sneak
1e21653f44
All checks were successful
check / check (push) Successful in 15s
script/lint runs the linter directly when it is already inside a container and otherwise builds Dockerfile.lint, so the linter never runs on a developer host. That closes three host-only mechanisms: the result cache golangci-lint keys on file content rather than location, which produced a confirmed false green and findings reported against other checkouts; the host-global $TMPDIR/golangci-lint.lock, which fails a run in a way no caller can distinguish from findings; and host/container version skew, which hid thirteen findings on one repo. Detection is on LINT_IN_CONTAINER=1, set by every Dockerfile, and on nothing else. The two directions are not symmetric: a false negative inside a container attempts a nested docker build, finds no daemon and fails loudly, while a false positive on a host silently lints there, which is the defect this issue exists to kill. /.dockerenv is therefore rejected even as a fallback -- measured absent inside BuildKit RUN steps and present on any host that is itself a container, so it fails in both directions and one of them is the dangerous one. Nothing else changes shape. The Dockerfile still runs make check, script/check still runs test, lint and fmt-check, script/cibuild is still a single docker build with CHECK_EPOCH and VERSION, and the Go multistage lint stage and its COPY --from=lint ordering dependency survive with ENV LINT_IN_CONTAINER=1 added. Dockerfile.lint is the standalone developer-host path and carries the same CHECK_EPOCH guard, with the ARG below the dependency layer so only the lint re-runs. The script/bootstrap golangci-lint install and the per-checkout GOLANGCI_LINT_CACHE/TMPDIR wrapper are deleted as superseded. Neither has a caller left. A JS repo's yarn install stays: the rule is that no lint verdict may come from a host invocation, not that no linter binary may exist there, and in a repo whose formatter is its linter the formatter necessarily runs on the host. golangci-lint config verify is kept, on measurement. Under the pinned v2.12.2 a bogus top-level key and a bogus key under linters.settings.lll both pass `golangci-lint run` with exit 0 and `0 issues` while config verify exits 3 and names them; an unknown linter name fails run and passes config verify. It needs no network: every case reproduced byte-identically under `docker run --network none`, in a container where `getent hosts golangci-lint.run` exits 2. Comment blocks were cut hard across every file this unit touches. .dockerignore drops from 67 comment lines to 28, script/cibuild from 17 to 12, script/docker from 18 to 12, and prompts/REPO_POLICIES.md from 1182 lines to 907. What remains says why a line is load-bearing; the discovery narratives are gone.
59 lines
2.0 KiB
Plaintext
59 lines
2.0 KiB
Plaintext
# .dockerignore does NOT use .gitignore semantics. Docker matches with
|
|
# moby/patternmatcher: filepath.Match plus `**`, so `*` does not cross
|
|
# `/` and an unprefixed pattern is anchored at the context root. Every
|
|
# depth-independent pattern therefore needs `**/`, or `config/.env` and
|
|
# `certs/server.key` still ship while the file reads as solved. Only
|
|
# genuinely root-anchored entries go unprefixed. Never transplant these
|
|
# into .gitignore, where `**/` is wrong.
|
|
#
|
|
# Matching is case-sensitive, so secrets use character ranges rather
|
|
# than an ALL-CAPS twin, which would still miss `Server.Key`.
|
|
#
|
|
# Extend with this repo's own host-built artifacts, written anchored:
|
|
# `/myapp`, never `**/myapp`, which also matches `cmd/myapp/` and
|
|
# deletes the package directory from the context.
|
|
|
|
# Excluding .git means `git describe` cannot run in any build stage and
|
|
# fails quietly there; pass the version in with --build-arg VERSION.
|
|
.git
|
|
|
|
# Agent scratch: one full checkout of the repo per in-flight agent.
|
|
# Anchored because it occurs once where agents run at the repo root.
|
|
# KNOWN GAP: a repo running agents in subdirectories still ships
|
|
# `services/api/.claude/` and must add its own anchored entry.
|
|
.claude
|
|
|
|
# Environment files. `*.env` covers bare `.env` and the `prod.env`
|
|
# convention. Re-include a committed template with a negation if the
|
|
# build needs one: `!docs/example.env`.
|
|
**/*.[eE][nN][vV]
|
|
**/.[eE][nN][vV].*
|
|
**/.[eE][nN][vV][rR][cC]
|
|
|
|
# Private keys and the bundles carrying them. Public certificates
|
|
# (*.crt, *.cer) are deliberately absent: they are legitimate inputs.
|
|
**/*.[pP][eE][mM]
|
|
**/*.[kK][eE][yY]
|
|
**/*.[pP]12
|
|
**/*.[pP][fF][xX]
|
|
**/[iI][dD]_[rR][sS][aA]
|
|
**/[iI][dD]_[dD][sS][aA]
|
|
**/[iI][dD]_[eE][cC][dD][sS][aA]
|
|
**/[iI][dD]_[eE][dD]25519
|
|
|
|
# Dependencies: restored inside the image, never copied in.
|
|
**/node_modules
|
|
|
|
# OS metadata.
|
|
**/.DS_Store
|
|
**/Thumbs.db
|
|
|
|
# Editor state: never a build input, and it churns COPY.
|
|
**/*.swp
|
|
**/*.swo
|
|
**/*~
|
|
**/*.bak
|
|
**/.idea
|
|
**/.vscode
|
|
**/*.sublime-*
|