - The claim that every blocked module is in the Go package defaults is
          gone.
    - A comment says the file has no `formatters` section, so
      `golangci-lint run` does not run `gofmt`.
 - 2026-11-03: A package from the distribution's own package index now needs no
  version and no hash, and pulling that index is allowed
  (https://git.eeqj.de/sneak/prompts/issues/72), on sneak's answer at
  https://git.eeqj.de/sneak/prompts/issues/72#issuecomment-165196. The
  distribution is the pinned base image's in a `Dockerfile` and the host's on a
  host. It is trusted, and everything else stays pinned by hash. A package
  source that a `Dockerfile` adds itself does not get the exception. The pinning
  rule of `REPO_POLICIES.md` and both checklists say so, and the canonical Go
  `Dockerfile`'s `apk add` line has a comment saying why it is allowed.
 - 2026-11-03: A first test run that timed out now gets no verbose rerun
  (https://git.eeqj.de/sneak/prompts/issues/61), on sneak's approval at
  https://git.eeqj.de/sneak/prompts/issues/61#issuecomment-165195. The Go recipe
  in `REPO_POLICIES.md` looks in the first run's output for
  `panic: test timed out` or `*** Test killed`, and exits 1 when either is
  there. The Python `make test` example takes the same `timeout 90 sh -c`
  wrapper as its `Dockerfile` example. The 60 and 90 second rule and the
  5-minute rule now say a hung package uses the backstop once. The Go item in
  both repo checklists now asks for this, so a repository with the old recipe
  fails it.
 - 2026-10-27: Added `prompts/API_POLICIES.md`
  (https://git.eeqj.de/sneak/prompts/issues/137). It holds sneak's rule from
  https://git.eeqj.de/sneak/routewatch/issues/199 that a value in an API
  response is never a string with a label or unit in it. `REPO_POLICIES.md` and
  the code style commands in the README name the new file.
 - 2026-10-21: Check builds may now also keep the Python packages a `test` phase
  installs from `Pipfile.lock` (issue 133), on sneak's ruling in
  https://git.eeqj.de/sneak/rfscan/issues/80#issuecomment-153437. The install
  comes before `ARG CACHEBUST`: `COPY script/ script/`,
  `COPY Pipfile Pipfile.lock ./`, then `RUN script/bootstrap`. In that step
  `script/bootstrap` installs nothing beyond system packages, pipenv and its
  dependencies by hash, and the packages from the lockfile. It installs no
  Python, because the tests use the base image's. `--deploy` installs only what
  the lockfile names, checks every package against its hashes, and fails when
  the lockfile is out of date with `Pipfile`. A kept layer holds nothing a new
  install would refuse. A package built from source and the system packages may
  differ in a new install. As with Go's modules, the packages are kept in a
  layer, not a cache mount. The tests still run after `ARG CACHEBUST`, and every
  other stage still installs its Python packages after it. `REPO_POLICIES.md`
  gains a short Python `test` phase example, and both checklists and the README
  state the rule the same way. rfscan picks this up on its next re-vendor.
 - 2026-10-21: The canonical `.golangci.yml` now accepts a local `replace` of
  `github.com/grafana/sobek` in a repository's root `go.mod` (issue 134), for
  homoicon, which keeps a local copy of sobek on sneak's decision in
  https://git.eeqj.de/sneak/homoicon/issues/1759#issuecomment-153261. Every
  other local `replace` is still refused. It is an exclusion rather than a
  `replace-allow-list` entry because gomoddirectives does not check that list
  for a `replace` that points at a local path. homoicon picks this up on its
  next re-vendor.
 - 2026-10-18: Check builds may now also keep Go's downloaded modules,
  golangci-lint's cache and the layers that install system packages (issue 130),
  on sneak's ruling there. In each stage of the canonical Go `Dockerfile`, the
  system-package install and the module download (`COPY go.mod go.sum ./`,
  `RUN go mod download`) come before `ARG CACHEBUST`, so Docker keeps them until
  the base image, the install line, `go.mod` or `go.sum` changes. The modules
  are kept as a layer, not a cache mount, because Go does not check the files in
  a cache mount again. `golangci-lint run` also mounts golangci-lint's cache,
  `/root/.cache/golangci-lint`. Every step that lints, tests or compiles still
  comes after `ARG CACHEBUST` and runs on every check build, and both `go test`
  runs keep `-count=1`. `REPO_POLICIES.md`, both checklists, the Go style guide,
  the README and the script comments state the rule the same way. This repo's
  own `Dockerfile` is unchanged: its `script/bootstrap` step also installs node
  packages, which the ruling does not cover. Repositories pick this up on their
  next re-vendor.
 - 2026-10-15: Check builds now keep Go's build cache between runs (issue 113),
  on sneak's ruling there that Go's compile cache may survive. `script/lint`,
  `script/test`, `script/cibuild` and `script/docker` pass a new `CACHEBUST`
  build argument on every build in place of `--no-cache`, which also emptied the
  cache mounts. Every `Dockerfile` stage declares `ARG CACHEBUST` first, so
  every `RUN` step still runs on every check build. The canonical Go
  `Dockerfile` mounts Go's build cache on the steps that compile and runs both
  `go test` runs with `-count=1`, so no test result is reused. A stage without
  the `ARG` line is served from cache, so repositories re-vendor the scripts and
  the `ARG` lines in one commit. Not yet tried on the shared runner.
 - 2026-10-08: The canonical `script/bootstrap` now uses the installed node only
  when its major version is the pinned one (issue 118). Otherwise, as when node
  is missing, it installs the pinned node under nvm and installs yarn and the
  packages under it. It prints the version of the node it uses either way. The
  CI runner image ships node 24, under which the pinned yarn 1.22.22 printed the
  deprecation warning DEP0169 on every bootstrap. Only the major is compared
  because the `Dockerfile` stages start from a node 22 alpine image whose exact
  version is not the pin, and nvm cannot install a prebuilt node on alpine; the
  version-comparison rule in `REPO_POLICIES.md` names node as its exception.
  `script/fmt` and `script/fmt-check` pick their yarn with the same test: the
  `yarn` on `PATH` when the installed node is the pinned major, and otherwise
  yarn under the pinned node through nvm. `REPO_POLICIES.md` and both checklists
  say so, and the checklists' final `script/cibuild` check names what the CI
  runner image has: node 24 and no yarn. Not yet tried on the shared runner.
  Repositories pick this up on their next re-vendor.
 - 2026-10-07: The `script/cibuild` item in `NEW_REPO_CHECKLIST.md` now matches
  the canonical `script/cibuild` (issue 125). Its image build carries the tag,
  `-t "$tag"`, and the item says that `$version` comes from
  `git describe --tags --always --dirty` (`unknown` if empty) and `$tag` from
  `script/projectname`, each assigned on its own line before the build. A
  repository written from the checklist got an untagged build, which leaves a
  dangling image behind on every run, and was never told where `$version` comes
  from. The other `docker build` commands the checklists and `REPO_POLICIES.md`
  give for `script/` already matched their scripts.
 - 2026-10-07: `script/lint` and `script/test` now build with
  `--output type=cacheonly` in place of a tag (issue 123), so they still run
  their phase uncached and fail on a failing step but write no image. Nothing
  used those images, and writing one out cost about 16 seconds of a Go
  repository's test build. `script/cibuild` and `script/docker` keep their tags.
  `REPO_POLICIES.md`, both checklists and the README no longer say the gate
  builds are tagged. Not yet tried on the shared runner. Repositories pick this
  up on their next re-vendor.
 - 2026-10-07: The canonical `.gitea/workflows/check.yml` now sets
  `timeout-minutes: 20` on its `check` job (issue 120), so a hung build frees
  the shared runner instead of holding it until the runner's own limit.
  `script/cibuild` runs three Docker builds, each held to the 5-minute Docker
  build limit, plus the bootstrap; if that limit changes (issue 113), the value
  follows it. `REPO_POLICIES.md` and both checklists name the limit among what
  the workflow sets. Not yet tried on the shared runner. Repositories pick this
  up on their next re-vendor.
 - 2026-10-07: The canonical `package.json` now has `"private": true` in place of
  `"license": "MIT"` (issue 119), so a repository that copies it no longer
  declares MIT whatever its own licence is. yarn does not print "No license
  field" for a private package. This repository's own licence is unchanged.
 - 2026-10-06: The canonical `.gitea/workflows/check.yml` now sets
  `fetch-depth: 0` on its checkout step (issue 110), so CI fetches the history
  and tags that `git describe --tags --always` needs, and a tagged repository
  stamps the same version in CI as in a local build. `REPO_POLICIES.md` and both
  checklists name `fetch-depth: 0` among what the workflow does, next to
  `persist-credentials: false` and the `concurrency` block, instead of asking
  each tagged repository to add it. Not yet tried on the shared runner, which is
  out of disk space. Repositories pick this up on their next re-vendor.
 - 2026-10-06: The canonical `script/bootstrap` now runs `apt-get update` once,
  before the first `apt-get install` of a run (issue 115). The Gitea runner
  image starts with empty package lists, so installing anything it lacks, such
  as Go, failed with `Unable to locate package`. A repository's own section no
  longer needs a refresh of its own; `sneak/bsfirehose` and `sneak/dnswatcher`
  drop theirs at their next re-vendor.
 - 2026-10-06: `REPO_POLICIES.md` and both checklists now say that a checkout
  whose `.git` is a file, a linked worktree or a repository checked out as a
  submodule, is the exception to a plain `docker build .` succeeding (issue
  111): that file points to a git directory outside the build context, so the
  build cannot read the version and the version check in the canonical
  `Dockerfile` stops it. Such a build is given its version with
  `--build-arg VERSION=...`, as `script/docker` and `script/cibuild` already do.
  The check itself is unchanged.
 - 2026-10-06: The canonical `.gitea/workflows/check.yml` now has a `concurrency`
  block, so a new push cancels the older run on the same branch and no other,
  and its checkout step sets `persist-credentials: false`, so the job's token is
  not left in `.git/config` (issue 107). `REPO_POLICIES.md` and both checklists
  describe the workflow as it now is. Not yet tried on the shared runner, which
  is out of disk space. Repositories pick this up on their next re-vendor.
 - 2026-10-06: The canonical `.golangci.yml` now disables `canonicalheader`
  (issue 105). In golangci-lint v2.14.0 it misses findings at random in a
  package that also calls `ResponseWriter.Header()`, so the same tree can fail
  lint on one run and pass on the next. It comes back once a pinned
  golangci-lint release fixes it.
 - 2026-10-06: The canonical `.gitignore` and `.editorconfig` now each end with a
  comment saying the repository's own entries go below it and a re-vendor keeps
  them (issue 103, which took in issue 104), as `.dockerignore`'s header already
  does. `.editorconfig` gains a `[*.go]` section with tabs, since `gofmt`
  decides Go indentation everywhere. `REPO_POLICIES.md` and both checklists say
  that each of these two files is the canonical content followed by the
  repository's own entries, which a re-vendor keeps, and the Go styleguide puts
  `*.log`, `*.out`, `*.test` and binaries among those entries. Common outputs
  stay out of the canonical `.gitignore`; each repository lists its own.
 - 2026-10-05: `script/cibuild`, `script/docker`, `script/lint` and `script/test`
  now assign the image tag from `script/projectname` on its own line before the
  `docker build` (issue 101), so `set -e` stops the script where
  `script/projectname` fails instead of running `docker build` with a broken
  tag. The comment above it in each script says why, and the snippets in
  `REPO_POLICIES.md` show the same form. Repositories pick this up on their next
  re-vendor.
 - 2026-10-04: Went through the fleet findings recorded on 2026-08-09 (issue 62)
  and added the two rules `REPO_POLICIES.md` did not yet state: a new or changed
  check is proven by planting a defect it must catch; and a change to a separate
  workflow limited to `main` is first run from the feature branch, added to that
  workflow's `branches` list and removed again before merging. The other
  findings were already stated, replaced by `--no-cache`, about git worktrees,
  or about how agents work together. The warning against
  `golangci-lint config verify` is dropped because sneak ruled on
  https://git.eeqj.de/sneak/prompts/issues/40 (2026-08-10) that there is no
  config check step and the config is assumed valid; a vendored `.golangci.yml`
  stays byte-identical to the canonical copy. The issue gives each reason.
 - 2026-10-04: `REPO_POLICIES.md` now says which `Dockerfile` stages run
  `script/bootstrap` (issue 90). The gate phases and the build stage start from
  their pinned base images and install what those images lack either inline, as
  the canonical Go `Dockerfile` does for `git`, or by running
  `script/bootstrap`, as this repo's own `Dockerfile` does for its yarn
  packages. The development environment stage, the final stage of a non-server
  repo, runs `script/bootstrap`. The new repo checklist says the same.
 - 2026-10-04: Added a root `.gitattributes` that merges `TODO.md` with git's
  union merge (issue 98), so two branches that each add an entry at the top of
  Completed Steps merge without a conflict. Git now never reports a conflict in
  `TODO.md`: a real conflict elsewhere keeps both versions of the line, and when
  two new entries share an identical line, one is inserted into the middle of
  the other, which a rebase can do to an entry already on `next`. Read the
  merged entries after every merge or rebase. This applies to this repository
  only; no canonical file changed.
 - 2026-10-04: The canonical `.dockerignore` now also keeps out the git `config`
  of a submodule that keeps its own `.git` directory, which still reached the
  image (issue 88): both git patterns now carry the `**/` prefix. A submodule
  whose name has a `config` segment (`config`, `deploy/config`, `config/lib`)
  still loses its whole git directory, so Go's version stamping fails the build;
  the file records this as a `KNOWN GAP:` with the remedy,
  `git submodule add --name`. Closing it would take a wildcard re-include, which
  makes BuildKit walk every excluded directory, such as `node_modules`, on every
  build. `REPO_POLICIES.md` and both checklists say so in the same words.
 - 2026-10-04: The note under the canonical Go `Dockerfile` example in
  `REPO_POLICIES.md` now installs lint-phase system libraries with `apt-get`
  under their Debian package names (issue 83). The `golangci/golangci-lint`
  image is Debian-based and has no `apk`, so the old `apk add` instruction
  failed as written. Nothing is pinned or unpinned; that is still open on
  issue 72.
 - 2026-10-04: Fixed the server lifecycle example in
  `prompts/GO_HTTP_SERVER_CONVENTIONS.md` (issue 86). Only fx handles SIGINT and
  SIGTERM, and `Run()` in `main` exits with the shutdown's exit code. A listen
  error asks fx to shut down with exit code 1 through `fx.Shutdowner`; a Sentry
  start failure is returned from the server's start hook instead of calling
  `os.Exit` from a goroutine, so the stop hooks of what had started still run.
  The server's stop hook shuts the HTTP server down within 5 seconds and fails
  when requests are still running. A new paragraph says who owns signals and the
  exit code.
 - 2026-10-04: `REPO_POLICIES.md` now says how a Go tool a repo needs on the host
  is pinned (issue 37): installed with `go install` pinned to a commit hash,
  never tracked as a `go.mod` tool dependency or through a `tools.go` file.
  golangci-lint is unaffected, since no repo installs it on the host.
 - 2026-10-04: The canonical `.gitignore` and `.dockerignore` now also keep out
  `id_ecdsa_sk` and `id_ed25519_sk`, the private key files `ssh-keygen` writes
  for keys backed by a hardware security key (issue 81). Their `.pub` halves
  stay trackable.
 - 2026-10-04: `package.json` now has `"license": "MIT"`, matching `LICENSE`, so
  yarn no longer prints "No license field" when `script/bootstrap` runs it
  inside the Docker phases (issue 76). That was the only yarn warning there.
 - 2026-10-04: `REPO_POLICIES.md` now states that guidance for coding agents
  lives in one `AGENTS.md` at the repository root, never under a file or
  directory named after one agent tool and never in separate memory files (issue
  31). This retires the rule, still present in older vendored copies, that kept
  agent memory as committed files under `.claude/memory/`. `AGENTS.md` joins the
  list of files allowed in the root, and both checklists say so.
 - 2026-10-04: Rewrote the note under the canonical Go `make test` example in
  `REPO_POLICIES.md` (issue 77), which still named the cache-busting build
  argument that `--no-cache` replaced. It now says where Go's test result cache
  can replay a pass: on a developer's machine, where the Makefile target runs,
  and not in the `test` phase of the `Dockerfile`, whose base image and earlier
  steps hold no result for the repo's tests.
 - 2026-10-04: The Makefile examples in the Go styleguide and the HTTP server
  conventions now fall back to `dev` when `git describe` prints nothing (outside
  a git checkout, or where git is missing or refuses the checkout), instead of
  stamping an empty version (issue 74). The canonical `Dockerfile` already fails
  on a `dev` version when `.git` is in the build context.
 - 2026-10-04: The canonical `.dockerignore` now also keeps out each submodule's
  `config` (issue 75). A submodule's git directory lives under `.git/modules/`,
  nested again for its own submodules, and its `config` can hold a credential
  just like `.git/config`. The pattern `.git/modules/**/config` covers every
  depth and leaves the top-level `.git` that `git describe` reads untouched.
  `REPO_POLICIES.md` and both checklists say so in the same words.
 - 2026-10-03: Fixed two defects in the canonical Go `Dockerfile` example (issue
  73). The test phase now uses the Debian Go image, since `-race` needs cgo and
  the alpine image has no C compiler, so the phase failed before running a test.
  The stage that compiles runs `git config --system --add safe.directory /src`,
  because a context sent as a tar stream keeps the sender's file owners and git
  refuses that checkout, leaving the version empty. Both checklists state that
  step in the same words.
 - 2026-10-03: Moved the canonical golangci-lint to v2.14.0, built with go1.27,
  because v2.12.2 refuses to lint a module whose `go` directive is 1.27 (issue
  65). Releases from v2.13.0 deprecate `exhaustruct` in favour of
  `exhaustruct_v5`, which `default: all` switches on, so the canonical
  `.golangci.yml` now disables `exhaustruct_v5` beside `exhaustruct`. v2.12.2
  rejects that file, so `REPO_POLICIES.md` and both repo checklists now say a
  repo sets the lint phase digest and re-vendors `.golangci.yml` in one commit.
 - 2026-10-03: Brought the canonical `.gitignore` level with `.dockerignore` on
  secrets (issue 38): it now also ignores `prod.env`-style `*.env` files,
  `.envrc`, `*.p12`, `*.pfx` and the extensionless SSH private keys, written to
  `.gitignore`'s own rules (no `**/` prefix) and case-folded with character
  ranges. `example.env` and `sample.env` stay trackable through negations.
 - 2026-10-02: The image version now comes from git inside the build (issues 69
  and 71), superseding the 2026-09-08 entry that excluded `.git`. The canonical
  `.dockerignore` sends `.git` but keeps out `.git/config`, which can hold a
  credential. The Dockerfile example in `REPO_POLICIES.md` installs `git`, takes
  the `VERSION` build argument when one is given and otherwise
  `git describe --tags --always`, and fails when `.git` exists but the version
  is empty, `dev` or `unknown`; a plain `docker build .` with no build arguments
  must succeed. This repo's `script/docker` and `script/cibuild` still pass
  `--build-arg VERSION`, since its own `Dockerfile` compiles nothing.
 - 2026-09-08: Moved linting and testing into Docker as phases of the main
  `Dockerfile`, per the owner ruling on issue 40. `script/lint` and
  `script/test` build one phase each by name with `--no-cache` — the same answer
  issue 26 got, so no separate cache-busting mechanism survives — and the final
  stage copies a harmless file from both, so the image cannot be built unless
  they pass. This also closes issue 30: a container has its own result cache and
  its own lock, so a lint verdict can no longer belong to another checkout. No
  separate lint Dockerfile, and no `golangci-lint config verify` step.
  `script/check` runs the gates and nothing else, and `script/cibuild`
  bootstraps first, since it is all CI runs and `script/fmt-check` is native.
 - 2026-09-08: Kept in-repo agent scratch out of the Docker build context and out
  of version control: `.claude/` is one full checkout of the repo per in-flight
  agent, and under `COPY . .` all of it was reaching the image. Also closed the
  consequence of excluding `.git` — `git describe` yields an empty version
  inside a build stage without failing, so `script/docker` and `script/cibuild`
  now compute the version on the host and pass `--build-arg VERSION`.
 - 2026-09-08: Closed the secret exposure in the canonical `.dockerignore`: a
  local `.env`, `*.pem` or `*.key` was reaching the build context under
  `COPY . .`, invisible to every git-based check. The patterns are now written
  to `.dockerignore`'s own semantics — `**/`-prefixed so they hold at every
  depth, case-folded with character ranges — and `REPO_POLICIES.md` requires
  verifying by enumerating the image rather than by reading the file.
 - 2026-09-08: Made a pinned tool in `script/bootstrap` actually reach the host.
  `REPO_POLICIES.md` now requires comparing the installed version against the
  pin rather than testing `PATH` presence, and re-resolving the binary through
  `PATH` after installing, so a version bump cannot be a silent no-op and a
  shadowed install cannot report success.
 - 2026-09-08: Closed the false green in the canonical CI gate: `script/cibuild`
  and `script/docker` now build with `--no-cache`, so the Dockerfile's check
  layers cannot be served from cache on an unchanged tree, and the text claiming
  a bare `docker build .` proves the checks ran is corrected in
  `REPO_POLICIES.md`, both checklists and the Go styleguide.
 - 2026-09-03: Added `-count=1` to both `go test` invocations in the canonical Go
  `make test` example in `REPO_POLICIES.md`, so the target cannot report a
  cached pass it did not earn, and documented that Go's test-result cache is a
  second, independent cache stacked below the Docker layer cache.
 - 2026-08-31: Migrated the canonical `.golangci.yml` from the deprecated
  `gomodguard` to `gomodguard_v2`: the old linter is disabled by name (which is
  what silences the deprecation warning), the successor is named explicitly in
  `linters.enable`, and it carries a `blocked` module list drawn only from
  decisions already recorded in the Go package defaults.
 - 2026-08-07: Set the canonical `.golangci.yml` to the org-standard v2-schema
  config already deployed byte-identical across the org's Go repos (settings
  under `linters.settings` so thresholds like lll/funlen/cyclop/dupl actually
  apply under golangci-lint v2). Recorded the canonical golangci-lint version
  (v2.12.2, commit-pinned) in REPO_POLICIES.md.
 - 2026-03-20: Strengthened constructor naming and Params struct rules in the Go
  styleguide.
 - 2026-03-18: Documented fail-fast Dockerfile lint stage and conditional -v test
  rerun patterns in REPO_POLICIES.md.
 - 2026-03-11: Added HTTP service hardening policy for 1.0 releases.
 - 2026-03-10: Added policy: no build artifacts in repos.
 - 2026-03-04: Added LLM prose tells reference and copyediting checklist, then
  several self-applied revision passes.
 - 2026-02-28: Expanded the pre-1.0 schema migration rule; added clawpub
  reference.
 - 2026-02-23: Added Go style rules (no type-only packages, Stringer for
  string-based types); template repos section in README.
 - 2026-02-22: Initial policy corpus: REPO_POLICIES.md, code styleguides
  (general, Go, JS, Python), repo checklists, CI policy, hash pinning, Go HTTP
  server conventions, repo scaffolding.
 # Future Steps
 - Finish, format, and commit FIXUP_CLEAN.md and FIXUP_REPORT.md (the Next Step).
 - Commit this TODO.md at the repo root; it is the last missing policy file.
 - Decide the fate of untracked resume.sh: commit it or delete it.
 - Add more prompt templates for common development tasks (from README TODO).
@@ -1,6 +1,6 @@
 ---
 title: Existing Repo Checklist
-last_modified: 2026-11-11
+last_modified: 2026-11-09
 ---
 Use this checklist when beginning work in a repo that may not yet conform to our
@@ -205,30 +205,21 @@ with your task.
 - [ ] `Makefile` exists in root — reference
      `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`
 - [ ] Has targets: `test`, `lint`, `fmt`, `fmt-check`, `check`, `docker`,
-      `hooks`, `commit-upstream-policy-files`
+      `hooks`, `update-policy`
 - [ ] Target implementations live in `script/` (scripts-to-rule-them-all);
      Makefile targets are thin shims calling them — model scripts at
      `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`
 - [ ] `script/precommit` exists and the pre-commit hook (installed by
      `script/install-precommit`, shimmed by `make hooks`) runs it
- [ ] `script/write-upstream-policy-files` and
+- [ ] `script/update-policy` exists, identical to the model script, and
-      `script/commit-upstream-policy-files` exist, identical to the model
+      `make update-policy` shims to it. Before its first use, the repo's own
-      scripts, and `make commit-upstream-policy-files` shims to
+      entries in `.gitignore`, `.editorconfig` and `.dockerignore` go below the
-      `script/commit-upstream-policy-files`. `make commit-upstream-policy-files`
+      comment that ends each canonical file. An entry above that comment which
-      commits without pushing, so a person reviews and pushes the commit. A
+      the canonical file has never held makes the script stop before it writes
-      `.gitignore` or `.dockerignore` without the comment that ends the
+      anything, naming the file and the entry. It stops the same way on a line
-      canonical file needs no preparation. The script moves each line the
+      in `.golangci.yml` that the canonical file has never held, apart from
-      canonical file has never held to below the canonical content. Blank lines
+      comments and the repo's entries in the `deny` list of the `test-support`
-      and comments are dropped. Before its first use, add that comment to an
+      rule.
      `.editorconfig` that has lines of its own, and put those lines below it.
      Otherwise the script stops before it writes anything, naming the file and
      each line. In a file that has the comment, an entry above it which the
      canonical file has never held also stops the script. It stops the same way
      on a line in `.golangci.yml` that the canonical file has never held, apart
      from comments and the repo's entries in the `deny` list of the
      `test-support` rule. It also stops on a repo's own
      `script/write-upstream-policy-files` or
      `script/commit-upstream-policy-files`.
 - [ ] README has an **Entrypoints** section documenting the `script/`
      entrypoints and linking the standard
 - [ ] `script/lint` and `script/test` each run
@@ -1,6 +1,6 @@
 ---
 title: New Repo Checklist
-last_modified: 2026-11-11
+last_modified: 2026-11-09
 ---
 Use this checklist when creating a new repository from scratch. Follow the steps
@@ -266,13 +266,9 @@ are thin shims calling them. Model scripts:
 - [ ] `script/install-precommit` — installs the pre-commit hook that runs
      `script/precommit`
 - [ ] `make hooks` — shims to `script/install-precommit`
- [ ] `script/write-upstream-policy-files` — fetches the vendored policy files
+- [ ] `script/update-policy` / `make update-policy` — fetches the vendored
-      from the `prompts` repo over HTTP and writes them into the repo; identical
+      policy files from the `prompts` repo, commits them and pushes; identical
      across repos
 - [ ] `script/commit-upstream-policy-files` /
      `make commit-upstream-policy-files` — fetches the current
      `script/write-upstream-policy-files`, runs it on the repo and commits the
      result without pushing; identical across repos
 - [ ] README **Entrypoints** section documents the scripts and links the
      standard
@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-11-11
+last_modified: 2026-11-09
 ---
 This document covers repository structure, tooling, and workflow standards. Code
@@ -93,8 +93,8 @@ style conventions are in separate documents:
    - `make check` (runs `test`, `lint`, `fmt-check`)
    - `make docker`
    - `make hooks` (installs pre-commit hook)
-    - `make commit-upstream-policy-files` (brings the repo up to standards and
+    - `make update-policy` (fetches the vendored policy files, commits and
-      commits)
+      pushes)
    A model Makefile is at
    `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
@@ -111,8 +111,7 @@ style conventions are in separate documents:
    - `script/fmt-check`
    - `script/check`
    - `script/docker`
-    - `script/write-upstream-policy-files`
+    - `script/update-policy`
    - `script/commit-upstream-policy-files`
    The scripts must be POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they
    run in minimal containers; alpine images, for example, have no bash. Locate
@@ -186,19 +185,15 @@ style conventions are in separate documents:
    host. On a pristine checkout with nothing installed, the run dies there,
    after the containerised gates have passed.
-    Six further scripts are our own extensions to the standard:
+    Five further scripts are our own extensions to the standard:
    - `script/check` runs `script/test`, `script/lint` and `script/fmt-check`.
    - `script/precommit` is what the git pre-commit hook runs, and it calls
      `script/check`.
    - `script/install-precommit` installs the git pre-commit hook. The
      `make hooks` target shims to it.
-    - `script/write-upstream-policy-files` fetches the vendored policy files
+    - `script/update-policy` fetches the vendored policy files from the
-      from the `prompts` repo over HTTP and writes them into the repo it is
+      `prompts` repo, commits them and pushes. The `make update-policy` target
-      given, or its own repo with no argument.
+      shims to it.
    - `script/commit-upstream-policy-files` fetches the current
      `script/write-upstream-policy-files` from the `prompts` repo, runs it on
      its own repo and commits the result. It does not push. The
      `make commit-upstream-policy-files` target shims to it.
    - `script/projectname` (literally that filename) simply outputs the
      project's name.
@@ -938,26 +933,14 @@ style conventions are in separate documents:
 - Make all changes on a feature branch. You can do whatever you want on a
  feature branch.
- One command brings a repo up to standards:
+- A repo updates its policy files with one command: `make update-policy`. It
-  `make commit-upstream-policy-files`. It runs
+  runs `script/update-policy`, which fetches each vendored file the repo carries
-  `script/commit-upstream-policy-files`, which fetches the current
+  from the `prompts` repo, commits them and pushes. It uses the head of `main`,
-  `script/write-upstream-policy-files` from the head of `main` in the `prompts`
+  or the commit given by a full hash: `script/update-policy <hash>`. The list of
-  repo and runs it on the repo. It then commits the files that changed and does
+  vendored files is at the top of that script. The script replaces each file and
  not push, so a person reviews and pushes the commit.
    `script/write-upstream-policy-files` fetches each vendored file from
    `prompts` over HTTP and writes it into the repo. It skips a language's files
    when git tracks no source file of that language. A file the repo lacks is
    written whole. A `prompts/NAME.md` goes to `docs/NAME.md`, unless the repo
    keeps it at `NAME.md`. It also writes `script/write-upstream-policy-files`
    and `script/commit-upstream-policy-files` into the repo, so a repo updated
    once can update itself. The list of vendored files is at the top of
    `script/write-upstream-policy-files`. The script replaces each file and
  keeps only the repo's own entries:
    - in `.gitignore`, `.editorconfig` and `.dockerignore`: the lines below the
      comment that ends the canonical file
    - in a `.gitignore` or `.dockerignore` lacking that comment: every entry the
      canonical file has never held
    - in `.golangci.yml`: the entries the repo added to the `deny` list of the
      `test-support` depguard rule
@@ -1186,8 +1169,7 @@ style conventions are in separate documents:
    - `Makefile`
    - `script/` entrypoints (`bootstrap`, `setup`, `projectname`, `test`,
      `lint`, `fmt`, `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
-      `install-precommit`, `write-upstream-policy-files`,
+      `install-precommit`, `update-policy`)
      `commit-upstream-policy-files`)
    - `Dockerfile`, `.dockerignore`
    - `.gitea/workflows/check.yml`
    - Go: `go.mod`, `go.sum`, `.golangci.yml`
@@ -1,45 +0,0 @@
 #!/bin/sh
 # script/commit-upstream-policy-files: bring this repo up to standards.
 # It fetches the current script/write-upstream-policy-files from the
 # prompts repo over HTTP, runs it on this repo and commits the files it
 # wrote. It does not push. Identical in all repos. Our own extension to
 # scripts-to-rule-them-all.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 WRITE_UPSTREAM_POLICY_FILES_URL="https://git.eeqj.de/sneak/prompts/raw/branch/main/script/write-upstream-policy-files"
 die() {
    echo "commit-upstream-policy-files: $*" >&2
    exit 1
 }
 main() {
    [ "$#" -eq 0 ] || die "usage: script/commit-upstream-policy-files"
    cd "$ROOT"
    tmp="$(mktemp -d)"
    trap 'rm -rf "$tmp"' EXIT
    curl --fail --silent --show-error --max-time 60 \
        --output "$tmp/write-upstream-policy-files" \
        "$WRITE_UPSTREAM_POLICY_FILES_URL" ||
        die "cannot fetch $WRITE_UPSTREAM_POLICY_FILES_URL"
    sh "$tmp/write-upstream-policy-files" "$ROOT" > "$tmp/written"
    commit="$(head -n 1 "$tmp/written")"
    paths="$(tail -n +2 "$tmp/written")"
    for path in $paths; do
        git add -- "$path"
    done
    if git diff --cached --quiet -- $paths; then
        echo "commit-upstream-policy-files: already at prompts $commit, nothing to commit"
    else
        git commit -m "Update policy files from prompts $commit" -- $paths
    fi
 }
 main "$@"
@@ -0,0 +1,222 @@
 #!/bin/sh
 # script/update-policy: replace this repo's vendored policy files with
 # the canonical ones from the prompts repo, commit them and push.
 # Identical in all repos. Our own extension to
 # scripts-to-rule-them-all.
 #
 # Usage: script/update-policy [full commit hash of prompts]
 # Without a hash it uses the head of the prompts main branch.
 #
 # The script writes nothing until every file has been fetched and
 # merged. A repo's own entries are kept:
 #   - .gitignore, .editorconfig, .dockerignore: the lines below the
 #     canonical file's last line. An entry above that line which the
 #     canonical file has never held stops the script.
 #   - .golangci.yml: the entries the repo added to the deny list of the
 #     test-support rule. Any other line the canonical file has never
 #     held stops the script, unless it is blank or a comment.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 PROMPTS_URL="https://git.eeqj.de/sneak/prompts"
 # Paths in the prompts repo. A file this repo does not carry is skipped.
 VENDORED_FILES="
 .dockerignore
 .editorconfig
 .gitea/workflows/check.yml
 .gitignore
 .golangci.yml
 .prettierrc
 prompts/API_POLICIES.md
 prompts/CODE_STYLEGUIDE.md
 prompts/CODE_STYLEGUIDE_GO.md
 prompts/CODE_STYLEGUIDE_JS.md
 prompts/CODE_STYLEGUIDE_PYTHON.md
 prompts/EXISTING_REPO_CHECKLIST.md
 prompts/GO_HTTP_SERVER_CONVENTIONS.md
 prompts/LLM_PROSE_TELLS.md
 prompts/NEW_REPO_CHECKLIST.md
 prompts/REPO_POLICIES.md
 "
 die() {
    echo "update-policy: $*" >&2
    exit 1
 }
 # local_path <path in prompts>: print where this repo keeps the file, or
 # nothing if git does not track it here. A prompts/NAME.md lands at
 # docs/NAME.md or NAME.md.
 local_path() {
    name="${1#prompts/}"
    if [ "$name" != "$1" ] && [ -n "$(git ls-files -- "docs/$name")" ]; then
        echo "docs/$name"
    elif [ -n "$(git ls-files -- "$name")" ]; then
        echo "$name"
    fi
 }
 # local_only_lines <fetched> <local> [end]: print each line of the local
 # file, above line end if given, that the canonical file has never held:
 # not in the fetched file or in <fetched>.former, the lines earlier
 # commits removed from it. Blank lines and comments do not count.
 local_only_lines() {
    cat "$1" "$1.former" | awk -v end="${3:-}" '
        NR == FNR { held[$0]; next }
        (end == "" || FNR < end) && !/^[ \t]*(#|$)/ && !($0 in held)
    ' - "$2"
 }
 # keep_lines_below_last <fetched> <local>: append to the fetched file
 # whatever follows its last line in the local file. Stop if the canonical
 # file has never held a line above that one, unless it is blank or a
 # comment: replacing the file would delete it.
 keep_lines_below_last() {
    last="$(tail -n 1 "$1")"
    number="$(grep -n -F -x -- "$last" "$2" | head -n 1 | cut -d: -f1)"
    if [ -z "$last" ] || [ -z "$number" ]; then
        die "$2 lacks this line; add it and put the repo's own entries below it: $last"
    fi
    own="$(local_only_lines "$1" "$2" "$number")"
    if [ -n "$own" ]; then
        die "$2 has entries above its last canonical line that the canonical file lacks; move each below that line to keep it, or delete it:
 $own"
    fi
    tail -n "+$((number + 1))" "$2" >> "$1"
 }
 # keep_deny_entries <fetched> <local>: add to the deny list of the
 # test-support rule in the fetched file the entries only the local file
 # has. An entry is a "- pkg:" line, the lines under it and any comment
 # above it. Stop if the local file still has a line that neither the
 # result nor the canonical file has ever held, unless it is blank or a
 # comment: replacing the file would delete it.
 keep_deny_entries() {
    awk '
        function indent(line) { return match(line, /[^ ]/) - 1 }
        function print_local_entries(i) {
            for (i = 1; i <= count; i++)
                if (!(pkg[i] in fetched_pkg))
                    printf "%s", entry[i]
        }
        FNR == 1 { in_rule = 0; in_list = 0 }
        in_list && /[^ ]/ && indent($0) <= list_indent {
            in_list = 0
            if (FILENAME == ARGV[2]) print_local_entries()
        }
        in_list {
            is_entry = ($1 == "-" && $2 == "pkg:")
            if (FILENAME == ARGV[2]) {
                if (is_entry) fetched_pkg[$3]
                print
            } else if (is_entry) {
                count++
                pkg[count] = $3
                entry[count] = comment $0 "\n"
                comment = ""
            } else if (/^ *#/) {
                comment = comment $0 "\n"
            } else if (count) {
                entry[count] = entry[count] $0 "\n"
            }
            next
        }
        in_rule && /^ *[^ #]/ && indent($0) <= rule_indent { in_rule = 0 }
        /^ *test-support:/ { in_rule = 1; rule_indent = indent($0) }
        in_rule && /^ *deny:/ {
            in_rule = 0
            in_list = 1
            list_indent = indent($0)
            if (FILENAME == ARGV[2]) found = 1
        }
        FILENAME == ARGV[2] { print }
        END {
            if (in_list) print_local_entries()
            exit !found
        }
    ' "$2" "$1" > "$1.merged" ||
        die "the fetched $2 has no deny list in its test-support rule"
    mv "$1.merged" "$1"
    own="$(local_only_lines "$1" "$2")"
    if [ -n "$own" ]; then
        die "$2 has lines the canonical file has never held; only the deny list of the test-support rule may differ from canonical:
 $own"
    fi
 }
 main() {
    cd "$ROOT"
    [ "$#" -le 1 ] || die "usage: script/update-policy [full commit hash]"
    project="$(script/projectname)"
    if [ "$project" = "prompts" ]; then
        die "this repo is the source of the policy files"
    fi
    commit="${1:-}"
    if [ -z "$commit" ]; then
        head_line="$(git ls-remote "$PROMPTS_URL.git" refs/heads/main)"
        commit="${head_line%%[[:space:]]*}"
    fi
    printf '%s\n' "$commit" | grep -Eqx '[0-9a-f]{40}' ||
        die "not a full commit hash: '$commit'"
    tmp="$(mktemp -d)"
    trap 'rm -rf "$tmp"' EXIT
    git clone --quiet --bare "$PROMPTS_URL.git" "$tmp/prompts.git" ||
        die "cannot clone $PROMPTS_URL.git"
    carried=""
    for file in $VENDORED_FILES; do
        path="$(local_path "$file")"
        [ -n "$path" ] || continue
        if [ -n "$(git status --porcelain -- "$path")" ]; then
            die "$path has uncommitted changes"
        fi
        mkdir -p "$tmp/$(dirname "$path")"
        curl --fail --silent --show-error --max-time 60 \
            --output "$tmp/$path" \
            "$PROMPTS_URL/raw/commit/$commit/$file" ||
            die "cannot fetch $file at $commit"
        git -C "$tmp/prompts.git" log -p --format= "$commit" -- "$file" |
            sed -n 's/^-//p' > "$tmp/$path.former"
        carried="$carried $path"
    done
    [ -n "$carried" ] || die "this repo carries none of the vendored files"
    for path in $carried; do
        case "$path" in
            .gitignore | .editorconfig | .dockerignore)
                keep_lines_below_last "$tmp/$path" "$path"
                ;;
            .golangci.yml)
                keep_deny_entries "$tmp/$path" "$path"
                ;;
        esac
    done
    for path in $carried; do
        cp "$tmp/$path" "$path"
        git add -- "$path"
    done
    if git diff --cached --quiet -- $carried; then
        echo "update-policy: already at prompts $commit, nothing to commit"
    else
        git commit -m "Update policy files from prompts $commit" -- $carried
    fi
    # Also pushes when there was nothing to commit, so a run after a
    # failed push delivers the commit that push left behind.
    git push origin HEAD || die "push failed; fix that and run this again"
 }
 main "$@"
@@ -1,302 +0,0 @@
 #!/bin/sh
 # script/write-upstream-policy-files: write the current policy files
 # from the prompts repo into a repo clone, over HTTP. It commits
 # nothing; script/commit-upstream-policy-files does that. Identical in
 # all repos. Our own extension to scripts-to-rule-them-all.
 #
 # Usage: script/write-upstream-policy-files [path of a repo clone]
 # Without a path it updates the repo this script sits in.
 #
 # Standard output is the full hash of the prompts commit, then each path
 # written, one per line. Messages go to standard error.
 #
 # The script writes nothing until every file has been fetched and
 # merged. A repo's own entries are kept:
 #   - .gitignore, .editorconfig, .dockerignore: the lines below the
 #     canonical file's last line. An entry above that line which the
 #     canonical file has never held stops the script.
 #   - .gitignore, .dockerignore lacking that last line: each line the
 #     canonical file has never held, unless it is blank or a comment,
 #     goes below the canonical content.
 #   - .editorconfig lacking that last line: it is replaced if it has no
 #     such line. Otherwise the script stops, because a setting means
 #     nothing away from its section.
 #   - .golangci.yml: the entries the repo added to the deny list of the
 #     test-support rule. Any other line the canonical file has never
 #     held stops the script, unless it is blank or a comment.
 set -eu
 PROMPTS_URL="https://git.eeqj.de/sneak/prompts"
 PROMPTS_API_URL="https://git.eeqj.de/api/v1/repos/sneak/prompts"
 PROMPTS_FIRST_COMMIT="af257bef63f162a681bddc80d9b941c47a44b748"
 # Paths in the prompts repo. Every repo gets each file, written whole if
 # the repo lacks it. A language's files are skipped when git tracks no
 # source file of that language.
 VENDORED_FILES="
 .dockerignore
 .editorconfig
 .gitea/workflows/check.yml
 .gitignore
 .golangci.yml
 .prettierrc
 prompts/API_POLICIES.md
 prompts/CODE_STYLEGUIDE.md
 prompts/CODE_STYLEGUIDE_GO.md
 prompts/CODE_STYLEGUIDE_JS.md
 prompts/CODE_STYLEGUIDE_PYTHON.md
 prompts/EXISTING_REPO_CHECKLIST.md
 prompts/GO_HTTP_SERVER_CONVENTIONS.md
 prompts/LLM_PROSE_TELLS.md
 prompts/NEW_REPO_CHECKLIST.md
 prompts/REPO_POLICIES.md
 script/write-upstream-policy-files
 script/commit-upstream-policy-files
 "
 die() {
    echo "write-upstream-policy-files: $*" >&2
    exit 1
 }
 # fetch <url> <output file>
 fetch() {
    curl --fail --silent --show-error --max-time 60 --output "$2" "$1" ||
        die "cannot fetch $1"
 }
 # file_applies <path in prompts>: fail if the file is for a language of
 # which git tracks no source file in the target repo.
 file_applies() {
    case "$1" in
        .golangci.yml | prompts/CODE_STYLEGUIDE_GO.md | \
            prompts/GO_HTTP_SERVER_CONVENTIONS.md)
            [ -n "$(git ls-files -- '*.go')" ]
            ;;
        prompts/CODE_STYLEGUIDE_JS.md)
            [ -n "$(git ls-files -- '*.js' '*.mjs' '*.ts')" ]
            ;;
        prompts/CODE_STYLEGUIDE_PYTHON.md)
            [ -n "$(git ls-files -- '*.py')" ]
            ;;
    esac
 }
 # local_path <path in prompts>: print where the file goes in the target
 # repo. A prompts/NAME.md stays at NAME.md if git tracks it there and not
 # at docs/NAME.md; otherwise it goes to docs/NAME.md. Any other file goes
 # to its own path.
 local_path() {
    name="${1#prompts/}"
    if [ "$name" = "$1" ]; then
        echo "$1"
    elif [ -z "$(git ls-files -- "docs/$name")" ] &&
        [ -n "$(git ls-files -- "$name")" ]; then
        echo "$name"
    else
        echo "docs/$name"
    fi
 }
 # former_lines <patch> <path in prompts>: print the lines earlier commits
 # removed from the file. The file's section of the patch ends at the
 # next diff or the next commit.
 former_lines() {
    awk -v header="diff --git a/$2 b/$2" '
        /^diff --git / { inside = ($0 == header); next }
        /^From / { inside = 0; next }
        inside && /^-/ { print substr($0, 2) }
    ' "$1"
 }
 # local_only_lines <fetched> <local> [end]: print each line of the local
 # file, above line end if given, that the canonical file has never held:
 # not in the fetched file or in <fetched>.former, the lines earlier
 # commits removed from it. Blank lines and comments do not count.
 local_only_lines() {
    cat "$1" "$1.former" | awk -v end="${3:-}" '
        NR == FNR { held[$0]; next }
        (end == "" || FNR < end) && !/^[ \t]*(#|$)/ && !($0 in held)
    ' - "$2"
 }
 # keep_lines_below_last <fetched> <local>: append to the fetched file
 # whatever follows its last line in the local file. Stop if the canonical
 # file has never held a line above that one, unless it is blank or a
 # comment: replacing the file would delete it. If the local file lacks
 # that last line, append each line the canonical file has never held,
 # unless it is blank or a comment. An .editorconfig with such a line
 # stops the script instead, because a setting means nothing away from
 # its section.
 keep_lines_below_last() {
    last="$(tail -n 1 "$1")"
    number="$(grep -n -F -x -- "$last" "$2" | head -n 1 | cut -d: -f1)"
    if [ -z "$last" ] || [ -z "$number" ]; then
        own="$(local_only_lines "$1" "$2")"
        [ -n "$own" ] || return 0
        if [ "$2" = .editorconfig ]; then
            die "$2 lacks this line and has lines the canonical file has never held; add it and put those lines below it: $last
 $own"
        fi
        printf '%s\n' "$own" >> "$1"
        return 0
    fi
    own="$(local_only_lines "$1" "$2" "$number")"
    if [ -n "$own" ]; then
        die "$2 has entries above its last canonical line that the canonical file lacks; move each below that line to keep it, or delete it:
 $own"
    fi
    tail -n "+$((number + 1))" "$2" >> "$1"
 }
 # keep_deny_entries <fetched> <local>: add to the deny list of the
 # test-support rule in the fetched file the entries only the local file
 # has. An entry is a "- pkg:" line, the lines under it and any comment
 # above it. Stop if the local file still has a line that neither the
 # result nor the canonical file has ever held, unless it is blank or a
 # comment: replacing the file would delete it.
 keep_deny_entries() {
    awk '
        function indent(line) { return match(line, /[^ ]/) - 1 }
        function print_local_entries(i) {
            for (i = 1; i <= count; i++)
                if (!(pkg[i] in fetched_pkg))
                    printf "%s", entry[i]
        }
        FNR == 1 { in_rule = 0; in_list = 0 }
        in_list && /[^ ]/ && indent($0) <= list_indent {
            in_list = 0
            if (FILENAME == ARGV[2]) print_local_entries()
        }
        in_list {
            is_entry = ($1 == "-" && $2 == "pkg:")
            if (FILENAME == ARGV[2]) {
                if (is_entry) fetched_pkg[$3]
                print
            } else if (is_entry) {
                count++
                pkg[count] = $3
                entry[count] = comment $0 "\n"
                comment = ""
            } else if (/^ *#/) {
                comment = comment $0 "\n"
            } else if (count) {
                entry[count] = entry[count] $0 "\n"
            }
            next
        }
        in_rule && /^ *[^ #]/ && indent($0) <= rule_indent { in_rule = 0 }
        /^ *test-support:/ { in_rule = 1; rule_indent = indent($0) }
        in_rule && /^ *deny:/ {
            in_rule = 0
            in_list = 1
            list_indent = indent($0)
            if (FILENAME == ARGV[2]) found = 1
        }
        FILENAME == ARGV[2] { print }
        END {
            if (in_list) print_local_entries()
            exit !found
        }
    ' "$2" "$1" > "$1.merged" ||
        die "the fetched $2 has no deny list in its test-support rule"
    mv "$1.merged" "$1"
    own="$(local_only_lines "$1" "$2")"
    if [ -n "$own" ]; then
        die "$2 has lines the canonical file has never held; only the deny list of the test-support rule may differ from canonical:
 $own"
    fi
 }
 # stop_on_own_script <fetched> <local>: stop if the local script has a
 # line the canonical file has never held, unless it is blank or a
 # comment: the repo wrote that script itself, and replacing it would
 # delete it.
 stop_on_own_script() {
    own="$(local_only_lines "$1" "$2")"
    if [ -n "$own" ]; then
        die "$2 has lines the canonical file has never held; rename the repo's own script to keep it:
 $own"
    fi
 }
 main() {
    [ "$#" -le 1 ] ||
        die "usage: script/write-upstream-policy-files [path of a repo clone]"
    target="${1:-$(dirname "$0")/..}"
    cd "$target" || die "no such directory: $target"
    if [ "$(git rev-parse --show-toplevel 2> /dev/null)" != "$(pwd -P)" ]; then
        die "not the top of a git clone: $target"
    fi
    if [ -e prompts/REPO_POLICIES.md ]; then
        die "this repo is the source of the policy files"
    fi
    tmp="$(mktemp -d)"
    trap 'rm -rf "$tmp"' EXIT
    fetch "$PROMPTS_API_URL/branches/main" "$tmp/branch.json"
    commit="$(grep -Eo '"id":"[0-9a-f]{40}"' "$tmp/branch.json" |
        head -n 1 | cut -d'"' -f4)"
    [ -n "$commit" ] || die "no commit hash in $PROMPTS_API_URL/branches/main"
    fetch "$PROMPTS_URL/compare/$PROMPTS_FIRST_COMMIT...$commit.patch" \
        "$tmp/history.patch"
    to_write=""
    for file in $VENDORED_FILES; do
        file_applies "$file" || continue
        path="$(local_path "$file")"
        if git check-ignore -q -- "$path"; then
            die "$path is ignored by git; stop ignoring it"
        fi
        if [ -n "$(git status --porcelain -- "$path")" ]; then
            die "$path has uncommitted changes"
        fi
        mkdir -p "$tmp/$(dirname "$path")"
        fetch "$PROMPTS_URL/raw/commit/$commit/$file" "$tmp/$path"
        former_lines "$tmp/history.patch" "$file" > "$tmp/$path.former"
        to_write="$to_write $path"
    done
    for path in $to_write; do
        [ -e "$path" ] || continue
        case "$path" in
            .gitignore | .editorconfig | .dockerignore)
                keep_lines_below_last "$tmp/$path" "$path"
                ;;
            .golangci.yml)
                keep_deny_entries "$tmp/$path" "$path"
                ;;
            script/*)
                stop_on_own_script "$tmp/$path" "$path"
                ;;
        esac
    done
    echo "$commit"
    for path in $to_write; do
        mkdir -p "$(dirname "$path")"
        case "$path" in
            script/*)
                # A new name and mv, because the script running may be
                # script/commit-upstream-policy-files.
                cp "$tmp/$path" "$path.new"
                chmod 755 "$path.new"
                mv "$path.new" "$path"
                ;;
            *)
                cp "$tmp/$path" "$path"
                ;;
        esac
        echo "$path"
    done
 }
 main "$@"
@@ -1,922 +0,0 @@
 #!/bin/sh
 # test/commit-upstream-policy-files.sh: test
 # script/write-upstream-policy-files and script/commit-upstream-policy-files
 # on throwaway repos. Each scenario gets one temp directory holding a
 # repo, its local bare origin, a local git repository of the canonical
 # files in place of prompts, and a stub curl that serves them, so nothing
 # touches the network.
 set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd -P)/script"
 WRITE_UPSTREAM_POLICY_FILES="$SCRIPT_DIR/write-upstream-policy-files"
 COMMIT_UPSTREAM_POLICY_FILES="$SCRIPT_DIR/commit-upstream-policy-files"
 dir=""
 trap 'rm -rf "$dir"' EXIT
 fail() {
    echo "FAIL: $scenario: $*" >&2
    cat "$dir/output" >&2
    exit 1
 }
 # The stub stops with curl's HTTP error status on any URL containing
 # FAIL_URL, and answers with no commit hash when BAD_BRANCH_JSON is set.
 write_stub_curl() {
    mkdir "$dir/bin"
    cat > "$dir/bin/curl" << 'EOF'
 #!/bin/sh
 previous=""
 fail_flag=""
 for argument in "$@"; do
    [ "$previous" = "--output" ] && output="$argument"
    [ "$argument" = "--fail" ] && fail_flag=yes
    previous="$argument"
 done
 url="$previous"
 canonical="$(dirname "$0")/../canonical"
 site="https://git.eeqj.de/sneak/prompts"
 first="af257bef63f162a681bddc80d9b941c47a44b748"
 not_found() {
    [ -n "$fail_flag" ] && exit 22
    echo "404 page not found" > "$output"
    exit 0
 }
 serve_file() {
    [ -f "$canonical/$1" ] || not_found
    cat "$canonical/$1" > "$output"
 }
 case "$url" in
    *"${FAIL_URL:-no url contains this}"*)
        not_found
        ;;
    "https://git.eeqj.de/api/v1/repos/sneak/prompts/branches/main")
        if [ -n "${BAD_BRANCH_JSON:-}" ]; then
            echo '{"message":"no such branch"}' > "$output"
        else
            printf '{"name":"main","commit":{"id":"%s"},"x":{"id":"%s"}}\n' \
                "$HASH" 0000000000000000000000000000000000000000 > "$output"
        fi
        ;;
    "$site/raw/branch/main/script/write-upstream-policy-files")
        serve_file script/write-upstream-policy-files
        ;;
    "$site/compare/$first...$HASH.patch")
        git -C "$canonical" format-patch --stdout --root "$HASH" > "$output"
        ;;
    "$site/raw/commit/$HASH/"*)
        serve_file "${url#"$site/raw/commit/$HASH/"}"
        ;;
    *)
        not_found
        ;;
 esac
 EOF
    chmod +x "$dir/bin/curl"
 }
 write_canonical_files() {
    mkdir -p "$dir/canonical/prompts" "$dir/canonical/script"
    cp "$WRITE_UPSTREAM_POLICY_FILES" "$COMMIT_UPSTREAM_POLICY_FILES" \
        "$dir/canonical/script/"
    cat > "$dir/canonical/.gitignore" << 'EOF'
 *.log
 *.tmp
 # Own entries go below this comment.
 EOF
    cat > "$dir/canonical/.dockerignore" << 'EOF'
 **/*.log
 **/*.tmp
 # Own entries go below this comment.
 EOF
    cat > "$dir/canonical/.editorconfig" << 'EOF'
 root = true
 [*]
 indent_size = 4
 # Own sections go below this comment.
 EOF
    cat > "$dir/canonical/.golangci.yml" << 'EOF'
 linters:
  settings:
    depguard:
      rules:
        test-support:
          deny:
            - pkg: net/http/httptest
              desc: canonical
            - pkg: net/http/cgi
              desc: added canonically
        other:
          deny:
            - pkg: example.com/other
 EOF
    echo '{ "tabWidth": 4 }' > "$dir/canonical/.prettierrc"
    echo "new policy" > "$dir/canonical/prompts/REPO_POLICIES.md"
    echo "new api policy" > "$dir/canonical/prompts/API_POLICIES.md"
    for name in CODE_STYLEGUIDE CODE_STYLEGUIDE_GO CODE_STYLEGUIDE_JS \
        CODE_STYLEGUIDE_PYTHON EXISTING_REPO_CHECKLIST \
        GO_HTTP_SERVER_CONVENTIONS LLM_PROSE_TELLS NEW_REPO_CHECKLIST; do
        echo "new $name" > "$dir/canonical/prompts/$name.md"
    done
    mkdir -p "$dir/canonical/.gitea/workflows"
    echo "name: check" > "$dir/canonical/.gitea/workflows/check.yml"
 }
 # commit_canonical: commit the canonical files as they stand. The stub
 # curl serves only the newest commit; every other commit gets a 404.
 commit_canonical() {
    git -C "$dir/canonical" add .gitignore .dockerignore .editorconfig \
        .golangci.yml .prettierrc .gitea prompts script
    git -C "$dir/canonical" commit -q -m "Canonical"
    HASH="$(git -C "$dir/canonical" rev-parse HEAD)"
 }
 # write_outdated_files: this repo's files, one canonical version behind,
 # with the repo's own entries in the places the script keeps them. The
 # comment above the closing comment in .gitignore is replaced, not kept.
 write_outdated_files() {
    cat > "$dir/repo/.gitignore" << 'EOF'
 *.log
 # An outdated comment.
 # Own entries go below this comment.
 /myapp
 EOF
    cat > "$dir/repo/.dockerignore" << 'EOF'
 **/*.log
 # Own entries go below this comment.
 /myapp
 EOF
    cat > "$dir/repo/.editorconfig" << 'EOF'
 root = true
 [*]
 # Own sections go below this comment.
 [*.py]
 indent_size = 2
 EOF
    cat > "$dir/repo/.golangci.yml" << 'EOF'
 linters:
  settings:
    depguard:
      rules:
        test-support:
          deny:
            - pkg: net/http/httptest
              desc: canonical
            # Our own test helpers.
            - pkg: example.com/app/internal/apptest
              desc: own entry
        other:
          deny:
            - pkg: example.com/other
 EOF
    echo '{ "tabWidth": 2 }' > "$dir/repo/.prettierrc"
    echo "old policy" > "$dir/repo/REPO_POLICIES.md"
 }
 # start_scenario <name>: make a new temp directory holding a repo with
 # a Go source file and the outdated files, not yet committed, and an
 # empty origin.
 start_scenario() {
    scenario="$1"
    rm -rf "$dir"
    dir="$(mktemp -d)"
    : > "$dir/output"
    mkdir "$dir/tmp"
    write_stub_curl
    write_canonical_files
    export GIT_CONFIG_GLOBAL="$dir/gitconfig"
    git config --global user.name "Test"
    git config --global user.email "test@example.com"
    export FAIL_URL=""
    export BAD_BRANCH_JSON=""
    git init -q -b main "$dir/canonical"
    export HASH
    commit_canonical
    git init -q --bare -b main "$dir/origin.git"
    git init -q -b main "$dir/repo"
    git -C "$dir/repo" remote add origin "$dir/origin.git"
    mkdir "$dir/repo/script"
    cp "$WRITE_UPSTREAM_POLICY_FILES" "$COMMIT_UPSTREAM_POLICY_FILES" \
        "$dir/repo/script/"
    printf '#!/bin/sh\necho example\n' > "$dir/repo/script/projectname"
    chmod +x "$dir/repo/script/projectname"
    mkdir -p "$dir/repo/cmd/app"
    echo "package main" > "$dir/repo/cmd/app/main.go"
    write_outdated_files
 }
 # commit_and_push_fixture <paths...>: commit those paths as they stand
 # and every other shared file as the canonical file has it, so the
 # script changes only those paths. Record the commit as $before.
 commit_and_push_fixture() {
    (
        cd "$dir/repo"
        git add script cmd "$@"
        git clean -q -f -x
        for file in $(git -C "$dir/canonical" ls-files); do
            case "$file" in
                script/*) continue ;;
                prompts/REPO_POLICIES.md) path="REPO_POLICIES.md" ;;
                prompts/*) path="docs/${file#prompts/}" ;;
                *) path="$file" ;;
            esac
            if [ -z "$(git ls-files -- "$path")" ]; then
                mkdir -p "$(dirname "$path")"
                cp "$dir/canonical/$file" "$path"
                git add "$path"
            fi
        done
        git commit -q -m "Fixture"
        git push -q origin HEAD
    )
    before="$(git -C "$dir/repo" rev-parse HEAD)"
 }
 # remove_from_fixture <paths...>: delete those paths from the repo and
 # its origin, and record the commit as $before.
 remove_from_fixture() {
    (
        cd "$dir/repo"
        git rm -q -r "$@"
        git commit -q -m "Remove from fixture"
        git push -q origin HEAD
    )
    before="$(git -C "$dir/repo" rev-parse HEAD)"
 }
 run_commit_upstream_policy_files() {
    status=0
    (cd "$dir/repo" && PATH="$dir/bin:$PATH" TMPDIR="$dir/tmp" \
        script/commit-upstream-policy-files "$@") > "$dir/output" 2>&1 ||
        status=$?
 }
 # run_write_upstream_policy_files <arguments>: run the script in this
 # source tree, from outside the repo it updates.
 run_write_upstream_policy_files() {
    status=0
    (cd "$dir" && PATH="$dir/bin:$PATH" TMPDIR="$dir/tmp" \
        "$WRITE_UPSTREAM_POLICY_FILES" "$@") > "$dir/output" 2>&1 ||
        status=$?
 }
 head_of_repo() {
    git -C "$dir/repo" rev-parse HEAD
 }
 head_of_origin() {
    git -C "$dir/origin.git" rev-parse refs/heads/main
 }
 files_in_commit() {
    git -C "$dir/repo" show --name-only --format= HEAD | tr '\n' ' '
 }
 expect_success() {
    [ "$status" -eq 0 ] || fail "exited $status"
 }
 expect_failure() {
    [ "$status" -ne 0 ] || fail "exited 0"
 }
 expect_output() {
    grep -q -F -e "$1" "$dir/output" || fail "output lacks: $1"
 }
 expect_output_without() {
    if grep -q -F -e "$1" "$dir/output"; then
        fail "output has: $1"
    fi
 }
 # expect_file <path>: the file must equal standard input.
 expect_file() {
    cat > "$dir/expected"
    diff "$dir/expected" "$dir/repo/$1" >&2 || fail "$1 is wrong"
 }
 expect_same_as_canonical() {
    diff "$dir/canonical/$1" "$dir/repo/$1" >&2 || fail "$1 is not canonical"
 }
 expect_absent() {
    [ ! -e "$dir/repo/$1" ] || fail "$1 exists"
 }
 expect_executable() {
    [ "$(stat -c %a "$dir/repo/$1")" = 755 ] || fail "$1 is not mode 755"
 }
 expect_committed_executable() {
    git -C "$dir/repo" ls-files -s -- "$1" | grep -q '^100755 ' ||
        fail "$1 is not committed as executable"
 }
 expect_new_commit_not_pushed() {
    [ "$(head_of_repo)" != "$before" ] || fail "no commit was made"
    [ "$(head_of_origin)" = "$before" ] || fail "the commit was pushed"
 }
 expect_no_commit() {
    [ "$(head_of_repo)" = "$before" ] || fail "the repo has a new commit"
    [ "$(head_of_origin)" = "$before" ] || fail "origin has a new commit"
 }
 expect_nothing_written() {
    [ -z "$(git -C "$dir/repo" status --porcelain)" ] ||
        fail "the working tree changed"
    expect_no_commit
 }
 test_own_entries_kept() {
    start_scenario "own entries kept in all four files"
    commit_and_push_fixture .gitignore .dockerignore .editorconfig \
        .golangci.yml .prettierrc REPO_POLICIES.md
    run_commit_upstream_policy_files
    expect_success
    expect_file .gitignore << 'EOF'
 *.log
 *.tmp
 # Own entries go below this comment.
 /myapp
 EOF
    expect_file .dockerignore << 'EOF'
 **/*.log
 **/*.tmp
 # Own entries go below this comment.
 /myapp
 EOF
    expect_file .editorconfig << 'EOF'
 root = true
 [*]
 indent_size = 4
 # Own sections go below this comment.
 [*.py]
 indent_size = 2
 EOF
    expect_file .golangci.yml << 'EOF'
 linters:
  settings:
    depguard:
      rules:
        test-support:
          deny:
            - pkg: net/http/httptest
              desc: canonical
            - pkg: net/http/cgi
              desc: added canonically
            # Our own test helpers.
            - pkg: example.com/app/internal/apptest
              desc: own entry
        other:
          deny:
            - pkg: example.com/other
 EOF
    expect_file .prettierrc << 'EOF'
 { "tabWidth": 4 }
 EOF
    expect_file REPO_POLICIES.md << 'EOF'
 new policy
 EOF
    expect_new_commit_not_pushed
    git -C "$dir/repo" log -1 --format=%s | grep -q -F -e "$HASH" ||
        fail "the commit message does not name the head of main"
    [ "$(files_in_commit)" = ".dockerignore .editorconfig .gitignore .golangci.yml .prettierrc REPO_POLICIES.md " ] ||
        fail "the commit holds other files: $(files_in_commit)"
    [ -z "$(ls -A "$dir/tmp")" ] || fail "a temporary directory is left"
 }
 test_files_the_repo_lacks_are_written_whole() {
    start_scenario "files the repo lacks are written whole"
    mkdir "$dir/repo/docs"
    mv "$dir/repo/REPO_POLICIES.md" "$dir/repo/docs/REPO_POLICIES.md"
    echo "print()" > "$dir/repo/tool.py"
    echo "export {}" > "$dir/repo/web.ts"
    commit_and_push_fixture docs/REPO_POLICIES.md tool.py web.ts
    remove_from_fixture REPO_POLICIES.md .gitignore .golangci.yml .gitea \
        docs/API_POLICIES.md docs/CODE_STYLEGUIDE_GO.md \
        docs/CODE_STYLEGUIDE_JS.md docs/CODE_STYLEGUIDE_PYTHON.md
    run_commit_upstream_policy_files
    expect_success
    expect_same_as_canonical .gitignore
    expect_same_as_canonical .golangci.yml
    expect_same_as_canonical .gitea/workflows/check.yml
    expect_file docs/REPO_POLICIES.md << 'EOF'
 new policy
 EOF
    expect_absent REPO_POLICIES.md
    expect_file docs/API_POLICIES.md << 'EOF'
 new api policy
 EOF
    expect_absent API_POLICIES.md
    expect_file docs/CODE_STYLEGUIDE_GO.md << 'EOF'
 new CODE_STYLEGUIDE_GO
 EOF
    expect_file docs/CODE_STYLEGUIDE_JS.md << 'EOF'
 new CODE_STYLEGUIDE_JS
 EOF
    expect_file docs/CODE_STYLEGUIDE_PYTHON.md << 'EOF'
 new CODE_STYLEGUIDE_PYTHON
 EOF
    expect_new_commit_not_pushed
 }
 test_language_files_need_a_source_file() {
    start_scenario "a repo with no source file of a language gets none of its files"
    commit_and_push_fixture .prettierrc
    remove_from_fixture cmd .golangci.yml docs/CODE_STYLEGUIDE_GO.md \
        docs/GO_HTTP_SERVER_CONVENTIONS.md docs/CODE_STYLEGUIDE_JS.md \
        docs/CODE_STYLEGUIDE_PYTHON.md
    run_commit_upstream_policy_files
    expect_success
    expect_absent .golangci.yml
    expect_absent docs/CODE_STYLEGUIDE_GO.md
    expect_absent docs/GO_HTTP_SERVER_CONVENTIONS.md
    expect_absent docs/CODE_STYLEGUIDE_JS.md
    expect_absent docs/CODE_STYLEGUIDE_PYTHON.md
    expect_new_commit_not_pushed
 }
 test_javascript_source_brings_its_styleguide() {
    for extension in js mjs; do
        start_scenario "a repo whose only JavaScript source is a .$extension file gets the JavaScript style guide"
        echo "export {}" > "$dir/repo/web.$extension"
        commit_and_push_fixture "web.$extension"
        remove_from_fixture docs/CODE_STYLEGUIDE_JS.md
        run_commit_upstream_policy_files
        expect_success
        expect_file docs/CODE_STYLEGUIDE_JS.md << 'EOF'
 new CODE_STYLEGUIDE_JS
 EOF
        expect_new_commit_not_pushed
    done
 }
 test_nothing_changed() {
    start_scenario "nothing changed"
    cp "$dir/canonical/.prettierrc" "$dir/repo/.prettierrc"
    commit_and_push_fixture .prettierrc
    run_commit_upstream_policy_files
    expect_success
    expect_output "nothing to commit"
    expect_nothing_written
 }
 test_target_lacking_write_upstream_policy_files_gets_both_scripts() {
    start_scenario "a repo lacking script/write-upstream-policy-files gets it, and the current script/commit-upstream-policy-files, in the commit"
    rm "$dir/repo/script/write-upstream-policy-files"
    echo "# An older version." >> "$dir/repo/script/commit-upstream-policy-files"
    commit_and_push_fixture .prettierrc
    run_commit_upstream_policy_files
    expect_success
    expect_same_as_canonical script/write-upstream-policy-files
    expect_same_as_canonical script/commit-upstream-policy-files
    expect_committed_executable script/write-upstream-policy-files
    expect_committed_executable script/commit-upstream-policy-files
    expect_new_commit_not_pushed
    [ "$(files_in_commit)" = ".prettierrc script/commit-upstream-policy-files script/write-upstream-policy-files " ] ||
        fail "the commit holds other files: $(files_in_commit)"
 }
 # The shell reads a script in blocks, so the padding makes it read the
 # last line only after main has returned. It finds that line only if
 # script/write-upstream-policy-files left the old file in place under a
 # new name. The old file is an earlier canonical version, so
 # script/write-upstream-policy-files replaces it.
 test_commit_upstream_policy_files_replaces_itself() {
    start_scenario "script/commit-upstream-policy-files replaces its own file and still exits 0"
    {
        cat "$dir/repo/script/commit-upstream-policy-files"
        i=0
        while [ "$i" -lt 2000 ]; do
            echo "# Padding."
            i=$((i + 1))
        done
        echo "echo 'the old file ran to its end'"
    } > "$dir/merged"
    cp "$dir/merged" "$dir/canonical/script/commit-upstream-policy-files"
    commit_canonical
    cp "$COMMIT_UPSTREAM_POLICY_FILES" \
        "$dir/canonical/script/commit-upstream-policy-files"
    commit_canonical
    mv "$dir/merged" "$dir/repo/script/commit-upstream-policy-files"
    chmod 755 "$dir/repo/script/commit-upstream-policy-files"
    commit_and_push_fixture
    run_commit_upstream_policy_files
    expect_success
    expect_output "the old file ran to its end"
    expect_same_as_canonical script/commit-upstream-policy-files
    expect_executable script/commit-upstream-policy-files
    expect_new_commit_not_pushed
 }
 test_write_upstream_policy_files_with_path_commits_nothing() {
    start_scenario "script/write-upstream-policy-files with a path writes into that clone and commits nothing"
    rm "$dir/repo/script/write-upstream-policy-files" \
        "$dir/repo/script/commit-upstream-policy-files"
    commit_and_push_fixture .prettierrc
    run_write_upstream_policy_files "$dir/repo"
    expect_success
    expect_file .prettierrc << 'EOF'
 { "tabWidth": 4 }
 EOF
    expect_same_as_canonical script/write-upstream-policy-files
    expect_same_as_canonical script/commit-upstream-policy-files
    expect_executable script/write-upstream-policy-files
    expect_executable script/commit-upstream-policy-files
    expect_no_commit
    [ "$(head -n 1 "$dir/output")" = "$HASH" ] ||
        fail "the first line of output is not the hash"
    expect_output "script/write-upstream-policy-files"
    [ -z "$(ls -A "$dir/tmp")" ] || fail "a temporary directory is left"
 }
 test_write_upstream_policy_files_without_script_directory() {
    start_scenario "script/write-upstream-policy-files with a path writes both scripts into a clone with no script directory"
    commit_and_push_fixture .prettierrc
    remove_from_fixture script
    run_write_upstream_policy_files "$dir/repo"
    expect_success
    expect_same_as_canonical script/write-upstream-policy-files
    expect_same_as_canonical script/commit-upstream-policy-files
    expect_executable script/write-upstream-policy-files
    expect_executable script/commit-upstream-policy-files
    expect_no_commit
 }
 test_write_upstream_policy_files_without_argument_updates_own_repo() {
    start_scenario "script/write-upstream-policy-files with no argument updates the repo it sits in"
    commit_and_push_fixture .prettierrc
    status=0
    (cd "$dir" && PATH="$dir/bin:$PATH" \
        repo/script/write-upstream-policy-files) \
        > "$dir/output" 2>&1 || status=$?
    expect_success
    expect_file .prettierrc << 'EOF'
 { "tabWidth": 4 }
 EOF
    expect_no_commit
 }
 test_write_upstream_policy_files_bad_target() {
    start_scenario "script/write-upstream-policy-files refuses a path that is not the top of a clone"
    commit_and_push_fixture .prettierrc
    run_write_upstream_policy_files "$dir/repo/script"
    expect_failure
    expect_output "not the top of a git clone"
    run_write_upstream_policy_files "$dir/bin"
    expect_failure
    expect_output "not the top of a git clone"
    run_write_upstream_policy_files "$dir/no-such-directory"
    expect_failure
    expect_output "no such directory"
    run_write_upstream_policy_files "$dir/repo" extra
    expect_failure
    expect_output "usage:"
    expect_nothing_written
 }
 test_failed_fetch_stops() {
    for url in \
        "/api/v1/repos/sneak/prompts/branches/main" \
        "/raw/branch/main/script/write-upstream-policy-files" \
        "/compare/" \
        "/raw/commit/"; do
        start_scenario "a failed fetch of $url stops with nothing written"
        commit_and_push_fixture .gitignore .prettierrc REPO_POLICIES.md
        FAIL_URL="$url"
        run_commit_upstream_policy_files
        expect_failure
        expect_output "cannot fetch"
        expect_nothing_written
    done
 }
 test_one_missing_file_stops_all() {
    start_scenario "one file missing from prompts stops before any file is written"
    rm "$dir/canonical/prompts/REPO_POLICIES.md"
    commit_and_push_fixture .prettierrc REPO_POLICIES.md
    run_commit_upstream_policy_files
    expect_failure
    expect_output "cannot fetch"
    expect_nothing_written
 }
 test_branch_response_without_hash_stops() {
    start_scenario "a branch response with no commit hash stops"
    commit_and_push_fixture .prettierrc
    BAD_BRANCH_JSON=yes
    run_commit_upstream_policy_files
    expect_failure
    expect_output "no commit hash"
    expect_nothing_written
 }
 # Each of these files, with the repo's own entries above the closing
 # comment. The comment added with them must not be named.
 test_own_entry_above_closing_comment() {
    for file in .gitignore .dockerignore .editorconfig; do
        start_scenario "own entries above the closing comment of $file stop"
        {
            printf '/myapp\n/.tool/\n\n# A comment of our own.\n'
            cat "$dir/repo/$file"
        } > "$dir/merged"
        mv "$dir/merged" "$dir/repo/$file"
        commit_and_push_fixture .gitignore .dockerignore .editorconfig \
            .prettierrc REPO_POLICIES.md
        run_commit_upstream_policy_files
        expect_failure
        expect_output "$file has entries"
        expect_output "/myapp"
        expect_output "/.tool/"
        expect_output_without "A comment of our own."
        expect_nothing_written
    done
 }
 test_uncommitted_change_stops() {
    start_scenario "a carried file with uncommitted changes stops"
    commit_and_push_fixture .prettierrc REPO_POLICIES.md
    echo "uncommitted" >> "$dir/repo/REPO_POLICIES.md"
    run_commit_upstream_policy_files
    expect_failure
    expect_output "REPO_POLICIES.md has uncommitted changes"
    expect_file REPO_POLICIES.md << 'EOF'
 old policy
 uncommitted
 EOF
    expect_no_commit
 }
 test_untracked_script_stops() {
    start_scenario "an untracked script/write-upstream-policy-files is not overwritten"
    rm "$dir/repo/script/write-upstream-policy-files"
    commit_and_push_fixture .prettierrc
    echo "our own script" > "$dir/repo/script/write-upstream-policy-files"
    run_write_upstream_policy_files "$dir/repo"
    expect_failure
    expect_output "script/write-upstream-policy-files has uncommitted changes"
    expect_file script/write-upstream-policy-files << 'EOF'
 our own script
 EOF
    expect_no_commit
 }
 test_ignored_file_stops() {
    start_scenario "an ignored file at a listed path is not overwritten"
    commit_and_push_fixture .prettierrc
    remove_from_fixture docs/API_POLICIES.md
    echo "docs/API_POLICIES.md" >> "$dir/repo/.git/info/exclude"
    echo "our own notes" > "$dir/repo/docs/API_POLICIES.md"
    run_write_upstream_policy_files "$dir/repo"
    expect_failure
    expect_output "docs/API_POLICIES.md is ignored by git"
    expect_file docs/API_POLICIES.md << 'EOF'
 our own notes
 EOF
    expect_no_commit
 }
 test_own_script_stops() {
    for script in script/write-upstream-policy-files \
        script/commit-upstream-policy-files; do
        start_scenario "a tracked $script with a line the canonical file has never held stops"
        echo "echo our own script" >> "$dir/repo/$script"
        commit_and_push_fixture .prettierrc
        run_commit_upstream_policy_files
        expect_failure
        expect_output "$script has lines"
        expect_output "echo our own script"
        expect_nothing_written
    done
 }
 test_gitignore_lacks_canonical_last_line() {
    start_scenario ".gitignore lacking the canonical last line keeps the repo's own line below the canonical content"
    printf '*.log\n\n# A comment of our own.\n/myapp\n' > "$dir/repo/.gitignore"
    commit_and_push_fixture .gitignore .prettierrc
    run_commit_upstream_policy_files
    expect_success
    expect_file .gitignore << 'EOF'
 *.log
 *.tmp
 # Own entries go below this comment.
 /myapp
 EOF
    expect_new_commit_not_pushed
 }
 test_dockerignore_lacks_canonical_last_line() {
    start_scenario ".dockerignore lacking the canonical last line drops a line an earlier canonical commit held"
    echo "**/*.log" > "$dir/repo/.dockerignore"
    expect_former_canonical_line_replaced .dockerignore ".git"
    expect_same_as_canonical .dockerignore
 }
 test_editorconfig_lacks_canonical_last_line() {
    start_scenario ".editorconfig lacking the canonical last line with a line of its own stops"
    printf 'root = true\n[*.py]\nindent_size = 2\n' > "$dir/repo/.editorconfig"
    commit_and_push_fixture .editorconfig .prettierrc
    run_commit_upstream_policy_files
    expect_failure
    expect_output ".editorconfig lacks this line"
    expect_output "[*.py]"
    expect_output "indent_size = 2"
    expect_nothing_written
 }
 test_editorconfig_lacks_canonical_last_line_no_own_line() {
    start_scenario ".editorconfig lacking the canonical last line with no line of its own is replaced"
    printf 'root = true\n[*]\n' > "$dir/repo/.editorconfig"
    expect_former_canonical_line_replaced .editorconfig "indent_size = 8"
    expect_same_as_canonical .editorconfig
 }
 test_fetched_golangci_without_deny_list() {
    start_scenario "a fetched .golangci.yml with no deny list stops"
    cat > "$dir/canonical/.golangci.yml" << 'EOF'
 linters:
  settings:
    depguard:
      rules:
        test-support:
          files:
            - "**/*.go"
        other:
          deny:
            - pkg: example.com/other
 EOF
    commit_and_push_fixture .golangci.yml .prettierrc
    run_commit_upstream_policy_files
    expect_failure
    expect_output "no deny list in its test-support rule"
    expect_nothing_written
 }
 test_own_golangci_setting_stops() {
    start_scenario "a .golangci.yml setting the canonical file lacks stops"
    cat >> "$dir/repo/.golangci.yml" << 'EOF'
    # A comment of our own.
    forbidigo:
      forbid:
        - pattern: model.Operator
 EOF
    commit_and_push_fixture .golangci.yml .prettierrc
    run_commit_upstream_policy_files
    expect_failure
    expect_output ".golangci.yml has lines"
    expect_output "forbidigo:"
    expect_output "- pattern: model.Operator"
    expect_output_without "A comment of our own."
    expect_nothing_written
 }
 test_source_repo_stops() {
    start_scenario "the repo the policy files come from stops"
    mkdir "$dir/repo/prompts"
    echo "policy" > "$dir/repo/prompts/REPO_POLICIES.md"
    commit_and_push_fixture .prettierrc prompts/REPO_POLICIES.md
    run_commit_upstream_policy_files
    expect_failure
    expect_output "this repo is the source of the policy files"
    expect_nothing_written
 }
 test_staged_file_stays_out_of_commit() {
    start_scenario "a file staged before the script starts stays out of its commit"
    commit_and_push_fixture .prettierrc
    echo "notes" > "$dir/repo/notes.txt"
    git -C "$dir/repo" add notes.txt
    run_commit_upstream_policy_files
    expect_success
    [ "$(files_in_commit)" = ".prettierrc " ] ||
        fail "the commit holds more than the policy file"
    [ "$(git -C "$dir/repo" diff --cached --name-only)" = "notes.txt" ] ||
        fail "notes.txt is no longer staged"
 }
 test_commit_upstream_policy_files_takes_no_argument() {
    start_scenario "script/commit-upstream-policy-files refuses an argument"
    commit_and_push_fixture .prettierrc
    run_commit_upstream_policy_files "$HASH"
    expect_failure
    expect_output "usage:"
    expect_nothing_written
 }
 # expect_former_canonical_line_replaced <file> <line>: an earlier
 # canonical commit held the line and the newest does not. This repo's
 # file still has it, and the script replaces it.
 expect_former_canonical_line_replaced() {
    cp "$dir/canonical/$1" "$dir/newest"
    { echo "$2"; cat "$dir/newest"; } > "$dir/canonical/$1"
    commit_canonical
    cp "$dir/newest" "$dir/canonical/$1"
    commit_canonical
    { echo "$2"; cat "$dir/repo/$1"; } > "$dir/merged"
    mv "$dir/merged" "$dir/repo/$1"
    commit_and_push_fixture "$1" .prettierrc
    run_commit_upstream_policy_files
    expect_success
    if grep -q -F -x -e "$2" "$dir/repo/$1"; then
        fail "$1 still has: $2"
    fi
    expect_new_commit_not_pushed
 }
 test_former_canonical_golangci_line_replaced() {
    start_scenario "a .golangci.yml line an earlier canonical commit held is replaced"
    expect_former_canonical_line_replaced .golangci.yml "version: 1"
 }
 test_former_canonical_gitignore_line_replaced() {
    start_scenario "a .gitignore line above the closing comment that an earlier canonical commit held is replaced"
    expect_former_canonical_line_replaced .gitignore "*.old"
 }
 test_former_canonical_script_line_replaced() {
    start_scenario "a script/write-upstream-policy-files line an earlier canonical commit held is replaced"
    expect_former_canonical_line_replaced \
        script/write-upstream-policy-files "echo an older version"
    expect_same_as_canonical script/write-upstream-policy-files
 }
 # A line another file's history removed does not count as held by this
 # one.
 test_line_removed_from_another_file_still_stops() {
    start_scenario "a line only another canonical file once held stops"
    { echo "*.old"; cat "$dir/canonical/.dockerignore"; } > "$dir/merged"
    cp "$dir/merged" "$dir/canonical/.dockerignore"
    commit_canonical
    tail -n +2 "$dir/merged" > "$dir/canonical/.dockerignore"
    commit_canonical
    { echo "*.old"; cat "$dir/repo/.gitignore"; } > "$dir/merged"
    mv "$dir/merged" "$dir/repo/.gitignore"
    commit_and_push_fixture .gitignore .prettierrc
    run_commit_upstream_policy_files
    expect_failure
    expect_output ".gitignore has entries"
    expect_output "*.old"
    expect_nothing_written
 }
 main() {
    test_own_entries_kept
    test_files_the_repo_lacks_are_written_whole
    test_language_files_need_a_source_file
    test_javascript_source_brings_its_styleguide
    test_nothing_changed
    test_target_lacking_write_upstream_policy_files_gets_both_scripts
    test_commit_upstream_policy_files_replaces_itself
    test_write_upstream_policy_files_with_path_commits_nothing
    test_write_upstream_policy_files_without_script_directory
    test_write_upstream_policy_files_without_argument_updates_own_repo
    test_write_upstream_policy_files_bad_target
    test_failed_fetch_stops
    test_one_missing_file_stops_all
    test_branch_response_without_hash_stops
    test_own_entry_above_closing_comment
    test_uncommitted_change_stops
    test_untracked_script_stops
    test_ignored_file_stops
    test_own_script_stops
    test_gitignore_lacks_canonical_last_line
    test_dockerignore_lacks_canonical_last_line
    test_editorconfig_lacks_canonical_last_line
    test_editorconfig_lacks_canonical_last_line_no_own_line
    test_fetched_golangci_without_deny_list
    test_own_golangci_setting_stops
    test_source_repo_stops
    test_staged_file_stays_out_of_commit
    test_commit_upstream_policy_files_takes_no_argument
    test_former_canonical_golangci_line_replaced
    test_former_canonical_gitignore_line_replaced
    test_former_canonical_script_line_replaced
    test_line_removed_from_another_file_still_stops
    echo "commit-upstream-policy-files tests passed"
 }
 main "$@"
@@ -0,0 +1,567 @@
 #!/bin/sh
 # test/update-policy.sh: test script/update-policy on throwaway repos.
 # Each scenario gets one temp directory holding a repo, its local bare
 # origin, a local git repository of the canonical files in place of
 # prompts, and a stub curl that serves them, so nothing touches the
 # network.
 set -eu
 UPDATE_POLICY="$(cd "$(dirname "$0")/.." && pwd -P)/script/update-policy"
 dir=""
 trap 'rm -rf "$dir"' EXIT
 fail() {
    echo "FAIL: $scenario: $*" >&2
    cat "$dir/output" >&2
    exit 1
 }
 write_stub_curl() {
    mkdir "$dir/bin"
    cat > "$dir/bin/curl" << 'EOF'
 #!/bin/sh
 previous=""
 fail_flag=""
 for argument in "$@"; do
    [ "$previous" = "--output" ] && output="$argument"
    [ "$argument" = "--fail" ] && fail_flag=yes
    previous="$argument"
 done
 url="$previous"
 base="https://git.eeqj.de/sneak/prompts/raw/commit/$HASH/"
 path="${url#"$base"}"
 source="$(dirname "$0")/../canonical/$path"
 if [ "$path" = "$url" ] || [ ! -f "$source" ]; then
    [ -n "$fail_flag" ] && exit 22
    echo "404 page not found" > "$output"
    exit 0
 fi
 cp "$source" "$output"
 EOF
    chmod +x "$dir/bin/curl"
 }
 write_canonical_files() {
    mkdir -p "$dir/canonical/prompts"
    cat > "$dir/canonical/.gitignore" << 'EOF'
 *.log
 *.tmp
 # Own entries go below this comment.
 EOF
    cat > "$dir/canonical/.dockerignore" << 'EOF'
 **/*.log
 **/*.tmp
 # Own entries go below this comment.
 EOF
    cat > "$dir/canonical/.editorconfig" << 'EOF'
 root = true
 [*]
 indent_size = 4
 # Own sections go below this comment.
 EOF
    cat > "$dir/canonical/.golangci.yml" << 'EOF'
 linters:
  settings:
    depguard:
      rules:
        test-support:
          deny:
            - pkg: net/http/httptest
              desc: canonical
            - pkg: net/http/cgi
              desc: added canonically
        other:
          deny:
            - pkg: example.com/other
 EOF
    echo '{ "tabWidth": 4 }' > "$dir/canonical/.prettierrc"
    echo "new policy" > "$dir/canonical/prompts/REPO_POLICIES.md"
    echo "new api policy" > "$dir/canonical/prompts/API_POLICIES.md"
 }
 # commit_canonical: commit the canonical files as they stand. The stub
 # curl serves only the newest commit; every other commit gets a 404.
 commit_canonical() {
    git -C "$dir/canonical" add .gitignore .dockerignore .editorconfig \
        .golangci.yml .prettierrc prompts
    git -C "$dir/canonical" commit -q -m "Canonical"
    HASH="$(git -C "$dir/canonical" rev-parse HEAD)"
 }
 # write_outdated_files: this repo's files, one canonical version behind,
 # with the repo's own entries in the places the script keeps them. The
 # comment above the closing comment in .gitignore is replaced, not kept.
 write_outdated_files() {
    cat > "$dir/repo/.gitignore" << 'EOF'
 *.log
 # An outdated comment.
 # Own entries go below this comment.
 /myapp
 EOF
    cat > "$dir/repo/.dockerignore" << 'EOF'
 **/*.log
 # Own entries go below this comment.
 /myapp
 EOF
    cat > "$dir/repo/.editorconfig" << 'EOF'
 root = true
 [*]
 # Own sections go below this comment.
 [*.py]
 indent_size = 2
 EOF
    cat > "$dir/repo/.golangci.yml" << 'EOF'
 linters:
  settings:
    depguard:
      rules:
        test-support:
          deny:
            - pkg: net/http/httptest
              desc: canonical
            # Our own test helpers.
            - pkg: example.com/app/internal/apptest
              desc: own entry
        other:
          deny:
            - pkg: example.com/other
 EOF
    echo '{ "tabWidth": 2 }' > "$dir/repo/.prettierrc"
    echo "old policy" > "$dir/repo/REPO_POLICIES.md"
 }
 # start_scenario <name>: make a new temp directory holding a repo with
 # the outdated files, not yet committed, and an empty origin.
 start_scenario() {
    scenario="$1"
    rm -rf "$dir"
    dir="$(mktemp -d)"
    : > "$dir/output"
    write_stub_curl
    write_canonical_files
    # git clone reads no repo's own config, so the setting that points
    # git at the local canonical repository has to be in this file.
    export GIT_CONFIG_GLOBAL="$dir/gitconfig"
    git config --global user.name "Test"
    git config --global user.email "test@example.com"
    git config --global "url.$dir/canonical.insteadOf" \
        "https://git.eeqj.de/sneak/prompts.git"
    git init -q -b main "$dir/canonical"
    export HASH
    commit_canonical
    git init -q --bare -b main "$dir/origin.git"
    git init -q -b main "$dir/repo"
    git -C "$dir/repo" remote add origin "$dir/origin.git"
    mkdir "$dir/repo/script"
    cp "$UPDATE_POLICY" "$dir/repo/script/update-policy"
    printf '#!/bin/sh\necho example\n' > "$dir/repo/script/projectname"
    chmod +x "$dir/repo/script/projectname"
    write_outdated_files
 }
 # commit_and_push_fixture <paths...>: commit those paths, remove the
 # rest of the outdated files, and record the commit as $before.
 commit_and_push_fixture() {
    (
        cd "$dir/repo"
        git add script "$@"
        git commit -q -m "Fixture"
        git push -q origin HEAD
        git clean -q -f -x
    )
    before="$(git -C "$dir/repo" rev-parse HEAD)"
 }
 run_update_policy() {
    status=0
    (cd "$dir/repo" && PATH="$dir/bin:$PATH" script/update-policy "$@") \
        > "$dir/output" 2>&1 || status=$?
 }
 reject_pushes() {
    printf '#!/bin/sh\nexit 1\n' > "$dir/origin.git/hooks/pre-receive"
    chmod +x "$dir/origin.git/hooks/pre-receive"
 }
 accept_pushes() {
    rm "$dir/origin.git/hooks/pre-receive"
 }
 head_of_repo() {
    git -C "$dir/repo" rev-parse HEAD
 }
 head_of_origin() {
    git -C "$dir/origin.git" rev-parse refs/heads/main
 }
 expect_success() {
    [ "$status" -eq 0 ] || fail "exited $status"
 }
 expect_failure() {
    [ "$status" -ne 0 ] || fail "exited 0"
 }
 expect_output() {
    grep -q -F -e "$1" "$dir/output" || fail "output lacks: $1"
 }
 expect_output_without() {
    if grep -q -F -e "$1" "$dir/output"; then
        fail "output has: $1"
    fi
 }
 # expect_file <path>: the file must equal standard input.
 expect_file() {
    cat > "$dir/expected"
    diff "$dir/expected" "$dir/repo/$1" >&2 || fail "$1 is wrong"
 }
 expect_absent() {
    [ ! -e "$dir/repo/$1" ] || fail "$1 exists"
 }
 expect_nothing_written() {
    [ -z "$(git -C "$dir/repo" status --porcelain)" ] ||
        fail "the working tree changed"
    [ "$(head_of_repo)" = "$before" ] || fail "the repo has a new commit"
    [ "$(head_of_origin)" = "$before" ] || fail "origin has a new commit"
 }
 test_own_entries_kept() {
    start_scenario "own entries kept in all four files"
    commit_and_push_fixture .gitignore .dockerignore .editorconfig \
        .golangci.yml .prettierrc REPO_POLICIES.md
    run_update_policy "$HASH"
    expect_success
    expect_file .gitignore << 'EOF'
 *.log
 *.tmp
 # Own entries go below this comment.
 /myapp
 EOF
    expect_file .dockerignore << 'EOF'
 **/*.log
 **/*.tmp
 # Own entries go below this comment.
 /myapp
 EOF
    expect_file .editorconfig << 'EOF'
 root = true
 [*]
 indent_size = 4
 # Own sections go below this comment.
 [*.py]
 indent_size = 2
 EOF
    expect_file .golangci.yml << 'EOF'
 linters:
  settings:
    depguard:
      rules:
        test-support:
          deny:
            - pkg: net/http/httptest
              desc: canonical
            - pkg: net/http/cgi
              desc: added canonically
            # Our own test helpers.
            - pkg: example.com/app/internal/apptest
              desc: own entry
        other:
          deny:
            - pkg: example.com/other
 EOF
    expect_file .prettierrc << 'EOF'
 { "tabWidth": 4 }
 EOF
    expect_file REPO_POLICIES.md << 'EOF'
 new policy
 EOF
    [ "$(head_of_origin)" = "$(head_of_repo)" ] ||
        fail "the commit was not pushed"
    [ "$(head_of_repo)" != "$before" ] || fail "no commit was made"
    git -C "$dir/repo" log -1 --format=%s | grep -q -F -e "$HASH" ||
        fail "the commit message does not name the hash"
 }
 test_files_not_carried_are_skipped() {
    start_scenario "files the repo does not carry skipped"
    mkdir "$dir/repo/docs"
    mv "$dir/repo/REPO_POLICIES.md" "$dir/repo/docs/REPO_POLICIES.md"
    commit_and_push_fixture docs/REPO_POLICIES.md
    run_update_policy "$HASH"
    expect_success
    expect_file docs/REPO_POLICIES.md << 'EOF'
 new policy
 EOF
    expect_absent REPO_POLICIES.md
    expect_absent API_POLICIES.md
    expect_absent docs/API_POLICIES.md
    expect_absent .gitignore
    expect_absent .dockerignore
    expect_absent .editorconfig
    expect_absent .golangci.yml
    expect_absent .prettierrc
    [ "$(head_of_origin)" = "$(head_of_repo)" ] ||
        fail "the commit was not pushed"
 }
 test_nothing_changed() {
    start_scenario "nothing changed"
    cp "$dir/canonical/.prettierrc" "$dir/repo/.prettierrc"
    commit_and_push_fixture .prettierrc
    run_update_policy "$HASH"
    expect_success
    expect_output "nothing to commit"
    expect_nothing_written
 }
 test_bad_commit_hash() {
    for hash in not-a-hash 0000000000000000000000000000000000000000; do
        start_scenario "bad commit hash $hash stops with nothing written"
        commit_and_push_fixture .gitignore .prettierrc REPO_POLICIES.md
        run_update_policy "$hash"
        expect_failure
        expect_nothing_written
    done
    # The last hash has the right form, so it is the one that reaches curl.
    expect_output "cannot fetch"
 }
 test_push_failure() {
    start_scenario "push failure exits non-zero"
    commit_and_push_fixture .prettierrc
    reject_pushes
    run_update_policy "$HASH"
    expect_failure
    expect_output "push failed"
    [ "$(head_of_origin)" = "$before" ] || fail "origin has a new commit"
 }
 # Each of these files, with the repo's own entries above the closing
 # comment. The comment added with them must not be named.
 test_own_entry_above_closing_comment() {
    for file in .gitignore .dockerignore .editorconfig; do
        start_scenario "own entries above the closing comment of $file stop"
        {
            printf '/myapp\n/.tool/\n\n# A comment of our own.\n'
            cat "$dir/repo/$file"
        } > "$dir/merged"
        mv "$dir/merged" "$dir/repo/$file"
        commit_and_push_fixture .gitignore .dockerignore .editorconfig \
            .prettierrc REPO_POLICIES.md
        run_update_policy "$HASH"
        expect_failure
        expect_output "$file has entries"
        expect_output "/myapp"
        expect_output "/.tool/"
        expect_output_without "A comment of our own."
        expect_nothing_written
    done
 }
 test_retry_after_failed_push() {
    start_scenario "a retry after a failed push delivers the commit"
    commit_and_push_fixture .prettierrc
    reject_pushes
    run_update_policy "$HASH"
    expect_failure
    committed="$(head_of_repo)"
    [ "$committed" != "$before" ] || fail "no commit was made"
    [ "$(head_of_origin)" = "$before" ] || fail "origin has a new commit"
    accept_pushes
    run_update_policy "$HASH"
    expect_success
    [ "$(head_of_repo)" = "$committed" ] || fail "the retry made a new commit"
    [ "$(head_of_origin)" = "$committed" ] ||
        fail "the retry did not deliver the commit"
 }
 test_uncommitted_change_stops() {
    start_scenario "a carried file with uncommitted changes stops"
    commit_and_push_fixture .prettierrc REPO_POLICIES.md
    echo "uncommitted" >> "$dir/repo/REPO_POLICIES.md"
    run_update_policy "$HASH"
    expect_failure
    expect_output "REPO_POLICIES.md has uncommitted changes"
    expect_file REPO_POLICIES.md << 'EOF'
 old policy
 uncommitted
 EOF
    [ "$(head_of_repo)" = "$before" ] || fail "the repo has a new commit"
    [ "$(head_of_origin)" = "$before" ] || fail "origin has a new commit"
 }
 test_gitignore_lacks_canonical_last_line() {
    start_scenario ".gitignore lacking the canonical last line stops"
    printf '*.log\n/myapp\n' > "$dir/repo/.gitignore"
    commit_and_push_fixture .gitignore .prettierrc
    run_update_policy "$HASH"
    expect_failure
    expect_output ".gitignore lacks this line"
    expect_nothing_written
 }
 test_fetched_golangci_without_deny_list() {
    start_scenario "a fetched .golangci.yml with no deny list stops"
    cat > "$dir/canonical/.golangci.yml" << 'EOF'
 linters:
  settings:
    depguard:
      rules:
        test-support:
          files:
            - "**/*.go"
        other:
          deny:
            - pkg: example.com/other
 EOF
    commit_and_push_fixture .golangci.yml .prettierrc
    run_update_policy "$HASH"
    expect_failure
    expect_output "no deny list in its test-support rule"
    expect_nothing_written
 }
 test_own_golangci_setting_stops() {
    start_scenario "a .golangci.yml setting the canonical file lacks stops"
    cat >> "$dir/repo/.golangci.yml" << 'EOF'
    # A comment of our own.
    forbidigo:
      forbid:
        - pattern: model.Operator
 EOF
    commit_and_push_fixture .golangci.yml .prettierrc
    run_update_policy "$HASH"
    expect_failure
    expect_output ".golangci.yml has lines"
    expect_output "forbidigo:"
    expect_output "- pattern: model.Operator"
    expect_output_without "A comment of our own."
    expect_nothing_written
 }
 test_source_repo_stops() {
    start_scenario "the repo the policy files come from stops"
    printf '#!/bin/sh\necho prompts\n' > "$dir/repo/script/projectname"
    commit_and_push_fixture .prettierrc REPO_POLICIES.md
    run_update_policy "$HASH"
    expect_failure
    expect_output "this repo is the source of the policy files"
    expect_nothing_written
 }
 test_staged_file_stays_out_of_commit() {
    start_scenario "a file staged before the script starts stays out of its commit"
    commit_and_push_fixture .prettierrc
    echo "notes" > "$dir/repo/notes.txt"
    git -C "$dir/repo" add notes.txt
    run_update_policy "$HASH"
    expect_success
    [ "$(git -C "$dir/repo" show --name-only --format= HEAD)" = ".prettierrc" ] ||
        fail "the commit holds more than the policy file"
    [ "$(git -C "$dir/repo" diff --cached --name-only)" = "notes.txt" ] ||
        fail "notes.txt is no longer staged"
 }
 test_short_commit_hash_refused() {
    start_scenario "a hexadecimal hash shorter than 40 characters is refused"
    commit_and_push_fixture .prettierrc
    run_update_policy "${HASH%?}"
    expect_failure
    expect_output "not a full commit hash"
    expect_nothing_written
 }
 # git asks the local canonical repository for the head of main, and the
 # stub curl serves only that commit.
 test_no_hash_uses_head_of_main() {
    start_scenario "with no hash the script uses the head of main"
    commit_and_push_fixture .prettierrc
    run_update_policy
    expect_success
    expect_file .prettierrc << 'EOF'
 { "tabWidth": 4 }
 EOF
    git -C "$dir/repo" log -1 --format=%s | grep -q -F -e "$HASH" ||
        fail "the commit message does not name the head of main"
    [ "$(head_of_origin)" = "$(head_of_repo)" ] ||
        fail "the commit was not pushed"
 }
 # expect_former_canonical_line_replaced <file> <line>: an earlier
 # canonical commit held the line and the newest does not. This repo's
 # file still has it, and the script replaces it and pushes.
 expect_former_canonical_line_replaced() {
    cp "$dir/canonical/$1" "$dir/newest"
    { echo "$2"; cat "$dir/newest"; } > "$dir/canonical/$1"
    commit_canonical
    cp "$dir/newest" "$dir/canonical/$1"
    commit_canonical
    { echo "$2"; cat "$dir/repo/$1"; } > "$dir/merged"
    mv "$dir/merged" "$dir/repo/$1"
    commit_and_push_fixture "$1" .prettierrc
    run_update_policy "$HASH"
    expect_success
    if grep -q -F -x -e "$2" "$dir/repo/$1"; then
        fail "$1 still has: $2"
    fi
    [ "$(head_of_repo)" != "$before" ] || fail "no commit was made"
    [ "$(head_of_origin)" = "$(head_of_repo)" ] ||
        fail "the commit was not pushed"
 }
 test_former_canonical_golangci_line_replaced() {
    start_scenario "a .golangci.yml line an earlier canonical commit held is replaced"
    expect_former_canonical_line_replaced .golangci.yml "version: 1"
 }
 test_former_canonical_gitignore_line_replaced() {
    start_scenario "a .gitignore line above the closing comment that an earlier canonical commit held is replaced"
    expect_former_canonical_line_replaced .gitignore "*.old"
 }
 main() {
    test_own_entries_kept
    test_files_not_carried_are_skipped
    test_nothing_changed
    test_bad_commit_hash
    test_push_failure
    test_own_entry_above_closing_comment
    test_retry_after_failed_push
    test_uncommitted_change_stops
    test_gitignore_lacks_canonical_last_line
    test_fetched_golangci_without_deny_list
    test_own_golangci_setting_stops
    test_source_repo_stops
    test_staged_file_stays_out_of_commit
    test_short_commit_hash_refused
    test_no_hash_uses_head_of_main
    test_former_canonical_golangci_line_replaced
    test_former_canonical_gitignore_line_replaced
    echo "update-policy tests passed"
 }
 main "$@"