#!/bin/sh
# script/lint: lint in docker. golangci-lint is never installed on the host.
#
# Traps, each of which yields a green run over an unlinted or partly linted
# tree:
#
# 1. --target and --no-cache-filter must both stay, and $stage must match
#    the stage name in Dockerfile.lint. BuildKit ignores --no-cache-filter
#    when no stage matches its argument, serving the lint layer from cache
#    without a word; --target rejects a name that is not in the file, which
#    is what makes the single $stage safe.
#
# 2. --target checks that the stage exists, not that it is the stage
#    running golangci-lint, and it halts the build there. Moving the lint
#    step to another stage, or adding a stage after it, is not caught.
#
# 3. .dockerignore decides what reaches the container, and only what
#    reaches it is linted. Excluding a self-contained Go file drops it from
#    the lint silently. Never exclude Go sources, go.mod/go.sum or
#    .golangci.yml.
set -eu

ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"

# Must match the stage name in Dockerfile.lint.
stage=lint

main() {
    cd "$ROOT"
    docker build \
        --target "$stage" \
        --no-cache-filter="$stage" \
        --output=type=cacheonly \
        -f Dockerfile.lint .
}

main "$@"