clawbot
fb4fff59fe
check / check (push) Waiting to run
.dockerignore, .gitignore, .prettierignore and REPO_POLICIES.md are copied from sneak/prompts at dd4027b; .editorconfig, check.yml and .prettierrc already matched. This repository's build artifacts follow the copied content in .gitignore and, anchored, in .dockerignore. The scripts follow the new policy: check runs fmt-check, cibuild bootstraps and runs check before the image build, fmt and fmt-check find the pinned yarn under nvm, and the image's last stage marks /app safe for git. The build-context test expects the new pattern forms. Judgement call: script/precommit runs lint and fmt-check without the tests, so the README's red-phase test commit can still land; the policy allows that form only where local testing is impossible. Not applicable: the issue's .golangci.yml entries; this TypeScript repository has none. Model: opus-5-5
74 lines
2.9 KiB
TypeScript
74 lines
2.9 KiB
TypeScript
// The Docker build context is load-bearing in two directions, and both
|
|
// failures are silent.
|
|
//
|
|
// Excluding too little: a worktree left under `.claude/` is copied into the
|
|
// image, vitest globs its `test/` tree as well as the real one, and the test
|
|
// phase runs the whole suite twice over while reporting success. A compiled
|
|
// `bin/quak` is ~100 MB of context nobody needs.
|
|
//
|
|
// Excluding too much: Prettier 3 reads `.gitignore` as a default ignore file,
|
|
// so dropping it from the context silently changes which files the lint
|
|
// phase's prettier check looks at compared to `make fmt-check` on the host.
|
|
// And without `.git`, a `docker build .` given no `VERSION` build arg cannot
|
|
// derive the version (`script/version`) and stamps `package.json`'s instead.
|
|
//
|
|
// None of these shows up as a build failure, so they are asserted here.
|
|
import { describe, expect, it } from "vitest";
|
|
import { existsSync, readFileSync } from "node:fs";
|
|
import { fileURLToPath } from "node:url";
|
|
import { join } from "node:path";
|
|
|
|
const repoRoot = fileURLToPath(new URL("../../", import.meta.url));
|
|
|
|
const patterns = (name: string): string[] =>
|
|
readFileSync(join(repoRoot, name), "utf-8")
|
|
.split("\n")
|
|
.map((line) => line.trim())
|
|
.filter((line) => line !== "" && !line.startsWith("#"));
|
|
|
|
const dockerignore = patterns(".dockerignore");
|
|
|
|
describe(".dockerignore", () => {
|
|
// Everything here is either generated, enormous, or secret. `.claude` is
|
|
// the correctness one: see the header comment and issue #25. The leading
|
|
// `/` anchors an entry at the root of the context.
|
|
it.each([
|
|
".claude",
|
|
"/.quak",
|
|
"/bin/quak",
|
|
"**/node_modules",
|
|
"/coverage",
|
|
"/dist",
|
|
"/.vitest-cache",
|
|
"/.nyc_output",
|
|
"/*.tsbuildinfo",
|
|
])("keeps %s out of the build context", (pattern) => {
|
|
expect(dockerignore).toContain(pattern);
|
|
});
|
|
|
|
it("leaves .gitignore in the build context for prettier", () => {
|
|
expect(dockerignore).not.toContain(".gitignore");
|
|
});
|
|
|
|
it("leaves .git in the build context for the version", () => {
|
|
expect(dockerignore).not.toContain(".git");
|
|
expect(dockerignore).not.toContain(".git/");
|
|
});
|
|
|
|
// The build stage is the final image, so a .git/config sent in would
|
|
// ship the clone's remote URL and any credential in it.
|
|
it("sends .git without its config", () => {
|
|
expect(dockerignore).toContain("**/.git/config");
|
|
});
|
|
|
|
// BuildKit lets a `Dockerfile.dockerignore` shadow the root one; such a
|
|
// file would silently give the build a different, unreviewed context —
|
|
// and eslint's flat config does not ignore dot-directories, so a stray
|
|
// `.claude/` worktree would be linted.
|
|
it("is not shadowed by a Dockerfile.dockerignore", () => {
|
|
expect(existsSync(join(repoRoot, "Dockerfile.dockerignore"))).toBe(
|
|
false,
|
|
);
|
|
});
|
|
});
|