scripts-to-rule-them-all (#26)

Reviewed-on: #26
Co-authored-by: sneak <sneak@sneak.berlin>
Co-committed-by: sneak <sneak@sneak.berlin>

README.md

@@ -486,6 +486,36 @@ go test ./... # Unit tests
 go test -tags=integration -v ./internal/cli  # Integration tests
 ```
 
+## Entrypoints
+
+This repository adheres to the
+[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
+standard: normalized scripts in `script/` are the entrypoints for the
+development workflow, and the Makefile targets are thin shims that call
+them. We provide:
+
+- `script/bootstrap` — install all dependencies (Go, golangci-lint, Go
+  module download), idempotently
+- `script/setup` — make a fresh clone ready for development: runs
+  `script/bootstrap`, then `script/install-precommit`
+- `script/projectname` — output the project name (`secret`); used by
+  other scripts such as `script/docker`
+- `script/test` — run `go vet` and the test suite (verbose rerun on
+  failure)
+- `script/lint` — run `golangci-lint`
+- `script/fmt` — format all Go code (writes)
+- `script/fmt-check` — check formatting without writing
+- `script/check` — run `script/test`, `script/lint`, and
+  `script/fmt-check`
+- `script/docker` — build the Docker image tagged with the project name
+- `script/cibuild` — CI entrypoint: `docker build --ulimit
+  memlock=-1:-1 .` (memguard needs mlock; the Dockerfile runs the
+  checks)
+- `script/precommit` — pre-commit checks: `go mod tidy` verification,
+  then `script/check`
+- `script/install-precommit` — install the git pre-commit hook that
+  runs `script/precommit`
+
 ## Features
 
 - **Multiple Authentication Methods**: Supports passphrase, PGP, macOS Keychain, and Secure Enclave unlockers