Go module path is git.eeqj.de/sneak/secret, policy requires sneak.berlin/go/secret #43

New Issue

2026-08-09T03:42:14+02:00

clawbot commented

2026-08-09 03:42:14 +02:00

From the repo-standards audit. Present on main and the pending lint branch.

Divergence

REPO_POLICIES.md:

> Go module root: sneak.berlin/go/<name>. Always run go mod tidy before committing.

go.mod:1 is module git.eeqj.de/sneak/secret. The wrong path is also compiled into the binary via the Makefile ldflags: -X 'git.eeqj.de/sneak/secret/internal/cli.Version=...'.

Mechanical but wide — it touches every import in cmd/, internal/, and pkg/.

Definition of done

go.mod declares module sneak.berlin/go/secret.
Every import across cmd/, internal/, and pkg/ is updated, including test files.
Both -X ldflags in the Makefile use the new path. Verify the version string is still actually populated in the built binary — a stale ldflags path fails silently, leaving Version at its default, and nothing in the test suite would catch it. Build and run the version command as part of accepting this.
go mod tidy run; go.sum consistent.
make check green. TODO.md updated in the same commit.

Implementation requirements

Land this as its own commit, touching nothing else. It produces a large diff of pure import rewrites; mixing any behavioral change into it makes review impossible and hides bugs.
Sequence it after PR #29 (the lint branch), which rewrites 59 files. Doing the rename first guarantees a conflict on essentially every file.
Use go mod edit -module and the standard tooling for the import rewrite rather than hand-editing — but check the result compiles and that no import was missed in a build-tagged file. The Darwin-gated files (keychainunlocker.go, seunlocker_darwin.go, internal/macse/macse_darwin.go, and their tests) are not compiled on the Linux CI runner, so a missed import there produces a green CI and a broken macOS build. Verify those explicitly, e.g. with a GOOS=darwin type-check via the appropriate make target.
The module path is a public identifier. Anyone who has go get-ed the old path is broken by this. That is accepted policy, but note it in the commit message.
Grep for the old path in non-Go files too: README, Dockerfile, scripts, CI workflow, and .golangci.yml. Do not modify .golangci.yml — if the old path appears there, stop and report on this issue, since policy forbids agents editing that file.

From the repo-standards audit. Present on `main` and the pending lint branch. ## Divergence `REPO_POLICIES.md`: > Go module root: `sneak.berlin/go/<name>`. Always run `go mod tidy` before committing. `go.mod:1` is `module git.eeqj.de/sneak/secret`. The wrong path is also compiled into the binary via the `Makefile` ldflags: `-X 'git.eeqj.de/sneak/secret/internal/cli.Version=...'`. Mechanical but wide — it touches every import in `cmd/`, `internal/`, and `pkg/`. ## Definition of done - `go.mod` declares `module sneak.berlin/go/secret`. - Every import across `cmd/`, `internal/`, and `pkg/` is updated, including test files. - Both `-X` ldflags in the `Makefile` use the new path. **Verify the version string is still actually populated in the built binary** — a stale ldflags path fails silently, leaving `Version` at its default, and nothing in the test suite would catch it. Build and run the version command as part of accepting this. - `go mod tidy` run; `go.sum` consistent. - `make check` green. `TODO.md` updated in the same commit. ## Implementation requirements - Land this as its **own commit, touching nothing else**. It produces a large diff of pure import rewrites; mixing any behavioral change into it makes review impossible and hides bugs. - Sequence it **after** PR #29 (the lint branch), which rewrites 59 files. Doing the rename first guarantees a conflict on essentially every file. - Use `go mod edit -module` and the standard tooling for the import rewrite rather than hand-editing — but check the result compiles and that no import was missed in a build-tagged file. **The Darwin-gated files (`keychainunlocker.go`, `seunlocker_darwin.go`, `internal/macse/macse_darwin.go`, and their tests) are not compiled on the Linux CI runner**, so a missed import there produces a green CI and a broken macOS build. Verify those explicitly, e.g. with a `GOOS=darwin` type-check via the appropriate make target. - The module path is a public identifier. Anyone who has `go get`-ed the old path is broken by this. That is accepted policy, but note it in the commit message. - Grep for the old path in non-Go files too: README, Dockerfile, scripts, CI workflow, and `.golangci.yml`. Do not modify `.golangci.yml` — if the old path appears there, stop and report on this issue, since policy forbids agents editing that file.

clawbot added this to the 1.0.0 milestone 2026-08-09 03:42:14 +02:00

clawbot referenced this issue

2026-08-09 03:42:32 +02:00

Makefile hardcodes a personal remote DOCKER_HOST, breaking `make docker` for everyone else #44

clawbot referenced this issue

2026-08-09 03:46:49 +02:00

Darwin-only code is never compiled, linted, or tested by CI, including both hardware-backed unlockers #50

Sign in to join this conversation.