From b5819282f37fa6bb52e04058e6228c0b6682396a Mon Sep 17 00:00:00 2001 From: clawbot Date: Wed, 7 Oct 2026 21:46:20 +0000 Subject: [PATCH] Re-vendor the canonical files from sneak/prompts at dd4027b (closes #95) The shared files are the copies at sneak/prompts commit dd4027b, with this repository's own entries kept after them. golangci-lint is v2.14.0 and raises no findings. Lint and test are phases of the Dockerfile, built by script/lint and script/test; the tests run under the race detector as nobody, so Dockerfile.lint, script/verify-lint-image-pin and make test-race are gone. Every docker build in script/ passes --no-cache in place of the old cache-busting build argument, and script/cibuild runs script/bootstrap and script/check before the image build. .claude/settings.json is deleted. Deviation: the workflow keeps fetch-depth: 0 for the tag-derived version. Deviation: .gitignore keeps the scan database patterns. Deviation: prettier still runs in Docker, not on the host. Over the cap: make test takes about 60 seconds on this host. Model: opus-5-5 --- .claude/settings.json | 5 - .dockerignore | 79 ++++++- .gitignore | 49 +++- .golangci.yml | 1 + Dockerfile | 162 ++++--------- Dockerfile.lint | 45 ---- Makefile | 5 +- README.md | 115 +++------ REPO_POLICIES.md | 443 ++++++++++++++++++++++++++++------- TODO.md | 111 ++++----- script/bootstrap | 6 +- script/cibuild | 29 ++- script/docker | 20 +- script/fmt | 5 +- script/fmt-check | 2 +- script/lint | 31 +-- script/test | 18 +- script/test-race | 40 ---- script/verify-lint-image-pin | 77 ------ 19 files changed, 664 insertions(+), 579 deletions(-) delete mode 100644 .claude/settings.json delete mode 100644 Dockerfile.lint delete mode 100755 script/test-race delete mode 100755 script/verify-lint-image-pin diff --git a/.claude/settings.json b/.claude/settings.json deleted file mode 100644 index 4208b22..0000000 --- a/.claude/settings.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "worktree": { - "bgIsolation": "none" - } -} diff --git a/.dockerignore b/.dockerignore index e1d1d88..2a40fff 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1,12 +1,79 @@ +# .dockerignore does NOT use .gitignore semantics. Docker matches with +# moby/patternmatcher: filepath.Match plus `**`, so `*` does not cross +# `/` and an unprefixed pattern is anchored at the context root. Every +# depth-independent pattern therefore needs `**/`, or `config/.env` and +# `certs/server.key` still ship while this file reads as solved. Only +# genuinely root-anchored entries go unprefixed. Never transplant these +# into .gitignore, where `**/` is wrong. +# +# Matching is case-sensitive, so secrets use character ranges rather +# than an ALL-CAPS twin, which would still miss `Server.Key`. +# +# Extend with this repo's own host-built artifacts, written anchored: +# `/myapp`, never `**/myapp`, which also matches `cmd/myapp/` and +# deletes the package directory from the context. + # .git is sent without its config. Without a VERSION build argument the # stage that compiles runs `git describe --tags --always` on .git, which # does not need .git/config; that file can hold a credential, such as a # password in a remote URL or the token the CI checkout step stores there. -.git/config +# Each submodule keeps a config with the same exposure in its git directory +# under .git/modules/, nested again for a submodule's own submodules, or in +# its own .git directory when it keeps one. +# KNOWN GAP: a submodule whose name has a `config` segment (`config`, +# `deploy/config`, `config/lib`) loses its whole git directory, because +# `**/.git/modules/**/config` also matches that segment's directory +# under .git/modules/. Go's version stamping then fails the build; +# nothing leaks. Name such a submodule without that segment: +# `git submodule add --name`. +**/.git/config +**/.git/modules/**/config +# Agent scratch: one full checkout of the repo per in-flight agent. +# Anchored because it occurs once where agents run at the repo root. +# KNOWN GAP: a repo running agents in subdirectories still ships +# `services/api/.claude/` and must add its own anchored entry. .claude -.DS_Store -sfdupes -*.log -*.out -*.test + +# Environment files. `*.env` covers bare `.env` and the `prod.env` +# convention. Re-include a committed template with a negation if the +# build needs one: `!docs/example.env`. +**/*.[eE][nN][vV] +**/.[eE][nN][vV].* +**/.[eE][nN][vV][rR][cC] + +# Private keys and the bundles carrying them. Public certificates +# (*.crt, *.cer) are deliberately absent: they are legitimate inputs. +**/*.[pP][eE][mM] +**/*.[kK][eE][yY] +**/*.[pP]12 +**/*.[pP][fF][xX] +**/[iI][dD]_[rR][sS][aA] +**/[iI][dD]_[dD][sS][aA] +**/[iI][dD]_[eE][cC][dD][sS][aA] +**/[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK] +**/[iI][dD]_[eE][dD]25519 +**/[iI][dD]_[eE][dD]25519_[sS][kK] + +# Dependencies: restored inside the image, never copied in. +**/node_modules + +# OS metadata. +**/.DS_Store +**/Thumbs.db + +# Editor state: never a build input, and it churns COPY. +**/*.swp +**/*.swo +**/*~ +**/*.bak +**/.idea +**/.vscode +**/*.sublime-* + +# This repository's host-built artifacts: the binary `make build` writes, +# and test binaries, coverage output and logs. +/sfdupes +/*.test +/*.out +/*.log diff --git a/.gitignore b/.gitignore index 56ba247..45b6dbc 100644 --- a/.gitignore +++ b/.gitignore @@ -11,25 +11,48 @@ Thumbs.db .vscode/ *.sublime-* +# Agent scratch (worktrees of this repo, created and destroyed by +# in-flight tooling). Unanchored: .gitignore patterns already match at +# every depth, so no prefix is wanted here. This is not a .dockerignore +# entry and must not be given a `**/` prefix on the way into one. +.claude/ + # Node node_modules/ -# Environment / secrets -.env -.env.* -*.pem -*.key +# Secrets. Unanchored like every entry above, so each matches at every +# depth. Matching is case-sensitive on Linux, so names use character +# ranges rather than a lowercase form that misses `Server.Key`. -# Go build artifacts -/sfdupes -*.test -*.out +# Environment files. `*.env` covers bare `.env` and the `prod.env` +# convention. Only the templates `example.env` and `sample.env` are +# re-included below. A repository that commits any other template adds +# its own negation after these lines, for example `!.env.example`. +*.[eE][nN][vV] +.[eE][nN][vV].* +.[eE][nN][vV][rR][cC] +!example.env +!sample.env + +# Private keys and the bundles carrying them. +*.[pP][eE][mM] +*.[kK][eE][yY] +*.[pP]12 +*.[pP][fF][xX] +[iI][dD]_[rR][sS][aA] +[iI][dD]_[dD][sS][aA] +[iI][dD]_[eE][cC][dD][sS][aA] +[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK] +[iI][dD]_[eE][dD]25519 +[iI][dD]_[eE][dD]25519_[sS][kK] + +# This repository's own entries, kept after the canonical content above. *.log +*.out +*.test +/sfdupes -# Local scan data +# A scan database lists every path it scanned. *.sqlite *.sqlite-shm *.sqlite-wal - -# Agent worktrees -.claude/worktrees/ diff --git a/.golangci.yml b/.golangci.yml index a7a74c2..1b73eb9 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -17,6 +17,7 @@ linters: disable: # Genuinely incompatible with project patterns - exhaustruct # Requires all struct fields + - exhaustruct_v5 # Requires all struct fields (successor to exhaustruct) - godot # Requires comments to end with periods - wrapcheck # Too verbose for internal packages - varnamelen # Short names like db, id are idiomatic Go diff --git a/Dockerfile b/Dockerfile index b2d7424..264c3eb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,52 +1,42 @@ -# Lint stage — fast feedback on formatting and lint issues -# golangci/golangci-lint:v2.12.2, 2026-08-07 -FROM golangci/golangci-lint@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint +# Lint phase, built alone by script/lint. The tools are invoked directly +# rather than through `make lint` or `make fmt-check`, which run docker +# themselves and so cannot run inside a build step. +# golangci/golangci-lint:v2.14.0, 2026-10-07 +FROM golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint WORKDIR /src COPY go.mod go.sum ./ RUN go mod download COPY . . -# Cache-buster for the gate layers, and only for them: on an unchanged -# tree Docker would serve the gates below from cache and the build would -# exit 0 having run nothing. script/cibuild and script/docker pass a -# fresh CHECK_EPOCH; a build without one, such as a bare -# `docker build .`, fails at the check right after the ARG. -# -# ARG is per-stage, so the markdown and build stages declare it again. -# Each gate RUN must reference the value: BuildKit hashes the expanded -# command, so a declared but unreferenced ARG invalidates nothing. Keep -# it below the dependency layers so they stay cached. -ARG CHECK_EPOCH -RUN if [ -z "${CHECK_EPOCH}" ]; then \ - echo "CHECK_EPOCH is unset; build via script/cibuild or script/docker" >&2; \ - exit 1; \ - fi - -# These gates call the tools directly, not through `make lint` or -# `make fmt-check`: both run docker, which cannot run inside a docker -# build. This step is the gofmt half of `make fmt-check`; the markdown -# stage is its prettier half. gofmt's output is assigned to a variable -# first so that its own exit status, as when it cannot parse a file, -# still fails the step. -RUN echo "gate gofmt, epoch ${CHECK_EPOCH}" && \ - files="$(gofmt -s -l .)" && \ +# The gofmt half of `make fmt-check`; the markdown stage is its prettier +# half. gofmt's output is assigned to a variable first so that its own +# exit status, as when it cannot parse a file, still fails the step. +RUN files="$(gofmt -s -l .)" && \ if [ -n "$files" ]; then \ echo "gofmt: files not formatted:" >&2; echo "$files" >&2; exit 1; \ fi -# Fails the build when the FROM above and the one in Dockerfile.lint pin -# different linter images. -RUN echo "gate lint-image-pin, epoch ${CHECK_EPOCH}" && \ - script/verify-lint-image-pin +# Validates .golangci.yml against the schema the pinned binary embeds. +RUN golangci-lint config verify --config .golangci.yml +RUN golangci-lint run --config .golangci.yml ./... -# Same config-schema check Dockerfile.lint runs, kept here so this build -# gates on exactly what script/lint gates on. It validates against a -# schema the pinned binary embeds, so it needs no network. -RUN echo "gate config verify, epoch ${CHECK_EPOCH}" && \ - golangci-lint config verify --config .golangci.yml - -RUN echo "gate lint, epoch ${CHECK_EPOCH}" && \ - golangci-lint run --config .golangci.yml ./... +# Test phase, built alone by script/test. -race needs cgo and so a C +# compiler, which the Debian Go image ships and the alpine one does not. +# +# The tests run as nobody: several of them make a file unreadable and +# expect reading it to fail, and root reads it anyway. nobody has no home +# directory, so HOME is /tmp, where Go puts its build cache. +# golang:1.25-trixie, 2026-10-04 +FROM golang@sha256:2c4c60ef415fbfa5e90300722293bef36c5e63fae17570ce18f580af933dbd73 AS test +USER nobody +ENV HOME=/tmp +WORKDIR /src +COPY go.mod go.sum ./ +RUN go mod download +COPY . . +RUN go test -timeout 90s -race -cover ./... || \ + { echo "--- Rerunning with -v for details ---"; \ + go test -timeout 90s -race -v ./...; exit 1; } # Prettier stage: the prettier that formats this repository's Markdown, # never installed on a host. script/fmt and script/fmt-check build this @@ -66,92 +56,33 @@ WORKDIR /src # Markdown stage: the Markdown half of `make fmt-check`, as a gate. FROM prettier AS markdown COPY . . -# Second per-stage declaration of the gate cache-buster and its check; -# see the lint stage above. -ARG CHECK_EPOCH -RUN if [ -z "${CHECK_EPOCH}" ]; then \ - echo "CHECK_EPOCH is unset; build via script/cibuild or script/docker" >&2; \ - exit 1; \ - fi -RUN echo "gate prettier, epoch ${CHECK_EPOCH}" && \ - prettier --check '**/*.md' --tab-width 4 --prose-wrap always +RUN prettier --check '**/*.md' --tab-width 4 --prose-wrap always -# Build stage +# Build stage. Nothing is wanted from the lint, test and markdown stages; +# the copies are what make BuildKit build them first, so this stage +# cannot run unless all three passed. # golang:1.25-alpine, 2026-07-23 FROM golang@sha256:56961d79ea8129efddcc0b8643fd8a5416b4e6228cfd477e3fd61deb2672c587 AS builder - -# We never build or run as root. Create an unprivileged user and point -# HOME and the build cache at its home so go build and go test can write -# it when we drop to it below. -# -# The module cache stays at the base image's default /go/pkg/mod and -# belongs to root: script/bootstrap fills it as root. Do not move it -# into the home and hand it over with `chown -R`: that walks every file -# in it, which took from about 80 s to over ten minutes on a shared -# host, depending on load. -RUN adduser -D -u 1000 builder -ENV HOME=/home/builder -ENV GOPATH=/home/builder/go -ENV GOMODCACHE=/go/pkg/mod -ENV GOCACHE=/home/builder/.cache/go-build - +COPY --from=lint /src/go.sum /dev/null +COPY --from=test /src/go.sum /dev/null +COPY --from=markdown /src/go.sum /dev/null WORKDIR /src -# No-op file copies whose only purpose is the build-graph edge: they -# make this stage depend on the lint and markdown stages, so BuildKit -# finishes those gates before compilation and tests start. Remove one -# and the build silently stops gating on that stage and still exits 0. -COPY --from=lint /src/go.sum /dev/null -COPY --from=markdown /src/go.sum /dev/null - -# Install development prerequisites the same way a developer does. Only -# script/ and the dependency manifests are copied first, so this layer -# stays cached until they change. Bootstrap ends in `go mod download`. +# script/bootstrap installs the git and make this image lacks, and ends +# in `go mod download`. COPY script/ script/ COPY go.mod go.sum ./ RUN script/bootstrap - -# Hand builder only what it writes to, without walking the module cache. -# This layer stays cached with bootstrap. -# - /src itself: make build writes the binary into it, and git refuses -# a repository whose top directory belongs to another user. -# - the module cache's cache/download directory itself, not what is in -# it: Go only reads the downloaded modules, but make build saves its -# lookup of this module's own version from git there, in a new -# directory named after the module path. -# - builder's home: the go commands bootstrap ran as root left Go's -# telemetry files there, a few small files. -RUN chown builder:builder /src /go/pkg/mod/cache/download && \ - chown -R builder:builder /home/builder - -# The sources are handed to builder as they are copied, so no layer has -# to walk them. Then drop root before running any checks or builds. -COPY --chown=builder:builder . . -USER builder - -# Fail the build unless the branch is green. Runs as non-root: root -# would bypass the chmod(0) the permission-denied tests rely on. -# -# The gate is `make test`, not `make check`, which runs docker; lint and -# the format checks ran in the lint and markdown stages above. `make`, -# not the script directly, because the Makefile's -# `export CGO_ENABLED = 0` applies only to what it invokes. -# -# Third per-stage declaration of the gate cache-buster and its check; -# see the lint stage above. It is placed after USER so the drop to the -# unprivileged user still happens before the checks run. -ARG CHECK_EPOCH -RUN if [ -z "${CHECK_EPOCH}" ]; then \ - echo "CHECK_EPOCH is unset; build via script/cibuild or script/docker" >&2; \ - exit 1; \ - fi -RUN echo "gate test, epoch ${CHECK_EPOCH}" && make test +# A tar-stream context keeps the sender's file owners, which git refuses. +RUN git config --system --add safe.directory /src +COPY . . # The version stamped into the binary: the VERSION build argument when # one is given, otherwise `git describe --tags --always` of the .git in -# the build context (git is installed by script/bootstrap above). A -# context that carries .git and still yields no version fails the build; -# with neither, as from a source tarball, it is "dev". +# the build context. A context that carries .git and still yields no +# version fails the build; with neither, as from a source tarball, it is +# "dev". `make build` rather than `go build`, so the image and a host +# build share one compile recipe, cgo disabled included. ARG VERSION RUN version="${VERSION:-$(git describe --tags --always || echo dev)}"; \ if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \ @@ -161,7 +92,8 @@ RUN version="${VERSION:-$(git describe --tags --always || echo dev)}"; \ fi; \ make build VERSION="$version" -# Runtime stage +# Runtime stage, and the last one: a plain `docker build .` builds this +# stage's chain and nothing else. # alpine:3.22, 2026-07-23 FROM alpine@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce diff --git a/Dockerfile.lint b/Dockerfile.lint deleted file mode 100644 index 4d6707f..0000000 --- a/Dockerfile.lint +++ /dev/null @@ -1,45 +0,0 @@ -# Lint-only image, built by script/lint: the repo is copied into the -# pinned golangci-lint image and the linter runs as a build step, so a -# successful build is a clean lint. No bind mount, so it works when the -# docker daemon is remote. -# -# It is separate from the main Dockerfile's lint stage because -# script/lint must not depend on the rest of that build; the two FROM -# lines are kept identical by script/verify-lint-image-pin, run as a -# gate below. -# golangci/golangci-lint:v2.12.2, 2026-08-07 -FROM golangci/golangci-lint@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 - -WORKDIR /src - -# Dependency layers first, so they stay cached across lint runs. -COPY go.mod go.sum ./ -RUN go mod download - -COPY . . - -# Cache-buster for the gate layers, and only for them; caching of the -# lint run is waived by ruling. On an unchanged tree the gates below -# would be served from cache and this build would exit 0 in under a -# second having run no linter. script/lint passes a fresh value on every -# invocation. -# -# Each gate RUN must reference the value: BuildKit hashes the expanded -# command, so a declared but unreferenced ARG invalidates nothing. Keep -# it below the dependency layers so they stay cached. -ARG CHECK_EPOCH - -# Fails the build when the FROM above and the main Dockerfile's lint -# stage pin different linter images. -RUN echo "gate lint-image-pin, epoch ${CHECK_EPOCH}" && \ - script/verify-lint-image-pin - -# Validates .golangci.yml against golangci-lint's JSON schema, which the -# pinned binary embeds: measured under `--network none`, it passes a -# valid config and rejects an invalid one. No gate step makes a network -# call, but `go mod download` above needs the network on a cold cache. -RUN echo "gate config verify, epoch ${CHECK_EPOCH}" && \ - golangci-lint config verify --config .golangci.yml - -RUN echo "gate lint, epoch ${CHECK_EPOCH}" && \ - golangci-lint run --config .golangci.yml ./... diff --git a/Makefile b/Makefile index 5adfcec..67c7260 100644 --- a/Makefile +++ b/Makefile @@ -6,7 +6,7 @@ BINARY := sfdupes VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev) LDFLAGS := -X main.Version=$(VERSION) -.PHONY: sfdupes build bootstrap setup test test-race lint fmt fmt-check check docker hooks clean +.PHONY: sfdupes build bootstrap setup test lint fmt fmt-check check docker hooks clean # Standard targets are thin shims; the implementations live in script/ # per the scripts-to-rule-them-all pattern. @@ -27,9 +27,6 @@ setup: test: @script/test -test-race: - @script/test-race - lint: @script/lint diff --git a/README.md b/README.md index 41afbc8..ea3879b 100644 --- a/README.md +++ b/README.md @@ -741,44 +741,26 @@ entrypoints are: presence-checked only. `golangci-lint` and prettier are deliberately **not** installed: they run in Docker (see `script/lint` and `script/fmt`) and never from a host install, so there is no host copy to drift from the pin. A missing - `docker` is warned about rather than installed or treated as fatal — - everything except linting, formatting and `make test-race` works without it. - Ends with `go mod download`. + `docker` is warned about rather than installed or treated as fatal: + `make build` works without it, and testing, linting, formatting and the image + build need it. Ends with `go mod download`. - `script/setup` — make a fresh clone ready for development: runs `script/bootstrap`, then `script/install-precommit`. - `script/projectname` — print this project's name (`sfdupes`). Scripts that need the name call it, so they stay identical across repositories. -- `script/test` — run the test suite with a 30-second timeout and coverage - enabled, rerunning verbosely on failure so the logs show which test failed. -- `script/test-race` — run the test suite under the race detector with a - 60-second timeout. The detector needs cgo and a C compiler, which the build - never uses, so the tests run in a digest-pinned Debian `golang` image that has - `gcc`, with the checkout mounted read-only; the container is removed when it - exits. They run as the calling user, or as `nobody` when that is root, because - several tests make a file unreadable and root reads it anyway; only then must - the checkout be readable by other users. Not part of `script/check`. Every run - starts with empty caches, so it needs the network and takes minutes, and the - mount needs a local docker daemon. -- `script/lint` — run the linter. It builds `Dockerfile.lint`, which copies the - repository into the digest-pinned `golangci/golangci-lint` image and runs - `golangci-lint config verify` and `golangci-lint run` as build steps, so a - successful build is a clean lint. That exit status is all it produces, so it - runs with `--output=type=cacheonly` and writes no image; a run leaves only - build cache. The linter is never run on the host, which makes a working - `docker` the one prerequisite for linting — and therefore for `make check` and - the pre-commit hook. Offline machines: the gate steps themselves make no - network calls. `golangci-lint run` does not, and neither does - `golangci-lint config verify` — it validates against a schema the pinned - binary embeds, measured under `--network none` to both pass a valid config and - reject an invalid one. The build around them does. `Dockerfile.lint` runs - `go mod download` before the gates and this module has external dependencies, - so a first lint on a machine with a cold BuildKit cache reaches the network - there (as well as pulling the pinned image); under `--network none` it fails - at that step, before any gate. That layer sits above the gates and stays - cached, so once it is warm `script/lint` — and with it `make check` — runs - entirely offline, until `go.mod` or `go.sum` changes and the download layer - goes cold again. Because the daemon only ever sees a build context, this works - when the docker daemon is remote and bind mounts are impossible. +- `script/test` — run the test suite under the race detector, with a 90-second + timeout and coverage enabled, rerunning verbosely on failure so the logs show + which test failed. It builds the `Dockerfile`'s `test` phase alone, tagged + `sfdupes-test`. The race detector needs cgo and a C compiler, which the build + never uses, so the phase starts from a digest-pinned Debian `golang` image, + which has `gcc`. The tests run as `nobody`, because several of them make a + file unreadable and root reads it anyway. +- `script/lint` — run the linter. It builds the `Dockerfile`'s `lint` phase + alone, tagged `sfdupes-lint`: in the digest-pinned `golangci/golangci-lint` + image, the gofmt check, `golangci-lint config verify` and `golangci-lint run` + run as build steps, so a successful build is a clean lint. The linter is never + run on the host, which makes a working `docker` the one prerequisite for + linting. - `script/fmt` — format in place: the Go sources with `gofmt -s -w`, and every Markdown file with prettier, at the settings in `.prettierrc` (4-space indents, prose wrapped at 80 columns). prettier is pinned by hash through @@ -791,51 +773,32 @@ entrypoints are: repository mounted read-only: prints any unformatted file and exits non-zero instead of writing. gofmt and prettier both run every time, and each names itself when it fails. The `Dockerfile` runs the same two checks as gates: the - gofmt check in its lint stage, prettier in its `markdown` stage. + gofmt check in its `lint` phase, prettier in its `markdown` stage. - `script/check` — run `script/test`, `script/lint`, and `script/fmt-check`, in - that order. Modifies nothing. Needs `docker`, because `script/lint` and - `script/fmt-check` do. + that order. Modifies nothing. Needs `docker`, because all three do. - `script/docker` — build the Docker image, tagged with the name from - `script/projectname`. The `Dockerfile` runs the gates as build steps, so this - is also the check a developer or reviewer runs by hand. -- `script/cibuild` — build the Docker image untagged. This is what the Gitea - workflow runs on push; because the gates run as build steps, a successful - build implies the repository is green. + `script/projectname`, passing the output of + `git describe --tags --always --dirty` (or `unknown` when that is empty) as + the `VERSION` build argument. The `Dockerfile`'s build stage depends on its + `lint`, `test` and `markdown` stages, so this is also the check a developer or + reviewer runs by hand. +- `script/cibuild` — run `script/bootstrap`, then `script/check`, then build the + image as `script/docker` does. This is what the Gitea workflow runs on push; a + successful run means every check passed. The tests and the linter run twice: + once in `script/check`, and again as stages of the image build. - `script/precommit` — run by the git pre-commit hook: `go mod tidy` must be a no-op (a resulting change to `go.mod` or `go.sum` fails the commit), then `script/check`. - `script/install-precommit` — install the git pre-commit hook that runs `script/precommit`. The hook is written to the common git directory, so the main checkout and every worktree share it. -- `script/verify-lint-image-pin` — fail unless the `golangci/golangci-lint` - reference in `Dockerfile.lint` and the one in the `Dockerfile` lint stage are - the same image at the same digest, naming both if not. The linter is pinned in - those two files and nothing else keeps them in sync, so a bump applied to one - alone would leave `make lint` and the `Dockerfile`'s fail-fast lint stage - checking the same tree against different rulesets, both green. The guard - restates neither pin — a third copy would be the same drift one file further - out — and runs as a gate in both files, so `make lint`, `make check` and - `make docker` all catch it. -`script/verify-linter-pin` used to live here. It compared a linter binary -against a version pin in `script/bootstrap`, and both of its subjects are gone: -no linter binary is copied between build stages any more, and bootstrap pins no -version because it installs no linter. The drift it existed to catch has moved -from binary-versus-pin to pin-versus-pin, which is what -`script/verify-lint-image-pin` above checks. - -`script/lint`, `script/docker` and `script/cibuild` all pass a freshly computed -`CHECK_EPOCH` build argument, and the gate steps in `Dockerfile.lint` and -`Dockerfile` reference it. Without that, an unchanged tree lets Docker serve the -gate layers from cache and the build exits 0 having executed no tests and no -lint — a green it never earned, and one this repository has produced twice. -`CHECK_EPOCH` invalidates the gate layers on every run while leaving the pinned -base images and the dependency layers cached. Each script's value carries the -process id as well as the epoch, because two runs land inside the same second -easily and a bare epoch would cache the second one. Each `Dockerfile` stage with -gates fails when the value is empty, so a bare `docker build .` stops with -`CHECK_EPOCH is unset; build via script/cibuild or script/docker` instead of -serving the gates from cache. +Every `docker build` in `script/` passes `--no-cache`. On an unchanged tree +Docker would serve the gate steps from its cache, and the build would pass +having run no test and no linter. Every run therefore downloads the Go modules +again and needs the network. `script/test` and `script/lint` send the daemon +only a build context, so they work against a remote docker daemon; `script/fmt` +and `script/fmt-check` mount the repository and need a local one. ## Build @@ -847,17 +810,15 @@ compile recipe: the default target. - `make bootstrap` — install the build and development dependencies. - `make setup` — prepare a fresh clone: `bootstrap` plus the pre-commit hook. -- `make test` — run the test suite (30-second timeout; reruns with `-v` on - failure). -- `make test-race` — run the test suite under the race detector, in Docker (see - `script/test-race`); requires `docker`. Not part of `make check`. -- `make lint` — run `golangci-lint` with the repo config, in Docker (see - `script/lint`); requires `docker`. +- `make test` — run the test suite under the race detector, in Docker (90-second + timeout; reruns with `-v` on failure; see `script/test`); requires `docker`. +- `make lint` — run `golangci-lint` with the repo config and the gofmt check, in + Docker (see `script/lint`); requires `docker`. - `make fmt` / `make fmt-check` — format the Go sources and the Markdown / verify formatting without writing; requires `docker`, for prettier (see `script/fmt`). - `make check` — `test`, `lint`, and `fmt-check`; modifies nothing. Requires - `docker`, via `lint` and `fmt-check`. + `docker`. - `make docker` — build the Docker image, which runs the gates as build stages. - `make hooks` — install the pre-commit hook. - `make clean` — remove the binary. diff --git a/REPO_POLICIES.md b/REPO_POLICIES.md index bc2f161..20382d1 100644 --- a/REPO_POLICIES.md +++ b/REPO_POLICIES.md @@ -1,6 +1,6 @@ --- title: Repository Policies -last_modified: 2026-07-06 +last_modified: 2026-10-04 --- This document covers repository structure, tooling, and workflow standards. Code @@ -60,17 +60,28 @@ style conventions are in separate documents: prerequisite since nvm requires bash. yarn is then pinned via `corepack prepare yarn@ --activate`. Never install "latest" or "lts"; always exact versions. `script/cibuild` runs the CI build: it changes to the - repo root and runs `docker build .`; the Gitea workflow calls it. Four further - scripts are our own extensions to the standard: `script/check` runs - `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is - what the git pre-commit hook runs, and it calls `script/check`; - `script/install-precommit` installs the git pre-commit hook (the `make hooks` - target shims to it); and `script/projectname` (literally that filename) simply - outputs the project's name. Scripts that need the name call - `script/projectname` — e.g. `script/docker` assembles its image tag from it — - so those scripts stay byte-identical across all repos. Repo-type-specific - pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in - `script/precommit`, not in the hook itself. Model scripts are at + repo root, runs `script/bootstrap`, runs `script/check`, and builds the image + with the version; the Gitea workflow calls it. **`script/cibuild` runs + `script/bootstrap` first**, because the workflow checks out the repo and runs + nothing else, while `script/fmt-check` runs the formatter on the host: on a + pristine checkout with nothing installed the run dies there, after the + containerised gates have passed. **The bootstrap alone is not enough**: + `script/bootstrap` installs node and yarn under nvm and leaves neither on the + `PATH` of the shell that called it, so a bare `yarn` still exits 127. The host + entrypoints that need yarn — `script/fmt` and `script/fmt-check` — therefore + source nvm for the pinned node version before invoking it, exactly as + `script/bootstrap`'s own install step does. A runner carrying nothing but + docker and git then gets through `script/check`. Four further scripts are our + own extensions to the standard: `script/check` runs `script/test`, + `script/lint` and `script/fmt-check`; `script/precommit` is what the git + pre-commit hook runs, and it calls `script/check`; `script/install-precommit` + installs the git pre-commit hook (the `make hooks` target shims to it); and + `script/projectname` (literally that filename) simply outputs the project's + name. Scripts that need the name call `script/projectname` — e.g. + `script/docker` assembles its image tag from it — so those scripts stay + byte-identical across all repos. Repo-type-specific pre-commit extras (e.g. + `go mod tidy` verification in Go repos) belong in `script/precommit`, not in + the hook itself. Model scripts are at `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/`. The README must document the provided scripts in an **Entrypoints** section (see the README requirements below). @@ -89,87 +100,198 @@ style conventions are in separate documents: contributor should be able to understand the entire development workflow by reading the Makefile. -- Every repo should have a `Dockerfile`. All Dockerfiles must run `make check` - as a build step so the build fails if the branch is not green. For non-server - repos, the Dockerfile should bring up a development environment and run - `make check`. For server repos, `make check` should run as an early build - stage before the final image is assembled. Dockerfiles install development - prerequisites by running `script/bootstrap` rather than duplicating installs - inline; COPY `script/` and the dependency manifests (`package.json` + - `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap - layer stays cached until dependencies change. +- Every repo should have a `Dockerfile`, and it carries the repo's gates: a + `lint` phase and a `test` phase, with the final stage depending on both so the + image cannot be built unless they pass. For non-server repos the final stage + brings up a development environment; for server repos it is the runtime image. + The gate phases and the build stage start from their pinned base images and + install what those images lack either inline, as the canonical Go `Dockerfile` + below does for `git`, or by running `script/bootstrap`, as the `prompts` + repo's own `Dockerfile` does for its yarn packages. The development + environment stage installs development prerequisites by running + `script/bootstrap` rather than duplicating its installs inline. A stage that + runs `script/bootstrap` COPYs `script/` and the dependency manifests + (`package.json` + `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it. -- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go - repos use a multistage build where linting runs in an independent stage based - on the `golangci/golangci-lint` image (pinned by hash). This stage runs - `make fmt-check` and `make lint` before the full build begins. The build stage - then declares an explicit dependency on the lint stage via - `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete - linting before proceeding to compilation and tests. This ensures lint failures - surface in seconds rather than minutes, without blocking on dependency - download or compilation in the build stage. +- **Linting and testing run in Docker, as phases of the `Dockerfile`.** There is + no separate lint file. `script/lint` and `script/test` each build one phase + and nothing else: - The standard pattern for a Go repo Dockerfile is: + ```sh + docker build --no-cache --target lint -t "$(script/projectname)-lint" . + docker build --no-cache --target test -t "$(script/projectname)-test" . + ``` + + **A stage that is not the last one in the file is built only when the final + stage's chain depends on it, or when `--target` names it.** That is why the + two gates are always invoked by name here, and why the final stage carries a + `COPY --from=` of a harmless file from each of them: without that edge a + plain `docker build .` builds the last stage alone and exits 0 having linted + and tested nothing. + + **Every `docker build` in `script/` is tagged**, here and in + `script/cibuild` and `script/docker`. An untagged build leaves a dangling + image behind on every invocation, on every developer host and every CI + runner; a tagged one replaces the previous image. + + Inside a phase the tool is invoked directly — `golangci-lint`, `go test`, + `eslint`, `prettier` — never through `make lint` or `script/test`, which are + themselves a `docker build` and would recurse into a daemon that does not + exist in a build step. Formatting is the exception and stays on the host: + `script/fmt` writes the working tree, and `script/fmt-check` is its + read-only twin. + + **No lint verdict may come from a host invocation of the linter.** On a + shared host golangci-lint reads a result cache keyed on file content rather + than location, so a second checkout of the same content is served the first + one's findings, and a host-global lock in `$TMPDIR` makes concurrent runs + exit non-zero with `parallel golangci-lint is running` — a status a caller + cannot tell from real findings. Both have produced wrong verdicts in this + org, in both directions. A container has its own cache, its own `TMPDIR` and + a digest-pinned binary, so neither is reachable. + +- **Any build that runs checks is built with `--no-cache`.** Docker invalidates + a `COPY` layer only when the copied content changes, so on an unchanged tree + the check `RUN` is served from cache, nothing executes, and the build still + exits 0. Every `docker build` in `script/` therefore passes `--no-cache`: + `script/lint`, `script/test`, `script/cibuild` and `script/docker` are the + four, and there is no fifth — `script/check` runs the two gate phases and + `script/fmt-check`, and builds no image of its own. A bare `docker build .` is + not evidence that anything ran: a sub-second build reporting success is a + cache hit, not a result. Never invalidate by pruning — `docker builder prune` + and friends destroy a build cache shared with every other build on the host. + When a check is added or changed, prove it works by planting a defect it must + catch and watching the run fail on it, then revert the defect. A green run + alone shows neither that the check ran nor that it covers what it should. + +- **The gate phases are separate stages, and the build stage depends on both.** + The lint phase is based on the `golangci/golangci-lint` image (pinned by + hash), so lint failures surface in seconds rather than after a full compile, + and the test phase is based on the Debian Go image. The canonical Go repo + `Dockerfile`: ```dockerfile - # Lint stage — fast feedback on formatting and lint issues + # Lint phase # golangci/golangci-lint:v2.x.x, YYYY-MM-DD FROM golangci/golangci-lint@sha256:... AS lint WORKDIR /src COPY go.mod go.sum ./ RUN go mod download COPY . . - RUN make fmt-check - RUN make lint + RUN golangci-lint run --config .golangci.yml ./... - # Build stage - # golang:1.x-alpine, YYYY-MM-DD - FROM golang@sha256:... AS builder + # Test phase. -race needs cgo and so a C compiler, which the Debian Go + # image ships and the alpine one does not. + # golang:1.x, YYYY-MM-DD + FROM golang@sha256:... AS test WORKDIR /src - - # Force BuildKit to run the lint stage before proceeding - COPY --from=lint /src/go.sum /dev/null - COPY go.mod go.sum ./ RUN go mod download COPY . . - RUN make test + RUN go test -timeout 90s -race -cover ./... || \ + { echo "--- Rerunning with -v for details ---"; \ + go test -timeout 90s -race -v ./...; exit 1; } - ARG VERSION=dev - RUN CGO_ENABLED=0 go build -trimpath \ - -ldflags="-s -w -X main.Version=${VERSION}" \ - -o /app ./cmd/app/ + # Build stage. Nothing is wanted from either phase above; the copies + # are what make BuildKit build them first, so this stage cannot run + # unless lint and test passed. + # golang:1.x-alpine, YYYY-MM-DD + FROM golang@sha256:... AS builder + COPY --from=lint /src/go.sum /dev/null + COPY --from=test /src/go.sum /dev/null + RUN apk add --no-cache git + # A tar-stream context keeps the sender's file owners, which git refuses. + RUN git config --system --add safe.directory /src + WORKDIR /src + COPY go.mod go.sum ./ + RUN go mod download + COPY . . - # Runtime stage + # The VERSION build arg when one is given, otherwise + # `git describe --tags --always` on the .git in the build context. With + # .git present, a version that is still empty, dev or unknown fails the + # build: git is missing or could not read the checkout. + ARG VERSION + RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \ + if [ -e .git ]; then \ + case "$VERSION" in ""|dev|unknown) \ + echo "version is '$VERSION' although .git is present" >&2; \ + exit 1 ;; \ + esac; \ + fi; \ + CGO_ENABLED=0 go build -trimpath \ + -ldflags="-s -w -X main.Version=${VERSION}" \ + -o /app ./cmd/app/ + + # Runtime stage, and the last one FROM alpine@sha256:... COPY --from=builder /app /usr/local/bin/app ENTRYPOINT ["app"] ``` Key points: - - The lint stage uses the `golangci/golangci-lint` image directly (it - includes both Go and the linter), so there is no need to install the - linter separately. - - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates - a stage dependency. BuildKit runs stages in parallel by default; without - this line, the build stage would not wait for lint to finish and a lint - failure might not fail the overall build. + - The lint phase uses the `golangci/golangci-lint` image directly (it has + both Go and the linter), so nothing needs installing. + - `COPY --from= /src/go.sum /dev/null` is a no-op copy whose only + purpose is the ordering edge. BuildKit runs stages in parallel by default, + and a stage nothing depends on is not built at all, so without these two + lines a red gate would not fail the build. + - Keep the runtime stage last, and if you add a stage after it, give it the + same two copies. A plain `docker build .` builds the last stage's chain + and nothing else. - If the project uses `//go:embed` directives that reference build artifacts - (e.g. a web frontend compiled in a separate stage), the lint stage must + (e.g. a web frontend compiled in a separate stage), the lint phase must create placeholder files so the embed directives resolve. Example: `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`. - The lint stage should not depend on the actual build output — it exists to - fail fast. - - If the project requires CGO or system libraries for linting (e.g. - `vips-dev`), install them in the lint stage with `apk add`. - - The build stage runs `make test` after compilation setup. Tests run in the - build stage, not the lint stage, because they may require compiled - artifacts or heavier dependencies. + - If the project requires CGO or system libraries for linting, install them + in the lint phase. The `golangci/golangci-lint` image is Debian-based and + has no `apk`, so install with `apt-get` under the Debian package name + (`libvips-dev`, where alpine says `vips-dev`), and delete the package + lists in the same `RUN`, so the layer does not keep them: + + ```dockerfile + RUN apt-get update \ + && apt-get install -y --no-install-recommends libvips-dev \ + && rm -rf /var/lib/apt/lists/* + ``` + + - `.dockerignore` lets `.git` into the build context. It keeps out every git + `config` at any depth (`**/.git/config`, `**/.git/modules/**/config`): the + repository's own, each submodule's under `.git/modules/`, and that of a + submodule keeping its own `.git` directory. `git describe` does not need + them, and each can hold a credential: a password in a remote URL, or the + token the CI checkout step stores there. A submodule whose name has a + `config` segment (`config`, `deploy/config`, `config/lib`) loses its whole + git directory to `**/.git/modules/**/config`, and Go's version stamping + then fails the build: give it a name without that segment + (`git submodule add --name`). The stage that compiles has `git` (the + Debian Go image has it; an alpine one needs `apk add --no-cache git`) and + takes the version from the `VERSION` build argument when one is given, + otherwise from `git describe --tags --always`. That gives the tag on a + tagged commit; on a later commit, the tag, the number of commits since it + and the short commit (`v1.2.3-4-gabc1234`); and the short commit when no + tag is reachable. The stage that compiles also marks its working directory + safe for git (`git config --system --add safe.directory /src`): a context + sent as a tar stream keeps the sender's file owners, and git refuses a + checkout owned by another user, so the version would come out empty. + `ARG VERSION` has no default, and the build fails if the context carries + `.git` and the version still comes out empty, `dev` or `unknown`. A plain + `docker build .` with no build arguments must succeed; a Dockerfile that + refuses an empty build argument drops that refusal and keeps the argument. - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that - runs `script/cibuild` (which runs `docker build .`) on push. Since the - Dockerfile already runs `make check`, a successful build implies all checks - pass. + runs `script/cibuild` on push, and checks out the repo as its only other step. + That script bootstraps, runs the gate phases, and then builds the image, so a + successful run means every check passed; a bare `docker build .` does not + carry the same guarantee, because its gate phases may come from the cache. The + image build is uncached and so runs the gate phases a second time. That is the + price of the rule above, and it is worth paying: the image that ships is built + from a run of its own gates rather than from a cache entry. A separate + workflow limited to `main` by a `branches` list under `on: push` cannot be + checked by review: to try a change to it, add the feature branch to that list + and push, then remove the branch from the list again before merging. Keep any + job in it that publishes behind `if: github.ref_name == 'main'`, so the run + from the feature branch publishes nothing. - Use platform-standard formatters: `black` for Python, `prettier` for JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with @@ -189,14 +311,21 @@ style conventions are in separate documents: module under test to verify it compiles/parses. There is no excuse for `make test` to be a no-op. -- `make test` must complete in under 20 seconds. Add a 30-second timeout in the - Makefile. +- `make test` must complete in under 60 seconds. That is the hard cap, and a + suite that exceeds it fails. Under 20 seconds is the target. A suite between + 20 and 60 seconds is still green, but the overage must be filed as an + improvement bug against that repo. Add a 90-second timeout to the test + invocation (`go test -timeout 90s`). The backstop deliberately sits above the + hard cap so that it catches a genuinely hung test rather than a merely slow + one. -- **`make test` should use the conditional verbose rerun pattern.** Run tests - without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to - show full output. This keeps CI logs and `docker build` output clean on - success (just package/suite summaries) while providing full diagnostic detail - on failure (every test case, every assertion). The general shell pattern: +- **The test command should use the conditional verbose rerun pattern.** Run + tests without `-v` (verbose) first. If tests fail, automatically rerun with + `-v` to show full output. This keeps CI logs and `docker build` output clean + on success (just package/suite summaries) while providing full diagnostic + detail on failure (every test case, every assertion). The command lives in the + `test` phase of the `Dockerfile`, since `script/test` builds that phase; the + Makefile form below is the same pattern for any repo-local invocation: ```makefile test: @@ -209,11 +338,26 @@ style conventions are in separate documents: ```makefile test: - @go test -timeout 30s -race -cover ./... || \ + @go test -count=1 -timeout 90s -race -cover ./... || \ { echo "--- Rerunning with -v for details ---"; \ - go test -timeout 30s -race -v ./...; exit 1; } + go test -count=1 -timeout 90s -race -v ./...; exit 1; } ``` + `-count=1` is required on both invocations: it defeats Go's test _result_ + cache, so neither run can report a stored pass in place of running the + tests. It leaves the build cache alone, so it costs the runtime of the suite + and no recompilation. + + That cache is Go's own, separate from Docker's layer cache. Go stores a + passing result in its cache directory (`GOCACHE`), and when the same tests + run again on unchanged code it prints that result, marked `(cached)`, + without running them. That matters on a developer's machine, where this + target runs and the directory lasts from one run to the next. The `test` + phase of the `Dockerfile` needs no `-count=1`: its base image holds no + result for this repo's tests and nothing before its `go test` step runs a + test, so there is nothing to replay. `--no-cache` (above) is what makes that + step run on an unchanged tree. + Python example: ```makefile @@ -239,10 +383,84 @@ style conventions are in separate documents: must be in `.gitignore`. No exceptions. - `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`), - editor files (`.swp`, `*~`), language build artifacts, and `node_modules/`. - Fetch the standard `.gitignore` from - `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up - a new repo. + editor files (`.swp`, `*~`), in-repo agent scratch directories (`.claude/`), + language build artifacts, and `node_modules/`. Fetch the standard `.gitignore` + from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when + setting up a new repo. These patterns are written to `.gitignore`'s own + semantics, in which an unanchored pattern already matches at every depth; they + are not a `.dockerignore` and must not be transplanted into one unmodified. + +- **`.dockerignore` does not use `.gitignore` semantics, and copying patterns + across unmodified leaves secrets in the build context.** Docker matches with + `moby/patternmatcher`: `filepath.Match` semantics plus a `**` extension, so + `*` does not cross `/` and a pattern without a leading `**/` is anchored at + the build-context root. A `.dockerignore` listing `.env`, `*.pem` and `*.key` + therefore excludes only the copies at the repository root, while `config/.env` + and `certs/server.key` still reach the context and can land in an image layer + — which is more dangerous than a short file with no secret patterns at all, + because it reads as solved and stops anyone looking. Give every + depth-independent pattern the `**/` prefix and leave only genuinely + root-anchored entries unprefixed: `.claude`, and the repo's own host-built + binary, written `/myapp` and never `**/myapp`, which would also match + `cmd/myapp/` and delete the package directory from the context. Matching is + case-sensitive, and an ALL-CAPS twin per pattern still misses `Server.Key`, so + secret names use character ranges — `**/*.[kK][eE][yY]`, `**/*.[pP][eE][mM]`, + and likewise for `.envrc` and the extensionless SSH keys. Where such a pattern + also catches something the build needs, re-include it with a negation + (`!docs/example.env`); deleting the pattern reopens the exposure for every + other file it covers. Fetch the standard `.dockerignore` from + `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore` and extend + it with the repo's own artifacts. + +- **In-repo agent scratch belongs in both files, written to each file's own + semantics.** `.claude/` holds one worktree per in-flight agent — an entire + additional checkout of the repo — so under `COPY . .` the build context + inflates by a multiple of the repo and another session's unreviewed work can + be copied into an image layer. In `.gitignore` the entry is `.claude/`, + unanchored. In `.dockerignore` it is `.claude`, anchored and with **no** `**/` + prefix, because the prefixed form would also delete any nested directory of + that name from the build. Anchoring carries a known gap that the canonical + `.dockerignore` states in its own comment, since consuming repos receive the + file and not the tracker: the directory is created in the agent's working + directory, so a repo running agents in subdirectories still ships + `services/api/.claude/` and must add its own anchored entry there. + +- **A plain `docker build .` of a clone stamps the version that + `git describe --tags --always` gives**, derived from the `.git` in the build + context as the canonical `Dockerfile` above shows. Without its failure check, + a missing `git` or an unreadable checkout would leave `-X main.Version=` empty + and the build would still exit 0. `script/docker` and `script/cibuild` pass + the version they compute on the host; it takes precedence. They do this + byte-identically across repos: + + ```sh + # Own line: a failing command substitution inside an argument does not + # trip `set -e`, so the inline form degrades to an empty constant. + version="$(git describe --tags --always --dirty 2>/dev/null || true)" + [ -n "$version" ] || version="unknown" + docker build --no-cache \ + --build-arg VERSION="$version" \ + -t "$(script/projectname)" . + ``` + + `--always` makes an untagged repo yield an abbreviated commit hash rather + than failing, and the `[ -n "$version" ]` line is the single place the + fallback is applied — a live check that fires on a build from an export with + no `.git` and on a repository with no commits yet. Do not fold it into the + substitution as `|| echo unknown`, which makes the guard unreachable. The + Dockerfile's side is `ARG VERSION` in the stage that compiles, declared + there because `ARG` is stage-scoped; passing `VERSION` to a repo whose + Dockerfile declares no such `ARG` is ignored and costs nothing, which is why + the scripts stay byte-identical. One consequence for CI: the standard + checkout action clones shallow and fetches no tags, so a repo that embeds a + tag-derived version must set `fetch-depth: 0` on its checkout step. + +- **Verify `.dockerignore` by enumerating the image, not by reading the + patterns.** Plant files at the root _and_ at least two directories deep, build + a probe image that does `COPY . .`, and list what actually landed + (`docker run --rm --entrypoint find IMAGE /app`). The `transferring context` + size is not a substitute: a nested secret is a few bytes, and BuildKit + transfers only the delta from the previous build. - **No build artifacts in version control.** Code-derived data (compiled bundles, minified output, generated assets) must never be committed to the @@ -258,9 +476,56 @@ style conventions are in separate documents: - Make all changes on a feature branch. You can do whatever you want on a feature branch. -- `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only - manually by the user. Fetch from - `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`. +- `.golangci.yml` is standardized. The vendored copy in a consuming repo must + _NEVER_ be modified by an agent: fetch it from + `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and keep it + byte-identical, so that no repo can quietly loosen its own linting. Linter + configuration changes are made to the canonical copy in the `prompts` repo and + reach consuming repos by re-vendoring; an agent may open a PR against + canonical, which only the user merges. One list is exempt from byte-identity, + because it cannot be written once for every repo: the `deny` list of the + `test-support` depguard rule, where a repo names its own test-support packages + by full import path. A repo adds entries there and changes nothing else, and a + re-vendor carries its entries forward. The canonical golangci-lint version is + v2.14.0 (released 2026-09-24), pinned as the digest of the lint phase's base + image + (`golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f`, + which reports `2.14.0 built with go1.27.0 from 114493f9`). A module's `go` + directive must not name a newer Go minor version than the one golangci-lint + was built with, or golangci-lint refuses to lint it: this release lints + `go 1.27.1` but not `go 1.28`. That digest is the only pin, since no repo + installs golangci-lint on the host. A repo sets the lint phase digest to the + one named here and re-vendors `.golangci.yml` in the same commit, whichever of + the two prompted the change: the canonical copy can name linters that an older + golangci-lint rejects, and a newer golangci-lint can add linters that + `default: all` switches on until the canonical copy disables them. + +- **`script/bootstrap` installs a pinned tool by comparing versions, never by + testing presence.** An `if ! command -v ; then install; fi` guard tests + `PATH` only, so on an already-provisioned machine the pin is inert and a + version bump is a silent no-op — while the Dockerfile, installing into a clean + image, gets the pinned version, so a local `make check` and `make docker` can + disagree about what the tool even is. The canonical form: + - compares the installed version against the pin over the **whole** version + token; a parser that stops at the first `-` reports `2.12.2` for a host + running `2.12.2-rc1` and skips the install; + - treats absent, non-zero, empty or unrecognised `--version` output as a + mismatch, so the failure direction is a redundant install and never a + skipped one; + - after installing, re-resolves the binary the way callers do — `hash -r`, + then through `PATH`, not through the directory the installer wrote to — + and fails naming the resolved path, since an install that a shadowing + binary hides succeeds while changing nothing any caller sees; + - is actually called, and prints the version on both success paths: a + function defined and never invoked has the same exit status and the same + empty output as one that worked. + + Keep it POSIX sh: no arrays, no `[[`, no `grep -P`. + + A Go tool a repo needs on the host is installed with `go install` pinned to + a commit hash (`go install @`). It is never tracked as + a `go.mod` tool dependency or through a `tools.go` file, either of which + pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`. - When pinning images or packages by hash, add a comment above the reference with the version and date (YYYY-MM-DD). @@ -374,12 +639,14 @@ style conventions are in separate documents: settings. - Avoid putting files in the repo root unless necessary. Root should contain - only project-level config files (`README.md`, `Makefile`, `Dockerfile`, - `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`, and - language-specific config). Everything else goes in a subdirectory. Canonical - subdirectory names: + only project-level config files (`README.md`, `AGENTS.md`, `Makefile`, + `Dockerfile`, `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`, + and language-specific config). Everything else goes in a subdirectory. + Canonical subdirectory names: - `bin/` — executable scripts and tools - - `cmd/` — Go command entrypoints + - `cmd/` — Go command entrypoints; thin only: one `main.go` per binary whose + body is a single call into `internal/` or `pkg/`, no project logic in + `cmd/` - `configs/` — configuration templates and examples - `deploy/` — deployment manifests (k8s, compose, terraform) - `docs/` — documentation and markdown (README.md stays in root) @@ -406,3 +673,7 @@ style conventions are in separate documents: - Go: `go.mod`, `go.sum`, `.golangci.yml` - JS: `package.json`, `yarn.lock`, `.prettierrc`, `.prettierignore` - Python: `pyproject.toml` + +- Guidance for coding agents lives in one `AGENTS.md` at the repository root. It + is never committed under a file or directory named after one agent tool, such + as `CLAUDE.md` or `.claude/`, and never split into separate memory files. diff --git a/TODO.md b/TODO.md index a538990..18bce24 100644 --- a/TODO.md +++ b/TODO.md @@ -29,6 +29,13 @@ # Completed Steps +- re-vendor the canonical files from `sneak/prompts` commit `dd4027b`: + golangci-lint v2.14.0; lint and test are phases of the `Dockerfile`, and + `make test` runs the suite under the race detector, so `Dockerfile.lint`, + `script/verify-lint-image-pin` and `make test-race` are gone; every + `docker build` in `script/` passes `--no-cache`; `.claude/settings.json` is + deleted (2026-10-07, https://git.eeqj.de/sneak/sfdupes/issues/95) + - cut the narration from `TODO.md` Completed Steps and from the comments in `script/` and both Dockerfiles; §Workflow now branches from and merges to `next` (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/49) @@ -167,32 +174,28 @@ `ENV PATH=/home/builder/go/bin:$PATH` went with its `go install`. `script/verify-linter-pin` is retired; `script/verify-lint-image-pin`, a gate in both files, compares their two `FROM` lines and restates neither pin. - Traps: an unchanged tree lets a lint build pass in under a second having run - no linter, so every gate `RUN` references `ARG CHECK_EPOCH` (BuildKit hashes - the expanded command) and `script/lint` passes `"$(date +%s)-$$"`, the PID - because two runs land in the same second easily. Nothing inside an image build - may shell out to docker, so the `Dockerfile` lint stage calls `golangci-lint` - directly and the build stage runs `make test` and `make fmt-check` instead of - `make check`, through `make` because the Makefile's `export CGO_ENABLED = 0` - only reaches what it invokes. `COPY --from=lint /src/go.sum /dev/null` - replaces the copied linter binary as the only edge making the build stage wait - for lint; dropping it would end fail-fast linting under a still-green build. - `golangci-lint config verify`, included per the ruling, validates from an - embedded schema with no network call, but `go mod download` above the gates - still needs the network on a cold cache. Verified: `make lint` green with no - `golangci-lint` on `PATH`; two back-to-back `script/lint` runs on an untouched - tree both ran the linter (27.7s and 28.7s in the lint step, `COPY . .` - `CACHED` above); a planted unused variable failed `script/lint`, and failed - `make docker` at `[lint 9/9]` with the build stage stopped at - `[builder 3/12]`; the drift guard fails on a tag-only, a digest-only and an - unreadable reference, naming both sides; under `--network none` config verify - passes a valid config and rejects an invalid one; `make docker` green in 5m35s - with all six gates run under one epoch (lint 37.6s, test 25.2s reporting - `ok sneak.berlin/go/sfdupes 1.938s coverage: 88.5%`, not `(cached)`); in the - builder image with the Go test cache off, `--user 0:0` still fails - `TestScanHardlinkRunFailsTogether` where the unprivileged user passes. Noted - for follow-up, not fixed here: `golangci-lint` warns that `gomodguard` is - deprecated since v2.12.0 in favour of `gomodguard_v2`. + Traps: nothing inside an image build may shell out to docker, so the + `Dockerfile` lint stage calls `golangci-lint` directly and the build stage + runs `make test` and `make fmt-check` instead of `make check`, through `make` + because the Makefile's `export CGO_ENABLED = 0` only reaches what it invokes. + `COPY --from=lint /src/go.sum /dev/null` replaces the copied linter binary as + the only edge making the build stage wait for lint; dropping it would end + fail-fast linting under a still-green build. `golangci-lint config verify`, + included per the ruling, validates from an embedded schema with no network + call, but `go mod download` above the gates still needs the network on a cold + cache. Verified: `make lint` green with no `golangci-lint` on `PATH`; two + back-to-back `script/lint` runs on an untouched tree both ran the linter + (27.7s and 28.7s in the lint step, `COPY . .` `CACHED` above); a planted + unused variable failed `script/lint`, and failed `make docker` at `[lint 9/9]` + with the build stage stopped at `[builder 3/12]`; the drift guard fails on a + tag-only, a digest-only and an unreadable reference, naming both sides; under + `--network none` config verify passes a valid config and rejects an invalid + one; `make docker` green in 5m35s with all six gates run (lint 37.6s, test + 25.2s reporting `ok sneak.berlin/go/sfdupes 1.938s coverage: 88.5%`, not + `(cached)`); in the builder image with the Go test cache off, `--user 0:0` + still fails `TestScanHardlinkRunFailsTogether` where the unprivileged user + passes. Noted for follow-up, not fixed here: `golangci-lint` warns that + `gomodguard` is deprecated since v2.12.0 in favour of `gomodguard_v2`. - install the Docker build stage's prerequisites by running `script/bootstrap` instead of `apk add --no-cache make` inline (2026-08-09, branch @@ -205,43 +208,32 @@ `script/verify-linter-pin`, run in the build stage before bootstrap, fails the build naming both versions unless that copied binary is the version `script/bootstrap` pins; a pin it cannot read is a hard failure, not a skip. - `$GOPATH/bin` joins `PATH`, where bootstrap's `go install` lands. Everything - added sits above `ARG CHECK_EPOCH`, and the `chown` and `USER builder` still - precede `make check`. Verified: the guard fails the build with both versions - named when the lint stage's linter is faked to another version, and passes an - unmodified build; bootstrap runs clean under Alpine's `sh` and `apk`, finding - the copied linter already at the pin; a second build served the bootstrap and - dependency layers `CACHED` while both gates ran with a fresh epoch; a planted - `unused` finding failed the build at the lint gate in 48.9s with the build - stage's `make check` never starting; and the suite run in the image as - `--user 0:0` fails `TestScanHardlinkRunFailsTogether`, so the drop to the - unprivileged user is still needed. That last check needs the Go test cache - off: as root it first reported `ok ... (cached)`, reusing the build-time - result. Build times on a noisy shared host: 2m13s on an unchanged tree, 2m17s - and 4m29s after a source change, 5m14s cold, which breaches the policy - ceiling; `chown -R builder:builder /src /home/builder` walks the module cache - and alone varied from 77s to 210s across those builds, and `main` measured - 5m03s cold with a 209s `chown`. Filed as + `$GOPATH/bin` joins `PATH`, where bootstrap's `go install` lands. The `chown` + and `USER builder` still precede `make check`. Verified: the guard fails the + build with both versions named when the lint stage's linter is faked to + another version, and passes an unmodified build; bootstrap runs clean under + Alpine's `sh` and `apk`, finding the copied linter already at the pin; a + second build served the bootstrap and dependency layers `CACHED` while both + gates ran; a planted `unused` finding failed the build at the lint gate in + 48.9s with the build stage's `make check` never starting; and the suite run in + the image as `--user 0:0` fails `TestScanHardlinkRunFailsTogether`, so the + drop to the unprivileged user is still needed. That last check needs the Go + test cache off: as root it first reported `ok ... (cached)`, reusing the + build-time result. Build times on a noisy shared host: 2m13s on an unchanged + tree, 2m17s and 4m29s after a source change, 5m14s cold, which breaches the + policy ceiling; `chown -R builder:builder /src /home/builder` walks the module + cache and alone varied from 77s to 210s across those builds, and `main` + measured 5m03s cold with a 209s `chown`. Filed as https://git.eeqj.de/sneak/sfdupes/issues/43 - bust the Docker layer cache for the gate steps, so `script/cibuild` and `script/docker` cannot report a green they did not earn (2026-08-09, branch `cibuild-cache-bust`, closes https://git.eeqj.de/sneak/sfdupes/issues/32): the `Dockerfile` copies the tree before its gates, so on an unchanged tree Docker - served them from cache and the build exited 0 having run nothing. Both scripts - now pass `--build-arg CHECK_EPOCH="$(date +%s)"`. `ARG` is per stage and the - gates span two stages, so it is declared in both; BuildKit hashes the expanded - command, so each gate `RUN` echoes the epoch, which also logs it as evidence - the layer ran. It sits below the dependency layers so they stay cached. - Verified under `BUILDKIT_PROGRESS=plain`, each script run twice back to back - on an unchanged tree: all three gates ran on all four runs with a fresh epoch - (`script/cibuild` 78.8s then 61.1s; `script/docker` 61.1s then 53.4s), and - thirteen steps were still served `CACHED`. With a planted `unused` finding the - build failed at `make lint` in 36.1s and the build-stage `make check` never - started. Run as root, the same image fails `TestScanHardlinkRunFailsTogether`, - because root reads through the `chmod(0)` the test relies on, so the build - stage must drop to the unprivileged `builder` user. Local fix only; - propagating it to the canonical templates is - https://git.eeqj.de/sneak/prompts/issues/26 + served them from cache and the build exited 0 having run nothing. Every + `docker build` in `script/` now passes `--no-cache` instead + (https://git.eeqj.de/sneak/sfdupes/issues/95). Run as root, the tests fail + `TestScanHardlinkRunFailsTogether`, because root reads through the `chmod(0)` + the test relies on, so they run as an unprivileged user - check the installed golangci-lint version in `script/bootstrap` instead of only its presence (2026-08-09, branch `bootstrap-version-check`, closes https://git.eeqj.de/sneak/sfdupes/issues/24): the version lives only in @@ -397,6 +389,3 @@ Accepted divergences (no action): - flat single-package layout with `.go` files in the repo root — fine for a small single-binary tool per the Go styleguide; the tracker audit agrees -- `make test` runs without `-race` — the repo mandates `CGO_ENABLED=0` (pure-Go - builds) and the race detector requires cgo, so the detector runs in a separate - cgo-enabled container, `make test-race`, which is not part of `make check` diff --git a/script/bootstrap b/script/bootstrap index 3e4c106..af57f26 100755 --- a/script/bootstrap +++ b/script/bootstrap @@ -68,9 +68,9 @@ main() { # Warn, do not fail: only the targets named below, and the # pre-commit hook, need docker. if missing docker; then - echo "bootstrap: WARNING: docker not found; make lint, make fmt," >&2 - echo "bootstrap: make fmt-check, make check, make docker and" >&2 - echo "bootstrap: make test-race require it." >&2 + echo "bootstrap: WARNING: docker not found; make test, make lint," >&2 + echo "bootstrap: make fmt, make fmt-check, make check and" >&2 + echo "bootstrap: make docker require it." >&2 fi go mod download diff --git a/script/cibuild b/script/cibuild index 5eca17f..d8d3200 100755 --- a/script/cibuild +++ b/script/cibuild @@ -1,19 +1,28 @@ #!/bin/sh -# script/cibuild: run the CI build. The Gitea workflow runs this on -# push. The Dockerfile runs every gate make check runs, as build steps, -# so a successful build means the repo is green. -# -# Without a fresh CHECK_EPOCH, a rebuild of an unchanged checkout serves -# the gate layers from cache and passes having run none of them. The -# process id goes in with the epoch so two runs started in the same -# second still differ. +# script/cibuild: run the CI build. It bootstraps first: a CI runner +# checks out and runs this and nothing else, and script/fmt-check runs +# the formatter on the host, which a pristine checkout cannot do. +# --no-cache for the same reason as script/docker: the gate phases the +# final stage depends on are RUN steps, and a cached one is a check that +# did not run. set -eu -ROOT="$(cd "$(dirname "$0")/.." && pwd -P)" +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)" +ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)" main() { cd "$ROOT" - docker build --build-arg CHECK_EPOCH="$(date +%s)-$$" . + "$SCRIPT_DIR/bootstrap" + "$SCRIPT_DIR/check" + # Own line: a failing command substitution inside an argument does + # not trip `set -e`, so the inline form degrades silently to an + # empty constant. The VERSION build argument takes precedence over + # the version a build stage derives from the .git in the context. + version="$(git describe --tags --always --dirty 2>/dev/null || true)" + [ -n "$version" ] || version="unknown" + docker build --no-cache \ + --build-arg VERSION="$version" \ + -t "$("$SCRIPT_DIR/projectname")" . } main "$@" diff --git a/script/docker b/script/docker index 7ebc548..07b626c 100755 --- a/script/docker +++ b/script/docker @@ -1,9 +1,8 @@ #!/bin/sh # script/docker: build the Docker image tagged with the project name. -# The tag comes from script/projectname. CHECK_EPOCH is passed for the -# same reason script/cibuild passes it: without a fresh value an -# unchanged tree is served from cache and this exits 0 having run no -# gate. +# Identical in all repos; the tag comes from script/projectname. +# --no-cache because the gate phases the final stage depends on are RUN +# steps, and a cached one is a check that did not run. set -eu SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)" @@ -11,10 +10,15 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)" main() { cd "$ROOT" - docker build \ - --build-arg CHECK_EPOCH="$(date +%s)-$$" \ - -t "$("$SCRIPT_DIR/projectname")" \ - . + # Own line: a failing command substitution inside an argument does + # not trip `set -e`, so the inline form degrades silently to an + # empty constant. The VERSION build argument takes precedence over + # the version a build stage derives from the .git in the context. + version="$(git describe --tags --always --dirty 2>/dev/null || true)" + [ -n "$version" ] || version="unknown" + docker build --no-cache \ + --build-arg VERSION="$version" \ + -t "$("$SCRIPT_DIR/projectname")" . } main "$@" diff --git a/script/fmt b/script/fmt index 8994c8b..1516af7 100755 --- a/script/fmt +++ b/script/fmt @@ -2,7 +2,8 @@ # script/fmt: format all files (writes): the Go sources with gofmt, the # Markdown with prettier. prettier is never installed on the host: it # runs from the Dockerfile's prettier stage with the repository mounted, -# as the calling user so the files it rewrites keep their owner. The tag +# as the calling user so the files it rewrites keep their owner. The +# build passes --no-cache, as every docker build in script/ does. The tag # makes each build replace the previous image instead of leaving another # one behind. set -eu @@ -14,7 +15,7 @@ main() { cd "$ROOT" gofmt -s -w . image="$("$SCRIPT_DIR/projectname")-prettier" - docker build -q --target prettier -t "$image" . >/dev/null + docker build -q --no-cache --target prettier -t "$image" . >/dev/null docker run --rm --user "$(id -u):$(id -g)" -v "$ROOT:/src" "$image" \ prettier --write '**/*.md' --tab-width 4 --prose-wrap always } diff --git a/script/fmt-check b/script/fmt-check index 788f585..1778b65 100755 --- a/script/fmt-check +++ b/script/fmt-check @@ -26,7 +26,7 @@ main() { # Same image as script/fmt; see there. image="$("$SCRIPT_DIR/projectname")-prettier" - docker build -q --target prettier -t "$image" . >/dev/null + docker build -q --no-cache --target prettier -t "$image" . >/dev/null if ! docker run --rm -v "$ROOT:/src:ro" "$image" \ prettier --check '**/*.md' --tab-width 4 --prose-wrap always; then echo "prettier: Markdown not formatted; run make fmt" >&2 diff --git a/script/lint b/script/lint index d942a1c..2d8b075 100755 --- a/script/lint +++ b/script/lint @@ -1,28 +1,23 @@ #!/bin/sh -# script/lint: run the linter. golangci-lint is never installed on a -# host: this builds Dockerfile.lint, which copies the repo into the -# digest-pinned golangci-lint image and lints as a build step, so a -# successful build is a clean lint. A cold cache needs the network to -# pull the image and for `go mod download`; once warm this runs offline -# until go.mod or go.sum changes. +# script/lint: run the linter. Linting is a phase of the Dockerfile and +# this builds that phase alone; the linter is never installed or run on +# a developer host, where a shared result cache and a host-global lock +# make its answer untrustworthy. # -# Without a fresh CHECK_EPOCH docker serves the gate layers from cache -# on an unchanged tree and this exits 0 having run no linter. The PID is -# in the value because two lint runs land inside the same second easily. -# -# The image is never used, so --output=type=cacheonly writes none; -# without it every run leaves an untagged image behind. +# The phase is not the last stage in the file, so it is built only when +# --target names it. --no-cache because a cached lint layer is a lint +# that did not run. The tag makes each build replace the previous image +# instead of leaving a dangling one behind. set -eu -ROOT="$(cd "$(dirname "$0")/.." && pwd -P)" +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)" +ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)" main() { cd "$ROOT" - docker build \ - --build-arg CHECK_EPOCH="$(date +%s)-$$" \ - --output=type=cacheonly \ - -f Dockerfile.lint \ - . + docker build --no-cache \ + --target lint \ + -t "$("$SCRIPT_DIR/projectname")-lint" . } main "$@" diff --git a/script/test b/script/test index bce66d8..cd239f2 100755 --- a/script/test +++ b/script/test @@ -1,17 +1,19 @@ #!/bin/sh -# script/test: run the test suite. Reruns verbosely on failure so CI -# logs show which test failed. +# script/test: run the test suite. Testing is a phase of the Dockerfile +# and this builds that phase alone, on the same terms as script/lint: +# --target because a phase that is not the last stage is built only when +# named, --no-cache because a cached test layer is a test that did not +# run, and a tag so each build replaces the previous image. set -eu -ROOT="$(cd "$(dirname "$0")/.." && pwd -P)" +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)" +ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)" main() { cd "$ROOT" - go test -timeout 30s -cover ./... || { - echo "--- Rerunning with -v for details ---" - go test -timeout 30s -v ./... - exit 1 - } + docker build --no-cache \ + --target test \ + -t "$("$SCRIPT_DIR/projectname")-test" . } main "$@" diff --git a/script/test-race b/script/test-race deleted file mode 100755 index 8e85862..0000000 --- a/script/test-race +++ /dev/null @@ -1,40 +0,0 @@ -#!/bin/sh -# script/test-race: run the test suite under the race detector. Not part -# of script/check. -# -# The race detector needs cgo and a C compiler, which the host build -# never uses, so the tests run in a golang image that has gcc. The -# checkout is mounted read-only, so the docker daemon must be local. The -# container starts with empty caches every time: each run downloads the -# dependencies and compiles them with the detector, which needs the -# network and takes minutes. -# -# The tests run as the calling user, never as root: several of them make -# a file unreadable and expect reading it to fail, and root reads it -# anyway. When the caller is root they run as nobody, and then the -# checkout must be readable by other users. Neither user has a home -# directory in the image, so HOME is /tmp, where Go puts its build cache. -set -eu - -ROOT="$(cd "$(dirname "$0")/.." && pwd -P)" - -# golang:1.25-trixie, 2026-10-04. Debian rather than the Alpine image the -# Dockerfile builds with, because this one includes gcc. -IMAGE="golang@sha256:2c4c60ef415fbfa5e90300722293bef36c5e63fae17570ce18f580af933dbd73" - -main() { - user="$(id -u):$(id -g)" - if [ "$(id -u)" -eq 0 ]; then - user=65534:65534 - fi - docker run --rm \ - --user "$user" \ - --env HOME=/tmp \ - --env CGO_ENABLED=1 \ - --volume "$ROOT:/src:ro" \ - --workdir /src \ - "$IMAGE" \ - go test -race -timeout 60s ./... -} - -main "$@" diff --git a/script/verify-lint-image-pin b/script/verify-lint-image-pin deleted file mode 100755 index 1a9fb69..0000000 --- a/script/verify-lint-image-pin +++ /dev/null @@ -1,77 +0,0 @@ -#!/bin/sh -# script/verify-lint-image-pin: fail unless the golangci-lint image -# referenced by Dockerfile.lint and the one referenced by the main -# Dockerfile's lint stage are the same image at the same digest. Our own -# extension to scripts-to-rule-them-all, not one of its entrypoints; run -# as a gate in both files. Nothing else keeps the two pins in sync, and -# a bump applied to one alone would lint the same tree against different -# rulesets, both green. -# -# Do not hardcode the expected digest here: that is a third copy to keep -# in sync. -# -# A reference that cannot be read is a hard failure, not a skip: two -# empty strings compare equal. -set -eu - -ROOT="$(cd "$(dirname "$0")/.." && pwd -P)" - -LINT_DOCKERFILE="Dockerfile.lint" -MAIN_DOCKERFILE="Dockerfile" - -# Echo the single golangci-lint image reference in the named Dockerfile. -# Scans every argument of every FROM instruction rather than assuming a -# field position, so `FROM --platform=... img AS stage` reads correctly. -# Exits non-zero, with a diagnosis, unless there is exactly one. -lint_image_ref() { - file="$1" - - if [ ! -f "$file" ]; then - echo "verify-lint-image-pin: $file: not found" >&2 - return 1 - fi - - refs="$( - awk ' - toupper($1) == "FROM" { - for (i = 2; i <= NF; i++) { - if ($i ~ /^golangci\/golangci-lint[:@]/) { - print $i - } - } - } - ' "$file" - )" - - count="$(printf '%s' "$refs" | grep -c . || true)" - if [ "$count" -ne 1 ]; then - echo "verify-lint-image-pin: $file: expected exactly one" \ - "golangci/golangci-lint FROM reference, found $count" >&2 - return 1 - fi - - printf '%s\n' "$refs" -} - -main() { - cd "$ROOT" - - lint_ref="$(lint_image_ref "$LINT_DOCKERFILE")" - main_ref="$(lint_image_ref "$MAIN_DOCKERFILE")" - - if [ "$lint_ref" != "$main_ref" ]; then - echo "verify-lint-image-pin: the linter image is pinned twice and" \ - "the two pins disagree:" >&2 - echo "verify-lint-image-pin: $LINT_DOCKERFILE: $lint_ref" >&2 - echo "verify-lint-image-pin: $MAIN_DOCKERFILE: $main_ref" >&2 - echo "verify-lint-image-pin: bump both FROM lines together so" \ - "script/lint and the Dockerfile lint stage keep running the" \ - "same linter" >&2 - exit 1 - fi - - echo "verify-lint-image-pin: $LINT_DOCKERFILE and $MAIN_DOCKERFILE" \ - "agree on $lint_ref" -} - -main "$@"