sneak
6f997b8d5c
Comments and documentation only; the docker build invocation and its three flags are byte-identical and .dockerignore's effective rules are unchanged. script/lint and Dockerfile.lint stated how the shape was derived — why two stages, why `golangci-lint config verify` was omitted, what earlier drafts of the comments claimed. That is in the history. What survives is the three traps, each of which yields a green run over an unlinted or partly linted tree: --target and --no-cache-filter must both stay with $stage matching the stage name in Dockerfile.lint; --target checks that the stage exists, not that it runs golangci-lint, and halts the build there; and .dockerignore decides what reaches the container, so excluding a self-contained Go file drops it from the lint silently. The TODO.md entry loses its "Hardened" and "Corrected" paragraphs, which argued with earlier versions of themselves, and keeps the flags, the durable property, the three unguarded seams, and the evidence that the gate was verified rather than assumed.
38 lines
1.2 KiB
Bash
Executable File
38 lines
1.2 KiB
Bash
Executable File
#!/bin/sh
|
|
# script/lint: lint in docker. golangci-lint is never installed on the host.
|
|
#
|
|
# Traps, each of which yields a green run over an unlinted or partly linted
|
|
# tree:
|
|
#
|
|
# 1. --target and --no-cache-filter must both stay, and $stage must match
|
|
# the stage name in Dockerfile.lint. BuildKit ignores --no-cache-filter
|
|
# when no stage matches its argument, serving the lint layer from cache
|
|
# without a word; --target rejects a name that is not in the file, which
|
|
# is what makes the single $stage safe.
|
|
#
|
|
# 2. --target checks that the stage exists, not that it is the stage
|
|
# running golangci-lint, and it halts the build there. Moving the lint
|
|
# step to another stage, or adding a stage after it, is not caught.
|
|
#
|
|
# 3. .dockerignore decides what reaches the container, and only what
|
|
# reaches it is linted. Excluding a self-contained Go file drops it from
|
|
# the lint silently. Never exclude Go sources, go.mod/go.sum or
|
|
# .golangci.yml.
|
|
set -eu
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
|
|
|
# Must match the stage name in Dockerfile.lint.
|
|
stage=lint
|
|
|
|
main() {
|
|
cd "$ROOT"
|
|
docker build \
|
|
--target "$stage" \
|
|
--no-cache-filter="$stage" \
|
|
--output=type=cacheonly \
|
|
-f Dockerfile.lint .
|
|
}
|
|
|
|
main "$@"
|