sneak
6f997b8d5c
Comments and documentation only; the docker build invocation and its three flags are byte-identical and .dockerignore's effective rules are unchanged. script/lint and Dockerfile.lint stated how the shape was derived — why two stages, why `golangci-lint config verify` was omitted, what earlier drafts of the comments claimed. That is in the history. What survives is the three traps, each of which yields a green run over an unlinted or partly linted tree: --target and --no-cache-filter must both stay with $stage matching the stage name in Dockerfile.lint; --target checks that the stage exists, not that it runs golangci-lint, and halts the build there; and .dockerignore decides what reaches the container, so excluding a self-contained Go file drops it from the lint silently. The TODO.md entry loses its "Hardened" and "Corrected" paragraphs, which argued with earlier versions of themselves, and keeps the flags, the durable property, the three unguarded seams, and the evidence that the gate was verified rather than assumed.
21 lines
668 B
Docker
21 lines
668 B
Docker
# Lint image, built by script/lint: golangci-lint runs as a build step, so
|
|
# a successful build is a clean lint.
|
|
|
|
# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
|
|
FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS deps
|
|
|
|
WORKDIR /src
|
|
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
# This stage must stay the one that runs golangci-lint, and its name must
|
|
# match $stage in script/lint. --target halts the build at this stage, so
|
|
# moving the lint step to another stage, or adding a stage after this one,
|
|
# is not caught.
|
|
FROM deps AS lint
|
|
|
|
COPY . .
|
|
|
|
RUN golangci-lint run --config .golangci.yml ./...
|