sneak/prompts
1
0
Fork 0
Code Issues 4 Pull Requests 1 Actions 25 Packages Projects Releases Wiki Activity

Pin host Go tools by commit hash with go install (closes #37) #91

Merged
clawbot merged 1 commits from issue-37-go-tool-pin into next 2026-10-04 09:49:14 +02:00
Conversation 5 Commits 1 Files Changed 2
+9
2 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TODO.md
+4
View File
@@ -21,6 +21,10 @@ fmt-check, and commit.
# Completed Steps # Completed Steps
- 2026-10-04: `REPO_POLICIES.md` now says how a Go tool a repo needs on the host
is pinned (issue 37): installed with `go install` pinned to a commit hash,
never tracked as a `go.mod` tool dependency or through a `tools.go` file.
golangci-lint is unaffected, since no repo installs it on the host.
- 2026-10-04: The canonical `.gitignore` and `.dockerignore` now also keep out - 2026-10-04: The canonical `.gitignore` and `.dockerignore` now also keep out
`id_ecdsa_sk` and `id_ed25519_sk`, the private key files `ssh-keygen` writes `id_ecdsa_sk` and `id_ed25519_sk`, the private key files `ssh-keygen` writes
for keys backed by a hardware security key (issue 81). Their `.pub` halves for keys backed by a hardware security key (issue 81). Their `.pub` halves
prompts/REPO_POLICIES.md
+5
View File
@@ -495,6 +495,11 @@ style conventions are in separate documents:
Keep it POSIX sh: no arrays, no `[[`, no `grep -P`. Keep it POSIX sh: no arrays, no `[[`, no `grep -P`.
A Go tool a repo needs on the host is installed with `go install` pinned to
a commit hash (`go install <package>@<commit hash>`). It is never tracked as
a `go.mod` tool dependency or through a `tools.go` file, either of which
pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`.
- When pinning images or packages by hash, add a comment above the reference - When pinning images or packages by hash, add a comment above the reference
with the version and date (YYYY-MM-DD). with the version and date (YYYY-MM-DD).