Files

T

check / check (push) Successful in 26s

Details

Fix git ownership and -race in the canonical Go Dockerfile (closes #73 )

The test phase ran go test -race on the alpine Go image, which has no C
compiler, so cgo was off and the phase failed with "-race requires cgo"
before running a test. It now uses the Debian Go image.

A build context sent as a tar stream keeps the sender's file owners, so
git in the stage that compiles refused the checkout and the version came
out empty. That stage now runs
git config --system --add safe.directory /src, and the policy text and
both checklists say why. The apk add --no-cache git line is unchanged:
its pinning waits on #72.

Model: opus-5-5

2026-10-03 15:54:45 +00:00

6.6 KiB

Raw Blame History

Workflow

branch (from main)
do the work in Next Step
move Next Step to the top of Completed Steps
move the top item of Future Steps into Next Step
commit (TODO.md changes in the same commit as the work)
merge to main if the branch is not protected, otherwise open a PR
push

Status

pre-1.0

Next Step

Finish the two draft prompt documents in the working tree and commit them: prompts/FIXUP_CLEAN.md (currently a near-empty stub) and prompts/FIXUP_REPORT.md (a rough draft). Write the missing content, run make fmt so they pass fmt-check, and commit.

Completed Steps

2026-10-03: Fixed two defects in the canonical Go Dockerfile example (issue 73). The test phase now uses the Debian Go image, since -race needs cgo and the alpine image has no C compiler, so the phase failed before running a test. The stage that compiles runs git config --system --add safe.directory /src, because a context sent as a tar stream keeps the sender's file owners and git refuses that checkout, leaving the version empty. Both checklists state that step in the same words.
2026-10-03: Brought the canonical .gitignore level with .dockerignore on secrets (issue 38): it now also ignores prod.env-style *.env files, .envrc, *.p12, *.pfx and the extensionless SSH private keys, written to .gitignore's own rules (no **/ prefix) and case-folded with character ranges. example.env and sample.env stay trackable through negations.
2026-10-02: The image version now comes from git inside the build (issues 69 and 71), superseding the 2026-09-08 entry that excluded .git. The canonical .dockerignore sends .git but keeps out .git/config, which can hold a credential. The Dockerfile example in REPO_POLICIES.md installs git, takes the VERSION build argument when one is given and otherwise git describe --tags --always, and fails when .git exists but the version is empty, dev or unknown; a plain docker build . with no build arguments must succeed. This repo's script/docker and script/cibuild still pass --build-arg VERSION, since its own Dockerfile compiles nothing.
2026-09-08: Moved linting and testing into Docker as phases of the main Dockerfile, per the owner ruling on issue 40. script/lint and script/test build one phase each by name with --no-cache — the same answer issue 26 got, so no separate cache-busting mechanism survives — and the final stage copies a harmless file from both, so the image cannot be built unless they pass. This also closes issue 30: a container has its own result cache and its own lock, so a lint verdict can no longer belong to another checkout. No separate lint Dockerfile, and no golangci-lint config verify step. script/check runs the gates and nothing else, and script/cibuild bootstraps first, since it is all CI runs and script/fmt-check is native.
2026-09-08: Kept in-repo agent scratch out of the Docker build context and out of version control: .claude/ is one full checkout of the repo per in-flight agent, and under COPY . . all of it was reaching the image. Also closed the consequence of excluding .git — git describe yields an empty version inside a build stage without failing, so script/docker and script/cibuild now compute the version on the host and pass --build-arg VERSION.
2026-09-08: Closed the secret exposure in the canonical .dockerignore: a local .env, *.pem or *.key was reaching the build context under COPY . ., invisible to every git-based check. The patterns are now written to .dockerignore's own semantics — **/-prefixed so they hold at every depth, case-folded with character ranges — and REPO_POLICIES.md requires verifying by enumerating the image rather than by reading the file.
2026-09-08: Made a pinned tool in script/bootstrap actually reach the host. REPO_POLICIES.md now requires comparing the installed version against the pin rather than testing PATH presence, and re-resolving the binary through PATH after installing, so a version bump cannot be a silent no-op and a shadowed install cannot report success.
2026-09-08: Closed the false green in the canonical CI gate: script/cibuild and script/docker now build with --no-cache, so the Dockerfile's check layers cannot be served from cache on an unchanged tree, and the text claiming a bare docker build . proves the checks ran is corrected in REPO_POLICIES.md, both checklists and the Go styleguide.
2026-09-03: Added -count=1 to both go test invocations in the canonical Go make test example in REPO_POLICIES.md, so the target cannot report a cached pass it did not earn, and documented that Go's test-result cache is a second, independent cache stacked below the Docker layer cache.
2026-08-31: Migrated the canonical .golangci.yml from the deprecated gomodguard to gomodguard_v2: the old linter is disabled by name (which is what silences the deprecation warning), the successor is named explicitly in linters.enable, and it carries a blocked module list drawn only from decisions already recorded in the Go package defaults.
2026-08-07: Set the canonical .golangci.yml to the org-standard v2-schema config already deployed byte-identical across the org's Go repos (settings under linters.settings so thresholds like lll/funlen/cyclop/dupl actually apply under golangci-lint v2). Recorded the canonical golangci-lint version (v2.12.2, commit-pinned) in REPO_POLICIES.md.
2026-03-20: Strengthened constructor naming and Params struct rules in the Go styleguide.
2026-03-18: Documented fail-fast Dockerfile lint stage and conditional -v test rerun patterns in REPO_POLICIES.md.
2026-03-11: Added HTTP service hardening policy for 1.0 releases.
2026-03-10: Added policy: no build artifacts in repos.
2026-03-04: Added LLM prose tells reference and copyediting checklist, then several self-applied revision passes.
2026-02-28: Expanded the pre-1.0 schema migration rule; added clawpub reference.
2026-02-23: Added Go style rules (no type-only packages, Stringer for string-based types); template repos section in README.
2026-02-22: Initial policy corpus: REPO_POLICIES.md, code styleguides (general, Go, JS, Python), repo checklists, CI policy, hash pinning, Go HTTP server conventions, repo scaffolding.

Future Steps

Finish, format, and commit FIXUP_CLEAN.md and FIXUP_REPORT.md (the Next Step).
Commit this TODO.md at the repo root; it is the last missing policy file.
Decide the fate of untracked resume.sh: commit it or delete it.
Add more prompt templates for common development tasks (from README TODO).