Files

sneak a8905f5fe7 Keep secrets out of the Docker build context at every depth (closes #29 )

The canonical .dockerignore was three lines while the canonical
Dockerfile does `COPY . .`, so a local .env, *.pem or *.key shipped into
the build context and could land in an image layer, invisible to every
git-based check. Copying .gitignore's patterns across is not the repair:
.dockerignore anchors an unprefixed pattern at the context root, so that
form protects only the repository root while reading as solved. Every
depth-independent pattern here carries `**/`, and secret names are
character ranges because matching is case-sensitive and an ALL-CAPS twin
still misses `Server.Key`. Public certificates are deliberately left in
as a legitimate build input. Verified by enumerating a probe image.

Model: opus-5

2026-09-08 04:58:31 +00:00

5.8 KiB

Raw Blame History

title, last_modified

title	last_modified
Existing Repo Checklist	2026-09-08

Use this checklist when beginning work in a repo that may not yet conform to our repository policies (https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/REPO_POLICIES.md).

Work on a feature branch. Check each item and fix any gaps before proceeding with your task.

Formatting (do this first)

If the repo has never been formatted to our standards, run make fmt and commit the result as a standalone branch/commit/PR before any other changes. Formatting diffs can be large and should not be mixed with functional changes.

Required Files

README.md exists with all required sections (Description, Getting Started, Rationale, Design, TODO, License, Author)
LICENSE file exists and matches the README
REPO_POLICIES.md exists and version date is current — fetch from https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/REPO_POLICIES.md
.gitignore is comprehensive (OS, editor, language artifacts, secrets) — fetch from https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore if missing
.editorconfig exists — fetch from https://git.eeqj.de/sneak/prompts/raw/branch/main/.editorconfig
Dockerfile and .dockerignore exist; Dockerfile runs make check as a build step, and script/cibuild and script/docker build it with --no-cache — fetch .dockerignore from https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore
Every depth-independent pattern in .dockerignore carries a **/ prefix, only genuinely root-anchored entries such as .git are unprefixed, and .gitignore's patterns have not been transplanted unmodified — the transplanted form leaves config/.env and certs/server.key in the build context while reading as solved
.dockerignore excludes the repo's own host-built artifacts (compiled binaries, test binaries, coverage output), written root-anchored — /myapp, never **/myapp. An existing repo is where such a binary is likeliest to already be sitting in the build context, invisible to git.
Gitea Actions workflow in .gitea/workflows/ runs script/cibuild on push — reference https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml
Language-specific config:
- Go: go.mod, go.sum, .golangci.yml (fetch from https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml)
- JS: package.json, yarn.lock, .prettierrc, .prettierignore (fetch from https://git.eeqj.de/sneak/prompts/raw/branch/main/.prettierrc and https://git.eeqj.de/sneak/prompts/raw/branch/main/.prettierignore)
- Python: pyproject.toml
- Docs/writing: .prettierrc, .prettierignore (same URLs as above)

Makefile and script/ Entrypoints

Makefile exists in root — reference https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile
Has targets: test, lint, fmt, fmt-check, check, docker, hooks
Target implementations live in script/ (scripts-to-rule-them-all); Makefile targets are thin shims calling them — model scripts at https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>
script/precommit exists and the pre-commit hook (installed by script/install-precommit, shimmed by make hooks) runs it
README has an Entrypoints section documenting the script/ entrypoints and linking the standard
make check does not modify any files in the repo
make test has a 90-second timeout and completes within the 60-second hard cap (over 20 seconds is green but must be filed as an improvement bug)
make test runs real tests, not a no-op (at minimum, import/compile check)
make check passes on current branch

Formatting

Platform-standard formatter is configured (black, prettier, go fmt)
Default formatter config, only exception: four-space indents (except Go)
All files pass make fmt-check

Git Hygiene

Pre-commit hook is installed (make hooks)
No secrets in the repo (.env, keys, credentials)
No mutable references in Dockerfiles or scripts (tags, @latest) — all pinned by cryptographic hash with version/date comment
Using yarn, not npm (JS projects)

Directory Structure

No unnecessary files in repo root
Files organized into canonical subdirectories (bin/, cmd/, docs/, internal/, static/, etc.)
Go migrations in internal/db/migrations/ and embedded in binary

HTTP Service Hardening (if targeting 1.0 and the repo is an HTTP/web service)

Security headers set on all responses (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy)
Request body size limits enforced on all endpoints
Read/write/idle timeouts configured on the HTTP server (slowloris defense)
Per-handler execution time limits in place
Password-based auth endpoints are rate-limited
CSRF tokens on all state-mutating HTML forms
Passwords hashed with bcrypt, scrypt, or argon2
Session cookies use HttpOnly, Secure, and SameSite attributes
True client IP correctly detected behind reverse proxy (trusted proxy allowlist configured)
CORS restricted to explicit origin allowlist for authenticated endpoints
Error responses do not leak stack traces, SQL queries, or internal paths

Final

make check passes
script/cibuild succeeds and demonstrably executed the checks — a sub-second build, or CACHED on a check layer, means nothing ran
Commit and merge fixes before starting your actual task

5.8 KiB Raw Blame History