sneak
c4d5546e86
All checks were successful
check / check (push) Successful in 5m12s
Per the owner ruling on issue 40, linting and testing are phases of the main Dockerfile rather than a separate lint file. script/lint and script/test build one phase each by name with caching disabled, and the final stage copies a harmless file from each so the image cannot be built unless both passed. A stage that is not the last is built only when something depends on it or --target names it, so the gates are invoked by name and the edges kept. script/check runs the gates and builds no image of its own; script/cibuild bootstraps first, because CI runs it alone and fmt-check is native. fmt and fmt-check source nvm for the pinned node before calling yarn, which bootstrap installs but leaves off its caller's PATH. Every build in script/ is tagged and uncached. Issue 30 closes too: a container has its own lint cache and lock. Model: opus-5
87 lines
4.7 KiB
Markdown
87 lines
4.7 KiB
Markdown
# Workflow
|
|
|
|
- branch (from `main`)
|
|
- do the work in Next Step
|
|
- move Next Step to the top of Completed Steps
|
|
- move the top item of Future Steps into Next Step
|
|
- commit (`TODO.md` changes in the same commit as the work)
|
|
- merge to `main` if the branch is not protected, otherwise open a PR
|
|
- push
|
|
|
|
# Status
|
|
|
|
pre-1.0
|
|
|
|
# Next Step
|
|
|
|
Finish the two draft prompt documents in the working tree and commit them:
|
|
prompts/FIXUP_CLEAN.md (currently a near-empty stub) and prompts/FIXUP_REPORT.md
|
|
(a rough draft). Write the missing content, run `make fmt` so they pass
|
|
fmt-check, and commit.
|
|
|
|
# Completed Steps
|
|
|
|
- 2026-09-08: Moved linting and testing into Docker as phases of the main
|
|
`Dockerfile`, per the owner ruling on issue 40. `script/lint` and
|
|
`script/test` build one phase each by name with `--no-cache` — the same answer
|
|
issue 26 got, so no separate cache-busting mechanism survives — and the final
|
|
stage copies a harmless file from both, so the image cannot be built unless
|
|
they pass. This also closes issue 30: a container has its own result cache and
|
|
its own lock, so a lint verdict can no longer belong to another checkout. No
|
|
separate lint Dockerfile, and no `golangci-lint config verify` step.
|
|
`script/check` runs the gates and nothing else, and `script/cibuild`
|
|
bootstraps first, since it is all CI runs and `script/fmt-check` is native.
|
|
- 2026-09-08: Kept in-repo agent scratch out of the Docker build context and out
|
|
of version control: `.claude/` is one full checkout of the repo per in-flight
|
|
agent, and under `COPY . .` all of it was reaching the image. Also closed the
|
|
consequence of excluding `.git` — `git describe` yields an empty version
|
|
inside a build stage without failing, so `script/docker` and `script/cibuild`
|
|
now compute the version on the host and pass `--build-arg VERSION`.
|
|
- 2026-09-08: Closed the secret exposure in the canonical `.dockerignore`: a
|
|
local `.env`, `*.pem` or `*.key` was reaching the build context under
|
|
`COPY . .`, invisible to every git-based check. The patterns are now written
|
|
to `.dockerignore`'s own semantics — `**/`-prefixed so they hold at every
|
|
depth, case-folded with character ranges — and `REPO_POLICIES.md` requires
|
|
verifying by enumerating the image rather than by reading the file.
|
|
- 2026-09-08: Made a pinned tool in `script/bootstrap` actually reach the host.
|
|
`REPO_POLICIES.md` now requires comparing the installed version against the
|
|
pin rather than testing `PATH` presence, and re-resolving the binary through
|
|
`PATH` after installing, so a version bump cannot be a silent no-op and a
|
|
shadowed install cannot report success.
|
|
- 2026-09-08: Closed the false green in the canonical CI gate: `script/cibuild`
|
|
and `script/docker` now build with `--no-cache`, so the Dockerfile's check
|
|
layers cannot be served from cache on an unchanged tree, and the text claiming
|
|
a bare `docker build .` proves the checks ran is corrected in
|
|
`REPO_POLICIES.md`, both checklists and the Go styleguide.
|
|
- 2026-09-03: Added `-count=1` to both `go test` invocations in the canonical Go
|
|
`make test` example in `REPO_POLICIES.md`, so the target cannot report a
|
|
cached pass it did not earn, and documented that Go's test-result cache is a
|
|
second, independent cache stacked below the Docker layer cache.
|
|
- 2026-08-07: Set the canonical `.golangci.yml` to the org-standard v2-schema
|
|
config already deployed byte-identical across the org's Go repos (settings
|
|
under `linters.settings` so thresholds like lll/funlen/cyclop/dupl actually
|
|
apply under golangci-lint v2). Recorded the canonical golangci-lint version
|
|
(v2.12.2, commit-pinned) in REPO_POLICIES.md.
|
|
- 2026-03-20: Strengthened constructor naming and Params struct rules in the Go
|
|
styleguide.
|
|
- 2026-03-18: Documented fail-fast Dockerfile lint stage and conditional -v test
|
|
rerun patterns in REPO_POLICIES.md.
|
|
- 2026-03-11: Added HTTP service hardening policy for 1.0 releases.
|
|
- 2026-03-10: Added policy: no build artifacts in repos.
|
|
- 2026-03-04: Added LLM prose tells reference and copyediting checklist, then
|
|
several self-applied revision passes.
|
|
- 2026-02-28: Expanded the pre-1.0 schema migration rule; added clawpub
|
|
reference.
|
|
- 2026-02-23: Added Go style rules (no type-only packages, Stringer for
|
|
string-based types); template repos section in README.
|
|
- 2026-02-22: Initial policy corpus: REPO_POLICIES.md, code styleguides
|
|
(general, Go, JS, Python), repo checklists, CI policy, hash pinning, Go HTTP
|
|
server conventions, repo scaffolding.
|
|
|
|
# Future Steps
|
|
|
|
- Finish, format, and commit FIXUP_CLEAN.md and FIXUP_REPORT.md (the Next Step).
|
|
- Commit this TODO.md at the repo root; it is the last missing policy file.
|
|
- Decide the fate of untracked resume.sh: commit it or delete it.
|
|
- Add more prompt templates for common development tasks (from README TODO).
|