depguard was in the disable list. It is now enabled with one rule, test-support: in files that are neither test files nor inside a package whose
directory name ends in test, the imports named under deny are refused.
Canonical denies net/http/httptest, which serves tests only and is the same
in every repository.
This replaces internal/testimportgate in sneak/homoicon, a package whose only
job was to refuse a non-test Go file importing an in-module package whose last
path segment ends in test. sneak ruled on sneak/homoicon#1029 that the rule moves into linter
configuration here.
depguard cannot express that rule generically. Its package lists are prefix
lists -- its own README says so, and I confirmed it: *test, **test and $gomod/**test each match nothing, while a full import path matches. "In
module" is not generic either, since the module path differs per repository.
And depguard refuses a rule with no allow or deny list, so this file cannot
ship the rule pre-armed and empty for each repository to fill in.
The closest expressible rule is the one here. The file half is generic and
exact; the package half is a deny list each repository extends with its own
test-support packages, by full import path. REPO_POLICIES.md now says that list
is the one part of a vendored copy a repository may add to.
Tested with golangci-lint v2.12.2 on a scratch module: a production file
importing a denied *test package fails, and the same import from a _test.go
file and from inside the *test package passes. make check here is green.
Model: opus-5
`depguard` was in the disable list. It is now enabled with one rule,
`test-support`: in files that are neither test files nor inside a package whose
directory name ends in `test`, the imports named under `deny` are refused.
Canonical denies `net/http/httptest`, which serves tests only and is the same
in every repository.
This replaces `internal/testimportgate` in sneak/homoicon, a package whose only
job was to refuse a non-test Go file importing an in-module package whose last
path segment ends in `test`. sneak ruled on
https://git.eeqj.de/sneak/homoicon/issues/1029 that the rule moves into linter
configuration here.
depguard cannot express that rule generically. Its package lists are prefix
lists -- its own README says so, and I confirmed it: `*test`, `**test` and
`$gomod/**test` each match nothing, while a full import path matches. "In
module" is not generic either, since the module path differs per repository.
And depguard refuses a rule with no allow or deny list, so this file cannot
ship the rule pre-armed and empty for each repository to fill in.
The closest expressible rule is the one here. The file half is generic and
exact; the package half is a deny list each repository extends with its own
test-support packages, by full import path. REPO_POLICIES.md now says that list
is the one part of a vendored copy a repository may add to.
Tested with golangci-lint v2.12.2 on a scratch module: a production file
importing a denied `*test` package fails, and the same import from a `_test.go`
file and from inside the `*test` package passes. `make check` here is green.
Model: opus-5
sneak
was assigned by clawbot2026-09-06 03:23:52 +02:00
Test-support code exists to hand a test privileges the program itself
must never have, so it must not be compiled into the shipped binary.
depguard now states that rule: in files that are neither tests nor
inside a package whose directory name ends in test, the denied imports
are refused.
depguard matches an import path against a list of prefixes, so it
cannot be told "any path whose last segment ends in test". A repo's own
test-support packages therefore have to be named one at a time under
deny, by full import path, and the policy paragraph now says that list
is the one part of the vendored copy a repo may extend.
Requested by sneak on
sneak/homoicon#1029 to replace a
per-repository check written as a Go test.
Model: opus-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
depguardwas in the disable list. It is now enabled with one rule,test-support: in files that are neither test files nor inside a package whosedirectory name ends in
test, the imports named underdenyare refused.Canonical denies
net/http/httptest, which serves tests only and is the samein every repository.
This replaces
internal/testimportgatein sneak/homoicon, a package whose onlyjob was to refuse a non-test Go file importing an in-module package whose last
path segment ends in
test. sneak ruled onsneak/homoicon#1029 that the rule moves into linter
configuration here.
depguard cannot express that rule generically. Its package lists are prefix
lists -- its own README says so, and I confirmed it:
*test,**testand$gomod/**testeach match nothing, while a full import path matches. "Inmodule" is not generic either, since the module path differs per repository.
And depguard refuses a rule with no allow or deny list, so this file cannot
ship the rule pre-armed and empty for each repository to fill in.
The closest expressible rule is the one here. The file half is generic and
exact; the package half is a deny list each repository extends with its own
test-support packages, by full import path. REPO_POLICIES.md now says that list
is the one part of a vendored copy a repository may add to.
Tested with golangci-lint v2.12.2 on a scratch module: a production file
importing a denied
*testpackage fails, and the same import from a_test.gofile and from inside the
*testpackage passes.make checkhere is green.Model: opus-5
clawbot referenced this pull request2026-09-08 06:16:51 +02:00