sneak
dcf75f6c72
All checks were successful
check / check (push) Successful in 22s
The rule landed in 12e8db8 is right; these are the three places where the
canonical text and the repos implementing it can diverge without either
side looking wrong.
1. `.dockerignore` excluding the agent scratch directory is now stated as a
correctness precondition of containerised linting rather than a
context-size measure. `Dockerfile.lint` lints whatever `COPY . .` copies,
and language toolchains discover files by walking the tree instead of
reading `.gitignore`, so a nested worktree in the context puts the
foreign-tree false reds back inside the container — in the convincing
form, where the findings are real but belong to another checkout.
sneak/quak measured the same discovery mechanism taking a test count
from 210 to 1050.
2. The cache-bust build arg is fixed at `CHECK_EPOCH` in `Dockerfile.lint`
as well as in `Dockerfile`. A per-file name is invisible to the grep that
proves every build is busted, which makes a renamed guard and a missing
guard read identically. sneak/quak's lint file currently names it
`LINT_EPOCH`.
3. The formatting check must run in exactly one of the two images, and
either placement is allowed. Splitting lint out of the `Dockerfile` is
precisely the moment `fmt-check` gets dropped from both, and running the
formatter beside the linters is the better shape wherever it is the same
pinned dependency — it takes the last host toolchain off the checked
path for the reason the linter came off it.
Both checklists carry the matching items, since a repo that satisfies the
policy prose but not the checklist is the drift this is meant to stop.
Refs #40