#!/bin/sh
# script/lint: run the linter. This is the ONLY source of a lint verdict
# in this repo — the linter runs in a container, one way, everywhere, so
# a run cannot inherit another checkout's cache, another process's lock,
# or a host toolchain that differs from the pinned one. Linting happens
# as a build step (see Dockerfile.lint), so a successful build is a
# clean lint, and it works where the docker daemon is remote and bind
# mounts are impossible.
#
# A failure here that names no finding is NOT a lint result: docker
# build exits 1 both for findings and for a build that never reached the
# lint step (daemon down, image unpullable, disk full). BuildKit names
# the failing step; read it, fix the environment, and re-run. Do not
# record a verdict from a run that did not lint.
set -eu

ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"

main() {
    cd "$ROOT"
    # Assign on its own line: a failing command substitution inside an
    # argument does not trip `set -e`, which would silently degrade the
    # nonce to an empty constant. `$$` is required because busybox `date`
    # drops %N without erroring. Without a fresh nonce the lint layer is
    # served from cache and this script exits 0 having linted nothing.
    epoch="$(date +%s%N)$$"
    docker build \
        --build-arg CHECK_EPOCH="$epoch" \
        -f Dockerfile.lint \
        .
}

main "$@"