Set the lint digest and .golangci.yml together; state the Go version rule

The canonical .golangci.yml now names exhaustruct_v5, which v2.12.2
rejects, so a repo that re-vendors the file on the old digest gets a
lint phase that fails before checking any code. REPO_POLICIES now says
a repo sets the lint phase digest and re-vendors .golangci.yml in one
commit, whichever prompted the change, and both repo checklists point
to that rule. It also replaces "a new Go version needs a golangci-lint
built with it" with the rule golangci-lint applies: the go directive
must not name a newer Go minor version than the one it was built with.

Model: opus-5-5

.dockerignore

@@ -17,10 +17,7 @@
 # stage that compiles runs `git describe --tags --always` on .git, which
 # does not need .git/config; that file can hold a credential, such as a
 # password in a remote URL or the token the CI checkout step stores there.
-# Each submodule keeps a config with the same exposure in its git directory
-# under .git/modules/, nested again for a submodule's own submodules.
 .git/config
-.git/modules/**/config
 
 # Agent scratch: one full checkout of the repo per in-flight agent.
 # Anchored because it occurs once where agents run at the repo root.

TODO.md

@@ -21,19 +21,6 @@ fmt-check, and commit.
 
 # Completed Steps
 
-- 2026-10-04: The canonical `.dockerignore` now also keeps out each submodule's
-  `config` (issue 75). A submodule's git directory lives under `.git/modules/`,
-  nested again for its own submodules, and its `config` can hold a credential
-  just like `.git/config`. The pattern `.git/modules/**/config` covers every
-  depth and leaves the top-level `.git` that `git describe` reads untouched.
-  `REPO_POLICIES.md` and both checklists say so in the same words.
-- 2026-10-03: Fixed two defects in the canonical Go `Dockerfile` example (issue
-  73). The test phase now uses the Debian Go image, since `-race` needs cgo and
-  the alpine image has no C compiler, so the phase failed before running a test.
-  The stage that compiles runs `git config --system --add safe.directory /src`,
-  because a context sent as a tar stream keeps the sender's file owners and git
-  refuses that checkout, leaving the version empty. Both checklists state that
-  step in the same words.
 - 2026-10-03: Moved the canonical golangci-lint to v2.14.0, built with go1.27,
   because v2.12.2 refuses to lint a module whose `go` directive is 1.27 (issue
   65). Releases from v2.13.0 deprecate `exhaustruct` in favour of

prompts/EXISTING_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: Existing Repo Checklist
-last_modified: 2026-10-04
+last_modified: 2026-10-03
 ---
 
 Use this checklist when beginning work in a repo that may not yet conform to our
@@ -59,28 +59,22 @@ with your task.
       here run anywhere other than the repo root, the anchored entry misses
       `services/api/.claude/`: add anchored entries for those directories.
 - [ ] If the repo embeds a version in a binary: `.dockerignore` lets `.git` into
-      the build context. It keeps out `.git/config` and each submodule's
-      `config` under `.git/modules/` at any depth (`.git/modules/**/config`),
-      which `git describe` does not need and which can hold a credential: a
-      password in a remote URL, or the token the CI checkout step stores there.
-      The stage that compiles has `git` (the Debian Go image has it; an alpine
-      one needs `apk add --no-cache git`) and takes the version from the
-      `VERSION` build argument when one is given, otherwise from
-      `git describe --tags --always`. That gives the tag on a tagged commit; on
-      a later commit, the tag, the number of commits since it and the short
-      commit (`v1.2.3-4-gabc1234`); and the short commit when no tag is
-      reachable. The stage that compiles also marks its working directory safe
-      for git (`git config --system --add safe.directory /src`): a context sent
-      as a tar stream keeps the sender's file owners, and git refuses a checkout
-      owned by another user, so the version would come out empty. `ARG VERSION`
-      has no default, and the build fails if the context carries `.git` and the
-      version still comes out empty, `dev` or `unknown`. A plain
-      `docker build .` with no build arguments must succeed; a Dockerfile that
-      refuses an empty build argument drops that refusal and keeps the argument.
-      `script/docker` and `script/cibuild` pass the version they compute on the
-      host; it takes precedence. A tag-derived version additionally needs
-      `fetch-depth: 0` on the CI checkout step, which clones shallow and fetches
-      no tags by default.
+      the build context. It keeps out `.git/config`, which `git describe` does
+      not need and which can hold a credential: a password in a remote URL, or
+      the token the CI checkout step stores there. The stage that compiles has
+      `git` (the Debian Go image has it; an alpine one needs
+      `apk add --no-cache git`) and takes the version from the `VERSION` build
+      argument when one is given, otherwise from `git describe --tags --always`.
+      That gives the tag on a tagged commit; on a later commit, the tag, the
+      number of commits since it and the short commit (`v1.2.3-4-gabc1234`); and
+      the short commit when no tag is reachable. `ARG VERSION` has no default,
+      and the build fails if the context carries `.git` and the version still
+      comes out empty, `dev` or `unknown`. A plain `docker build .` with no
+      build arguments must succeed; a Dockerfile that refuses an empty build
+      argument drops that refusal and keeps the argument. `script/docker` and
+      `script/cibuild` pass the version they compute on the host; it takes
+      precedence. A tag-derived version additionally needs `fetch-depth: 0` on
+      the CI checkout step, which clones shallow and fetches no tags by default.
 - [ ] Gitea Actions workflow in `.gitea/workflows/` runs `script/cibuild` on
       push — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`

prompts/NEW_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: New Repo Checklist
-last_modified: 2026-10-04
+last_modified: 2026-10-03
 ---
 
 Use this checklist when creating a new repository from scratch. Follow the steps
@@ -68,24 +68,19 @@ Template files can be fetched from:
       will run them in subdirectories, `services/api/.claude/` needs its own
       anchored entry.
     - If the image embeds a version in a binary: `.dockerignore` lets `.git`
-      into the build context. It keeps out `.git/config` and each submodule's
-      `config` under `.git/modules/` at any depth (`.git/modules/**/config`),
-      which `git describe` does not need and which can hold a credential: a
-      password in a remote URL, or the token the CI checkout step stores there.
-      The stage that compiles has `git` (the Debian Go image has it; an alpine
-      one needs `apk add --no-cache git`) and takes the version from the
-      `VERSION` build argument when one is given, otherwise from
-      `git describe --tags --always`. That gives the tag on a tagged commit; on
-      a later commit, the tag, the number of commits since it and the short
-      commit (`v1.2.3-4-gabc1234`); and the short commit when no tag is
-      reachable. The stage that compiles also marks its working directory safe
-      for git (`git config --system --add safe.directory /src`): a context sent
-      as a tar stream keeps the sender's file owners, and git refuses a checkout
-      owned by another user, so the version would come out empty. `ARG VERSION`
-      has no default, and the build fails if the context carries `.git` and the
-      version still comes out empty, `dev` or `unknown`. A plain
-      `docker build .` with no build arguments must succeed; a Dockerfile that
-      refuses an empty build argument drops that refusal and keeps the argument.
+      into the build context. It keeps out `.git/config`, which `git describe`
+      does not need and which can hold a credential: a password in a remote URL,
+      or the token the CI checkout step stores there. The stage that compiles
+      has `git` (the Debian Go image has it; an alpine one needs
+      `apk add --no-cache git`) and takes the version from the `VERSION` build
+      argument when one is given, otherwise from `git describe --tags --always`.
+      That gives the tag on a tagged commit; on a later commit, the tag, the
+      number of commits since it and the short commit (`v1.2.3-4-gabc1234`); and
+      the short commit when no tag is reachable. `ARG VERSION` has no default,
+      and the build fails if the context carries `.git` and the version still
+      comes out empty, `dev` or `unknown`. A plain `docker build .` with no
+      build arguments must succeed; a Dockerfile that refuses an empty build
+      argument drops that refusal and keeps the argument.
     - The Dockerfile carries a `lint` phase and a `test` phase, each invoking
       its tool directly rather than through `make` or `script/`, and the final
       stage carries a `COPY --from=` of a harmless file from each so the image

prompts/REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-10-04
+last_modified: 2026-10-03
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -160,7 +160,7 @@ style conventions are in separate documents:
 - **The gate phases are separate stages, and the build stage depends on both.**
   The lint phase is based on the `golangci/golangci-lint` image (pinned by
   hash), so lint failures surface in seconds rather than after a full compile,
-  and the test phase is based on the Debian Go image. The canonical Go repo
+  and the test phase is based on the Go image. The canonical Go repo
   `Dockerfile`:
 
     ```dockerfile
@@ -173,9 +173,8 @@ style conventions are in separate documents:
     COPY . .
     RUN golangci-lint run --config .golangci.yml ./...
 
-    # Test phase. -race needs cgo and so a C compiler, which the Debian Go
-    # image ships and the alpine one does not.
-    # golang:1.x, YYYY-MM-DD
+    # Test phase
+    # golang:1.x-alpine, YYYY-MM-DD
     FROM golang@sha256:... AS test
     WORKDIR /src
     COPY go.mod go.sum ./
@@ -193,8 +192,6 @@ style conventions are in separate documents:
     COPY --from=lint /src/go.sum /dev/null
     COPY --from=test /src/go.sum /dev/null
     RUN apk add --no-cache git
-    # A tar-stream context keeps the sender's file owners, which git refuses.
-    RUN git config --system --add safe.directory /src
     WORKDIR /src
     COPY go.mod go.sum ./
     RUN go mod download
@@ -239,23 +236,19 @@ style conventions are in separate documents:
     - If the project requires CGO or system libraries for linting (e.g.
       `vips-dev`), install them in the lint phase with `apk add`.
     - `.dockerignore` lets `.git` into the build context. It keeps out
-      `.git/config` and each submodule's `config` under `.git/modules/` at any
-      depth (`.git/modules/**/config`), which `git describe` does not need and
-      which can hold a credential: a password in a remote URL, or the token the
-      CI checkout step stores there. The stage that compiles has `git` (the
-      Debian Go image has it; an alpine one needs `apk add --no-cache git`) and
-      takes the version from the `VERSION` build argument when one is given,
-      otherwise from `git describe --tags --always`. That gives the tag on a
-      tagged commit; on a later commit, the tag, the number of commits since it
-      and the short commit (`v1.2.3-4-gabc1234`); and the short commit when no
-      tag is reachable. The stage that compiles also marks its working directory
-      safe for git (`git config --system --add safe.directory /src`): a context
-      sent as a tar stream keeps the sender's file owners, and git refuses a
-      checkout owned by another user, so the version would come out empty.
-      `ARG VERSION` has no default, and the build fails if the context carries
-      `.git` and the version still comes out empty, `dev` or `unknown`. A plain
-      `docker build .` with no build arguments must succeed; a Dockerfile that
-      refuses an empty build argument drops that refusal and keeps the argument.
+      `.git/config`, which `git describe` does not need and which can hold a
+      credential: a password in a remote URL, or the token the CI checkout step
+      stores there. The stage that compiles has `git` (the Debian Go image has
+      it; an alpine one needs `apk add --no-cache git`) and takes the version
+      from the `VERSION` build argument when one is given, otherwise from
+      `git describe --tags --always`. That gives the tag on a tagged commit; on
+      a later commit, the tag, the number of commits since it and the short
+      commit (`v1.2.3-4-gabc1234`); and the short commit when no tag is
+      reachable. `ARG VERSION` has no default, and the build fails if the
+      context carries `.git` and the version still comes out empty, `dev` or
+      `unknown`. A plain `docker build .` with no build arguments must succeed;
+      a Dockerfile that refuses an empty build argument drops that refusal and
+      keeps the argument.
 
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
   runs `script/cibuild` on push, and checks out the repo as its only other step.