Check builds keep Go's build cache, Go's downloaded modules, golangci-lint's cache and the system-package install. script/ passes a new CACHEBUST build argument in place of --no-cache; in each Dockerfile stage the package install and module download come before ARG CACHEBUST and every lint, test and build step after it; both go test runs carry -count=1. A repository takes the scripts and the Dockerfile order in one commit.
The image version comes from git describe inside the build. .dockerignore sends .git without any git config, reversing the rule that excluded .git; a build from a linked worktree passes --build-arg VERSION.
Dockerfile example: -race works, the builder trusts /src, lint-phase libraries use apt-get, stages say when they run script/bootstrap; the lint and test builds write no image.
golangci-lint v2.14.0 lints Go 1.27; exhaustruct_v5 and canonicalheader are disabled; the lint digest and .golangci.yml change in one commit. .golangci.yml accepts one local replace, homoicon's copy of sobek, on sneak's decision; every other local replace is still refused.
Ignore files keep out more secrets; a repository's own .gitignore and .editorconfig entries survive a re-vendor.
CI: the check job has a 20-minute limit, cancels a replaced run, leaves no token in .git/config, and fetches tags.
Go: fx owns signals and the exit code; runtime.GOARCH at run time; host tools via commit-pinned go install.
script/bootstrap refreshes apt's package lists once and installs the pinned node when another major version is installed; script/ stops when script/projectname fails.
Also: one root AGENTS.md; checks proven by a planted defect; no CHECK_EPOCH; TODO.md union merge; the canonical package.json is private instead of declaring MIT.
Recorded gap: a submodule with a config segment in its name.
Unverified: the kept caches have not yet run on the shared CI runner.
Consuming repositories re-vendor these, tracked in #78.
Model: opus-5-5
On `next`, for the files every repository vendors:
- Check builds keep Go's build cache, Go's downloaded modules, golangci-lint's cache and the system-package install. `script/` passes a new `CACHEBUST` build argument in place of `--no-cache`; in each `Dockerfile` stage the package install and module download come before `ARG CACHEBUST` and every lint, test and build step after it; both `go test` runs carry `-count=1`. A repository takes the scripts and the `Dockerfile` order in one commit.
- The image version comes from `git describe` inside the build. `.dockerignore` sends `.git` without any git `config`, reversing the rule that excluded `.git`; a build from a linked worktree passes `--build-arg VERSION`.
- Dockerfile example: `-race` works, the builder trusts `/src`, lint-phase libraries use `apt-get`, stages say when they run `script/bootstrap`; the lint and test builds write no image.
- golangci-lint v2.14.0 lints Go 1.27; `exhaustruct_v5` and `canonicalheader` are disabled; the lint digest and `.golangci.yml` change in one commit. `.golangci.yml` accepts one local `replace`, homoicon's copy of sobek, on sneak's decision; every other local `replace` is still refused.
- Ignore files keep out more secrets; a repository's own `.gitignore` and `.editorconfig` entries survive a re-vendor.
- CI: the check job has a 20-minute limit, cancels a replaced run, leaves no token in `.git/config`, and fetches tags.
- Go: fx owns signals and the exit code; `runtime.GOARCH` at run time; host tools via commit-pinned `go install`.
- `script/bootstrap` refreshes apt's package lists once and installs the pinned node when another major version is installed; `script/` stops when `script/projectname` fails.
- Also: one root `AGENTS.md`; checks proven by a planted defect; no `CHECK_EPOCH`; `TODO.md` union merge; the canonical `package.json` is private instead of declaring MIT.
Recorded gap: a submodule with a `config` segment in its name.
Unverified: the kept caches have not yet run on the shared CI runner.
Consuming repositories re-vendor these, tracked in https://git.eeqj.de/sneak/prompts/issues/78.
Model: opus-5-5
The Go styleguide and the HTTP server conventions no longer pass the
build architecture in through the Makefile. The Buildarch variable,
globals field and BUILDARCH Makefile lines are removed from every
example; the styleguide example prints runtime.GOARCH, and the
logger's Identify logs "arch", runtime.GOARCH. The styleguide item
gains one sentence saying so.
Model: opus-5-5
The canonical documents told every repo to exclude .git from the build
context, default ARG VERSION to dev and never run git describe in a
build stage, so an image built from a clone with no build argument
reported dev. .dockerignore now sends .git but keeps out .git/config,
which can hold a credential. The Dockerfile example installs git, takes
the VERSION build argument when one is given and otherwise
git describe --tags --always, and fails when .git exists but the version
is empty, dev or unknown. The policy and both checklists state the rule
in the same words, including that a plain docker build . with no build
arguments must succeed.
Model: opus-5-5
clawbot
changed title from next → main: read the architecture at run time to next → main: architecture at run time, version from git2026-10-02 04:38:22 +02:00
The canonical .gitignore matched only .env, .env.*, *.pem and *.key, so prod.env, .envrc, *.p12 and *.pfx bundles, and the SSH private keys id_rsa, id_dsa, id_ecdsa and id_ed25519 could be committed. The secrets section now covers the same shapes as the canonical .dockerignore, written to gitignore's own rules: unanchored, no **/ prefix, character ranges for case. example.env and sample.env stay trackable through negations, and the comment tells a repository to add its own negation for any other committed template.
Judgement call: the existing entries were rewritten with character ranges, which only widens them, and the bare .env line is dropped because *.env covers it.
Model: opus-5-5
clawbot
changed title from next → main: architecture at run time, version from git to next → main: architecture at run time, version from git, secrets in .gitignore2026-10-03 17:41:27 +02:00
The canonical golangci-lint moves from v2.12.2 to v2.14.0, built with go1.27: v2.12.2 refuses a module whose `go` directive names 1.27 or later. The policy now states the rule: the `go` directive must not name a newer Go minor version than the one golangci-lint was built with.
From v2.13.0, `default: all` turns on `exhaustruct_v5`, the successor of the deprecated `exhaustruct`. `.golangci.yml` disables it beside the old name, which stays listed or its deprecation warning returns.
v2.12.2 rejects the new `.golangci.yml`, so a repo changes the lint phase digest and re-vendors `.golangci.yml` in one commit; both checklists point to that rule.
Model: opus-5-5
clawbot
changed title from next → main: architecture at run time, version from git, secrets in .gitignore to next → main: architecture at run time, version from git, secrets in .gitignore, golangci-lint v2.14.02026-10-04 03:32:46 +02:00
The canonical Go `Dockerfile` example in `prompts/REPO_POLICIES.md` had two defects.
The test phase ran `go test -race` on the alpine Go image, which has no C compiler, so `-race` failed before any test ran. The test phase now uses the Debian Go image, pinned by digest like the others.
A build context sent as a tar stream keeps the sender's file owners, so git refused the checkout and the version step failed the build. The builder stage now runs `git config --system --add safe.directory /src`; the policy and both checklists say why in the same words.
The builder's `apk add --no-cache git` line is unchanged: whether it must be pinned is the open owner question on #72.
Model: opus-5-5
The canonical `.dockerignore` kept out `.git/config`, which can hold a credential, but not the `config` in each submodule's git directory under `.git/modules/`, nested again for a submodule's own submodules. It now also lists `.git/modules/**/config`, with one sentence in the comment above; `prompts/REPO_POLICIES.md` and both checklists say so in the same words.
The pattern stays under `.git/modules/` because `.git/**/config` would also drop a branch or tag named `config`, which `git describe` may need.
Known gap: a submodule whose name has a `config` path segment loses its whole git directory, so Go's version stamping fails the build loudly; tracked separately.
Model: opus-5-5
The Makefile examples in `prompts/CODE_STYLEGUIDE_GO.md` and `prompts/GO_HTTP_SERVER_CONVENTIONS.md` now read `VERSION ?= $(or $(shell git describe --tags --always 2>/dev/null),dev)`.
When `git describe` prints nothing (outside a git checkout, or where git is missing or refuses the checkout) the old line stamped an empty version without a word; it now falls back to `dev`, the same way in every repo. The comment above each line says so.
In a Docker build stage with `.git` present, a real version needs git installed and the checkout trusted, as the canonical `Dockerfile` does; the `Dockerfile` already fails when the version comes out empty, `dev` or `unknown`.
Model: opus-5-5
The note under the canonical Go `make test` example in `prompts/REPO_POLICIES.md` named a cache-busting build argument that `--no-cache` replaced, and said Go's test result cache survived in earlier image layers. Neither is true of the current files.
The note now says where that cache can replay a pass: on a developer's machine, where the Makefile target runs, so both invocations there keep `-count=1`. The `test` phase of the `Dockerfile` has nothing to replay, since its base image holds no result for the repo's tests and no step before `go test` runs one, so it needs no `-count=1`. Go stores only passing results, so neither run can report a stored pass.
Model: opus-5-5
Writes down sneak's 2026-08-22 ruling: the in-repo memory rule that older vendored copies of `REPO_POLICIES.md` still carry was retired, not lost.
`prompts/REPO_POLICIES.md` gains one bullet after the files a new repo must contain: guidance for coding agents lives in one `AGENTS.md` at the repository root, never under a file or directory named after one agent tool, and never split into separate memory files. `AGENTS.md` joins the files allowed in the repo root, which would otherwise forbid it. Both checklists get the matching item; the existing-repo one says to move such a file's content into `AGENTS.md` and delete it.
The Dockerfile finding at the end of the issue is tracked in #90.
Model: opus-5-5
`package.json` now carries `"license": "MIT"`, matching `LICENSE`. Without it yarn printed `warning package.json: No license field` and `warning No license field` each time `script/bootstrap` ran inside the Docker phases of `make check`. No other yarn warning appears in the bootstrap output.
Model: opus-5-5
`ssh-keygen` names the private key of a key backed by a hardware security key `id_ecdsa_sk` or `id_ed25519_sk`. The canonical `.gitignore` and `.dockerignore` listed only `id_rsa`, `id_dsa`, `id_ecdsa` and `id_ed25519`, so a repository could commit these files or copy them into an image.
Both names are added beside their plain counterparts in each file's own style: unanchored in `.gitignore`, `**/`-prefixed in `.dockerignore`, case-folded with character ranges in both. A pattern matches the whole file name, so the `.pub` halves stay trackable and still reach the build context.
Model: opus-5-5
Writes sneak's 2026-09-09 ruling ("commit pinned installation, not pulled into deps") into the `prompts/REPO_POLICIES.md` bullet that says `script/bootstrap` installs a pinned tool by comparing versions: a Go tool a repo needs on the host is installed with `go install` pinned to a commit hash, naming the tool's main package, and is never tracked as a `go.mod` tool dependency or through a `tools.go` file, either of which pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`.
golangci-lint is unchanged: no repo installs it on the host, and it stays pinned by its image digest.
Model: opus-5-5
The server lifecycle example in `prompts/GO_HTTP_SERVER_CONVENTIONS.md` dropped its exit code, installed its own SIGINT/SIGTERM handler beside the one fx's `Run()` installs, and exited from a goroutine when Sentry could not start, so no stop hook ran.
fx now owns signals and the exit code: `main` calls `Run()`; a listen error shuts fx down with `fx.ExitCode(1)` through `fx.Shutdowner`; `enableSentry()` returns its error from the start hook; the stop hook shuts the HTTP server down within 5 seconds, flushes Sentry, and fails when requests are still running. The start hook builds the HTTP server before the listen goroutine so the stop hook can reach it. A new paragraph says who owns signals and the exit code.
Model: opus-5-5
A key point under the canonical Go `Dockerfile` example in `prompts/REPO_POLICIES.md` said to install lint-phase system libraries with `apk add`. The lint phase is built on the golangci-lint image, which is Debian-based and has no `apk`, and `vips-dev` is the alpine package name. The point now gives the `apt-get` command with the Debian package name (`libvips-dev`) and removes the package lists in the same `RUN`.
The other `apk` mentions are about the alpine build stage or `script/bootstrap` on the host and stay. Nothing is pinned or unpinned; that is the open owner question on #72.
Model: opus-5-5
A submodule that keeps its own `.git` directory, instead of one under `.git/modules/`, still shipped `sub/.git/config` into the build context, credential included. Both git patterns in the canonical `.dockerignore` now start with `**/`: `**/.git/config` and `**/.git/modules/**/config`.
A submodule whose name has a `config` segment (`config`, `deploy/config`, `config/lib`) still loses its whole git directory, because the pattern also matches that directory, and Go's version stamping then fails the build loudly. The file records this as a known gap with the way around it, `git submodule add --name`; closing it needs a wildcard re-include that makes every build walk excluded directories. `prompts/REPO_POLICIES.md` and both checklists say the same.
Model: opus-5-5
Every PR here adds an entry at the top of Completed Steps in `TODO.md`, so each merge to `next` left the other open PRs conflicting there. A root `.gitattributes` now marks `TODO.md` with `merge=union`: when two branches insert at the same place, git keeps both sides. It applies to this repository only; nothing canonical changes.
Union never reports a conflict in `TODO.md`. When two new entries share an identical line, one can land inside the other, and a rebased entry sits below every entry that reached `next` after the branch was cut, so the merged entries are read after every merge or rebase. Whether Gitea's own conflict check applies the attribute is not known.
Model: opus-5-5
The bullet in `prompts/REPO_POLICIES.md` that requires a `Dockerfile` said every Dockerfile installs its prerequisites by running `script/bootstrap`, which the canonical Go `Dockerfile` in the same file never does. Reading the example as the deliberate one, the bullet now says the gate phases and the build stage start from their pinned base images and install what those images lack either inline, as the Go example does for `git`, or by running `script/bootstrap`, as this repository's own `Dockerfile` does for its yarn packages; the development environment stage of a non-server repo runs `script/bootstrap`. The new repo checklist item says the same.
The `COPY --from=` lines and the build stage's `apk add` line are unchanged.
Model: opus-5-5
Of the cross-repository findings recorded on 2026-08-09, two were rules a repository must follow that `prompts/REPO_POLICIES.md` did not yet state, and each now sits in the paragraph a reader would be in. A new or changed check is proven by planting a defect it must catch and watching the run fail, since a green run alone does not show the check ran. A separate workflow limited to `main` by a `branches` list is first run from the feature branch by adding that branch to the list and removing it before merging, with any publishing job kept behind `if: github.ref_name == 'main'`.
The other findings are dropped, each with its reason on the issue; the `config verify` warning goes by sneak's ruling on #40 that there is no config check step.
Model: opus-5-5
clawbot
changed title from next → main: architecture at run time, version from git, secrets in .gitignore, golangci-lint v2.14.0 to next → main: version from git, golangci-lint v2.14.0, Dockerfile and ignore-file fixes2026-10-04 15:15:16 +02:00
Back to needs-checks: the check on next is red because the shared Actions runner fails every job in its checkout step, not because of anything on this branch. That fault is sneak/project-management#27. This PR goes back to merge-ready once the check on its head re-runs green.
Model: opus-5-5
Back to `needs-checks`: the check on `next` is red because the shared Actions runner fails every job in its checkout step, not because of anything on this branch. That fault is https://git.eeqj.de/sneak/project-management/issues/27. This PR goes back to `merge-ready` once the check on its head re-runs green.
Model: opus-5-5
`script/cibuild`, `script/docker`, `script/lint` and `script/test` passed the image tag from `script/projectname` inline in the `docker build` arguments. A failing command substitution inside an argument does not trip `set -e`, so the scripts went on to `docker build` with an empty, `-lint` or `-test` tag, against the rule their own comment states. Each now assigns `tag` on its own line before `docker build`, so the script stops where `script/projectname` fails. The snippets in `prompts/REPO_POLICIES.md` show the same form, and the policy states the own-line rule.
Consuming repositories pick this up on their next re-vendor; the defect failed closed.
Model: opus-5-5
Back to merge-ready: sneak ruled that the server-side check gates nothing and a local make check is trusted (sneak/keyfunc#28 (comment)).
Model: opus-5-5
Back to `merge-ready`: sneak ruled that the server-side check gates nothing and a local `make check` is trusted (https://git.eeqj.de/sneak/keyfunc/pulls/28#issuecomment-127051).
Model: opus-5-5
The canonical `.gitignore` had no place for a repository's own build outputs, and nothing said a repository's own `.editorconfig` sections survive a re-vendor, so re-vendoring dropped them: a Go repository lost `/bin/`, `*.test` and `*.out`, and its tabs for Go files.
`.gitignore` now ends with a section, like `.dockerignore`'s header, where a repository adds its own build outputs (a root binary written `/myapp`) and its own environment-template negations, which a re-vendor keeps. `.editorconfig` gains `[*.go]` with tabs and the same kind of closing note. `prompts/REPO_POLICIES.md`, both checklists and the Go styleguide say these two files are the canonical content followed by the repository's own entries. Closes #104 too.
Model: opus-5-5
In golangci-lint v2.14.0, `canonicalheader` misses findings at random in a package that also calls `ResponseWriter.Header()`: on the same tree, repeated runs sometimes reported a non-canonical header key and sometimes reported nothing. So one commit could fail lint on one run and pass on the next, in every Go repository that vendors this file. Reproduced with the pinned image and the canonical config.
The canonical `.golangci.yml` now disables it, with a comment saying it comes back once a pinned golangci-lint release fixes it. New `.golangci.yml` sha256: `e49052a1418127b54b20cea530dfd3cc6ddfc126a9fd27fd570ccca1a3f18bc7`.
Model: opus-5-5
The canonical `.gitea/workflows/check.yml` lacked two settings `dnswatcher` had added, so a byte-identical re-vendor removed them. A `concurrency` block grouped by workflow and branch, with `cancel-in-progress: true`, makes a new push cancel the older run on the same branch and leaves every other branch's runs alone; on 2026-10-02 45 stale runs had queued on the one shared runner. `persist-credentials: false` on the checkout step keeps the job's token out of `.git/config`; `script/cibuild` needs no token. Each has a one-line comment, and the policy's workflow bullet and both checklists describe the file as it now is.
Unverified: the two live checks, which wait on the shared runner.
Model: opus-5-5
A plain `docker build .` from a checkout whose `.git` is a file (a linked worktree, or a repository checked out as a submodule) stops at the version check of the canonical `Dockerfile` example: that file points to a git directory outside the build context, so `git describe` prints nothing. The check is right to refuse an empty version; what was missing is what to do. `prompts/REPO_POLICIES.md` and both checklists now say such a build is given its version with `--build-arg VERSION=...`, as `script/docker` and `script/cibuild` already do. The check itself is unchanged.
Model: opus-5-5
`pkg_install` in the canonical `script/bootstrap` ran `apt-get install` with no `apt-get update` before it. The Gitea runner image starts with empty package lists, so a repository's own `pkg_install` of anything the image lacks, Go included, failed with "Unable to locate package". The apt branch now refreshes the lists once, before the first install of a run, in the same `$SUDO env DEBIAN_FRONTEND=noninteractive` form, and skips the refresh on later calls. nix, brew and apk are unchanged. Repositories that refresh in their own section, or changed their copy, drop that at their next re-vendor.
Model: opus-5-5
The policy said a repository whose version comes from git tags needs `fetch-depth: 0` on its CI checkout, because the checkout action clones shallow with no tags; every repository's version comes from `git describe --tags --always`, but the canonical `.gitea/workflows/check.yml` did not set it, so CI stamped a bare short commit id where a local build of a tagged repository stamps the tag. The checkout step now sets `fetch-depth: 0` with a one-line comment, and the workflow bullet of `prompts/REPO_POLICIES.md` and both checklists name it beside `persist-credentials: false` and the `concurrency` block, as part of what the workflow does.
Unverified: a live run, which waits on the shared runner.
Model: opus-5-5
Repositories copy package.json to get prettier, and with "license": "MIT"
each of them declared MIT whatever its own licence is. "private": true
keeps yarn from printing "No license field" and makes no licence claim.
This repository's LICENSE and README License section are unchanged.
Model: opus-5-5
The canonical check workflow gave its job no time limit, so a hung
script/cibuild held the shared runner until the runner's own default.
The check job now sets timeout-minutes: 20. script/cibuild runs three
Docker builds (the test phase, the lint phase, then the image, which
runs both again), each held to the 5-minute build limit, plus the
bootstrap. REPO_POLICIES.md and both checklists name the limit among
what the workflow sets.
Model: opus-5-5
script/lint and script/test build their Dockerfile phase with
--output type=cacheonly in place of a tag. The phase still runs
uncached and a failing step still fails the build, but no image is
written: nothing used those images, and writing one out took about 16
seconds of a Go repository's test build. script/cibuild and
script/docker keep their tags. REPO_POLICIES.md, both checklists and
the README now say the gate builds write no image.
Model: opus-5-5
The new-repository checklist gave script/cibuild's image build without a
tag, so a repository written from it left a dangling image behind on
every run, and it used $version without saying where it comes from. The
item now gives the build as the canonical script/cibuild runs it, with
-t "$tag", and names the two steps the script runs before it, each on
its own line: the version from git describe --tags --always --dirty
(unknown if empty) and the tag from script/projectname. The other docker
build commands the checklists and REPO_POLICIES.md give for script/
already matched their scripts.
Model: opus-5-5
script/bootstrap used whatever node was installed, so on the CI runner
image, which ships node 24, the pinned yarn 1.22.22 printed the
deprecation warning DEP0169 on every bootstrap. It now uses the
installed node only when its major version is the pinned one, and
otherwise installs the pinned node with nvm, as it already did when node
was missing, with yarn and the packages under it. It prints the node
version it uses. Only the major is compared because the Dockerfile
stages use a node 22 alpine image that nvm cannot replace. script/fmt
and script/fmt-check carry the same test to pick their yarn: the yarn on
PATH, or yarn under the pinned node loaded through nvm.
Model: opus-5-5
The script/ builds pass a new CACHEBUST build argument on every run in
place of --no-cache, which also emptied Go's build cache mount. Every
Dockerfile stage declares ARG CACHEBUST first, so every RUN step still
reruns on an unchanged tree. The canonical Go Dockerfile mounts only
Go's build cache, on the steps that compile, so compiled packages
survive between check builds; both go test runs carry -count=1, so no
test result is reused. golangci-lint's own cache and the module cache
are not kept.
A repository re-vendors the scripts and adds the ARG lines in one
commit: a stage without the line is served from cache with no warning.
Unverified: not yet tried on the shared CI runner.
Model: opus-5-5
On sneak's ruling in #130, check
builds keep three more things besides Go's build cache. In each stage of
the canonical Go Dockerfile, the system-package install and the module
download come before ARG CACHEBUST, so Docker keeps those layers until
the base image, the install line, go.mod or go.sum changes. Modules are
kept as a layer, not a cache mount, because Go does not check a cache
mount's files again. golangci-lint run also mounts golangci-lint's cache.
Every step that lints, tests or compiles still comes after ARG CACHEBUST,
both go test runs keep -count=1, and a step that also installs node
packages stays below the line. The policy, checklists, Go style guide,
README and script comments say the same.
Model: opus-5-5
sneak decided that homoicon keeps a local copy of sobek, its JavaScript
engine, and fixes it in its own tree
(sneak/homoicon#1759 (comment)).
homoicon's go.mod now replaces sobek with ./third_party/sobek, which
gomoddirectives refuses. The canonical .golangci.yml gains an exclusion
for exactly that report: a local replace of github.com/grafana/sobek in
a repository's root go.mod. Every other local replace is still refused.
It is an exclusion rather than a replace-allow-list entry because
gomoddirectives does not check that list for a replace that points at a
local path. TODO.md records the change.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
On
next, for the files every repository vendors:script/passes a newCACHEBUSTbuild argument in place of--no-cache; in eachDockerfilestage the package install and module download come beforeARG CACHEBUSTand every lint, test and build step after it; bothgo testruns carry-count=1. A repository takes the scripts and theDockerfileorder in one commit.git describeinside the build..dockerignoresends.gitwithout any gitconfig, reversing the rule that excluded.git; a build from a linked worktree passes--build-arg VERSION.-raceworks, the builder trusts/src, lint-phase libraries useapt-get, stages say when they runscript/bootstrap; the lint and test builds write no image.exhaustruct_v5andcanonicalheaderare disabled; the lint digest and.golangci.ymlchange in one commit..golangci.ymlaccepts one localreplace, homoicon's copy of sobek, on sneak's decision; every other localreplaceis still refused..gitignoreand.editorconfigentries survive a re-vendor..git/config, and fetches tags.runtime.GOARCHat run time; host tools via commit-pinnedgo install.script/bootstraprefreshes apt's package lists once and installs the pinned node when another major version is installed;script/stops whenscript/projectnamefails.AGENTS.md; checks proven by a planted defect; noCHECK_EPOCH;TODO.mdunion merge; the canonicalpackage.jsonis private instead of declaring MIT.Recorded gap: a submodule with a
configsegment in its name.Unverified: the kept caches have not yet run on the shared CI runner.
Consuming repositories re-vendor these, tracked in #78.
Model: opus-5-5
next → main: read the architecture at run timeto next → main: architecture at run time, version from gitnext → main: architecture at run time, version from gitto next → main: architecture at run time, version from git, secrets in .gitignorenext → main: architecture at run time, version from git, secrets in .gitignoreto next → main: architecture at run time, version from git, secrets in .gitignore, golangci-lint v2.14.0Writes sneak's 2026-09-09 ruling ("commit pinned installation, not pulled into deps") into the `prompts/REPO_POLICIES.md` bullet that says `script/bootstrap` installs a pinned tool by comparing versions: a Go tool a repo needs on the host is installed with `go install` pinned to a commit hash, naming the tool's main package, and is never tracked as a `go.mod` tool dependency or through a `tools.go` file, either of which pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`. golangci-lint is unchanged: no repo installs it on the host, and it stays pinned by its image digest. Model: opus-5-5next → main: architecture at run time, version from git, secrets in .gitignore, golangci-lint v2.14.0to next → main: version from git, golangci-lint v2.14.0, Dockerfile and ignore-file fixesBack to
needs-checks: the check onnextis red because the shared Actions runner fails every job in its checkout step, not because of anything on this branch. That fault is sneak/project-management#27. This PR goes back tomerge-readyonce the check on its head re-runs green.Model: opus-5-5
Back to
merge-ready: sneak ruled that the server-side check gates nothing and a localmake checkis trusted (sneak/keyfunc#28 (comment)).Model: opus-5-5
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.