Re-vendor the canonical files from sneak/prompts at dd4027b (closes #95)
check / check (push) Waiting to run
check / check (push) Waiting to run
The shared files are the copies at sneak/prompts commit dd4027b, with this repository's own entries kept after them. golangci-lint is v2.14.0 and raises no findings. Lint and test are phases of the Dockerfile, built by script/lint and script/test; the tests run under the race detector as nobody, so Dockerfile.lint, script/verify-lint-image-pin and make test-race are gone. Every docker build in script/ passes --no-cache in place of the old cache-busting build argument, and script/cibuild runs script/bootstrap and script/check before the image build. .claude/settings.json is deleted. Deviation: the workflow keeps fetch-depth: 0 for the tag-derived version. Deviation: .gitignore keeps the scan database patterns. Deviation: prettier still runs in Docker, not on the host. Over the cap: make test takes about 60 seconds on this host. Model: opus-5-5
This commit is contained in:
clawbot
+3
-3
@@ -68,9 +68,9 @@ main() {
|
||||
# Warn, do not fail: only the targets named below, and the
|
||||
# pre-commit hook, need docker.
|
||||
if missing docker; then
|
||||
echo "bootstrap: WARNING: docker not found; make lint, make fmt," >&2
|
||||
echo "bootstrap: make fmt-check, make check, make docker and" >&2
|
||||
echo "bootstrap: make test-race require it." >&2
|
||||
echo "bootstrap: WARNING: docker not found; make test, make lint," >&2
|
||||
echo "bootstrap: make fmt, make fmt-check, make check and" >&2
|
||||
echo "bootstrap: make docker require it." >&2
|
||||
fi
|
||||
|
||||
go mod download
|
||||
|
||||
+19
-10
@@ -1,19 +1,28 @@
|
||||
#!/bin/sh
|
||||
# script/cibuild: run the CI build. The Gitea workflow runs this on
|
||||
# push. The Dockerfile runs every gate make check runs, as build steps,
|
||||
# so a successful build means the repo is green.
|
||||
#
|
||||
# Without a fresh CHECK_EPOCH, a rebuild of an unchanged checkout serves
|
||||
# the gate layers from cache and passes having run none of them. The
|
||||
# process id goes in with the epoch so two runs started in the same
|
||||
# second still differ.
|
||||
# script/cibuild: run the CI build. It bootstraps first: a CI runner
|
||||
# checks out and runs this and nothing else, and script/fmt-check runs
|
||||
# the formatter on the host, which a pristine checkout cannot do.
|
||||
# --no-cache for the same reason as script/docker: the gate phases the
|
||||
# final stage depends on are RUN steps, and a cached one is a check that
|
||||
# did not run.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
docker build --build-arg CHECK_EPOCH="$(date +%s)-$$" .
|
||||
"$SCRIPT_DIR/bootstrap"
|
||||
"$SCRIPT_DIR/check"
|
||||
# Own line: a failing command substitution inside an argument does
|
||||
# not trip `set -e`, so the inline form degrades silently to an
|
||||
# empty constant. The VERSION build argument takes precedence over
|
||||
# the version a build stage derives from the .git in the context.
|
||||
version="$(git describe --tags --always --dirty 2>/dev/null || true)"
|
||||
[ -n "$version" ] || version="unknown"
|
||||
docker build --no-cache \
|
||||
--build-arg VERSION="$version" \
|
||||
-t "$("$SCRIPT_DIR/projectname")" .
|
||||
}
|
||||
|
||||
main "$@"
|
||||
|
||||
+12
-8
@@ -1,9 +1,8 @@
|
||||
#!/bin/sh
|
||||
# script/docker: build the Docker image tagged with the project name.
|
||||
# The tag comes from script/projectname. CHECK_EPOCH is passed for the
|
||||
# same reason script/cibuild passes it: without a fresh value an
|
||||
# unchanged tree is served from cache and this exits 0 having run no
|
||||
# gate.
|
||||
# Identical in all repos; the tag comes from script/projectname.
|
||||
# --no-cache because the gate phases the final stage depends on are RUN
|
||||
# steps, and a cached one is a check that did not run.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
@@ -11,10 +10,15 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
docker build \
|
||||
--build-arg CHECK_EPOCH="$(date +%s)-$$" \
|
||||
-t "$("$SCRIPT_DIR/projectname")" \
|
||||
.
|
||||
# Own line: a failing command substitution inside an argument does
|
||||
# not trip `set -e`, so the inline form degrades silently to an
|
||||
# empty constant. The VERSION build argument takes precedence over
|
||||
# the version a build stage derives from the .git in the context.
|
||||
version="$(git describe --tags --always --dirty 2>/dev/null || true)"
|
||||
[ -n "$version" ] || version="unknown"
|
||||
docker build --no-cache \
|
||||
--build-arg VERSION="$version" \
|
||||
-t "$("$SCRIPT_DIR/projectname")" .
|
||||
}
|
||||
|
||||
main "$@"
|
||||
|
||||
+3
-2
@@ -2,7 +2,8 @@
|
||||
# script/fmt: format all files (writes): the Go sources with gofmt, the
|
||||
# Markdown with prettier. prettier is never installed on the host: it
|
||||
# runs from the Dockerfile's prettier stage with the repository mounted,
|
||||
# as the calling user so the files it rewrites keep their owner. The tag
|
||||
# as the calling user so the files it rewrites keep their owner. The
|
||||
# build passes --no-cache, as every docker build in script/ does. The tag
|
||||
# makes each build replace the previous image instead of leaving another
|
||||
# one behind.
|
||||
set -eu
|
||||
@@ -14,7 +15,7 @@ main() {
|
||||
cd "$ROOT"
|
||||
gofmt -s -w .
|
||||
image="$("$SCRIPT_DIR/projectname")-prettier"
|
||||
docker build -q --target prettier -t "$image" . >/dev/null
|
||||
docker build -q --no-cache --target prettier -t "$image" . >/dev/null
|
||||
docker run --rm --user "$(id -u):$(id -g)" -v "$ROOT:/src" "$image" \
|
||||
prettier --write '**/*.md' --tab-width 4 --prose-wrap always
|
||||
}
|
||||
|
||||
+1
-1
@@ -26,7 +26,7 @@ main() {
|
||||
|
||||
# Same image as script/fmt; see there.
|
||||
image="$("$SCRIPT_DIR/projectname")-prettier"
|
||||
docker build -q --target prettier -t "$image" . >/dev/null
|
||||
docker build -q --no-cache --target prettier -t "$image" . >/dev/null
|
||||
if ! docker run --rm -v "$ROOT:/src:ro" "$image" \
|
||||
prettier --check '**/*.md' --tab-width 4 --prose-wrap always; then
|
||||
echo "prettier: Markdown not formatted; run make fmt" >&2
|
||||
|
||||
+13
-18
@@ -1,28 +1,23 @@
|
||||
#!/bin/sh
|
||||
# script/lint: run the linter. golangci-lint is never installed on a
|
||||
# host: this builds Dockerfile.lint, which copies the repo into the
|
||||
# digest-pinned golangci-lint image and lints as a build step, so a
|
||||
# successful build is a clean lint. A cold cache needs the network to
|
||||
# pull the image and for `go mod download`; once warm this runs offline
|
||||
# until go.mod or go.sum changes.
|
||||
# script/lint: run the linter. Linting is a phase of the Dockerfile and
|
||||
# this builds that phase alone; the linter is never installed or run on
|
||||
# a developer host, where a shared result cache and a host-global lock
|
||||
# make its answer untrustworthy.
|
||||
#
|
||||
# Without a fresh CHECK_EPOCH docker serves the gate layers from cache
|
||||
# on an unchanged tree and this exits 0 having run no linter. The PID is
|
||||
# in the value because two lint runs land inside the same second easily.
|
||||
#
|
||||
# The image is never used, so --output=type=cacheonly writes none;
|
||||
# without it every run leaves an untagged image behind.
|
||||
# The phase is not the last stage in the file, so it is built only when
|
||||
# --target names it. --no-cache because a cached lint layer is a lint
|
||||
# that did not run. The tag makes each build replace the previous image
|
||||
# instead of leaving a dangling one behind.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
docker build \
|
||||
--build-arg CHECK_EPOCH="$(date +%s)-$$" \
|
||||
--output=type=cacheonly \
|
||||
-f Dockerfile.lint \
|
||||
.
|
||||
docker build --no-cache \
|
||||
--target lint \
|
||||
-t "$("$SCRIPT_DIR/projectname")-lint" .
|
||||
}
|
||||
|
||||
main "$@"
|
||||
|
||||
+10
-8
@@ -1,17 +1,19 @@
|
||||
#!/bin/sh
|
||||
# script/test: run the test suite. Reruns verbosely on failure so CI
|
||||
# logs show which test failed.
|
||||
# script/test: run the test suite. Testing is a phase of the Dockerfile
|
||||
# and this builds that phase alone, on the same terms as script/lint:
|
||||
# --target because a phase that is not the last stage is built only when
|
||||
# named, --no-cache because a cached test layer is a test that did not
|
||||
# run, and a tag so each build replaces the previous image.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
go test -timeout 30s -cover ./... || {
|
||||
echo "--- Rerunning with -v for details ---"
|
||||
go test -timeout 30s -v ./...
|
||||
exit 1
|
||||
}
|
||||
docker build --no-cache \
|
||||
--target test \
|
||||
-t "$("$SCRIPT_DIR/projectname")-test" .
|
||||
}
|
||||
|
||||
main "$@"
|
||||
|
||||
@@ -1,40 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/test-race: run the test suite under the race detector. Not part
|
||||
# of script/check.
|
||||
#
|
||||
# The race detector needs cgo and a C compiler, which the host build
|
||||
# never uses, so the tests run in a golang image that has gcc. The
|
||||
# checkout is mounted read-only, so the docker daemon must be local. The
|
||||
# container starts with empty caches every time: each run downloads the
|
||||
# dependencies and compiles them with the detector, which needs the
|
||||
# network and takes minutes.
|
||||
#
|
||||
# The tests run as the calling user, never as root: several of them make
|
||||
# a file unreadable and expect reading it to fail, and root reads it
|
||||
# anyway. When the caller is root they run as nobody, and then the
|
||||
# checkout must be readable by other users. Neither user has a home
|
||||
# directory in the image, so HOME is /tmp, where Go puts its build cache.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
# golang:1.25-trixie, 2026-10-04. Debian rather than the Alpine image the
|
||||
# Dockerfile builds with, because this one includes gcc.
|
||||
IMAGE="golang@sha256:2c4c60ef415fbfa5e90300722293bef36c5e63fae17570ce18f580af933dbd73"
|
||||
|
||||
main() {
|
||||
user="$(id -u):$(id -g)"
|
||||
if [ "$(id -u)" -eq 0 ]; then
|
||||
user=65534:65534
|
||||
fi
|
||||
docker run --rm \
|
||||
--user "$user" \
|
||||
--env HOME=/tmp \
|
||||
--env CGO_ENABLED=1 \
|
||||
--volume "$ROOT:/src:ro" \
|
||||
--workdir /src \
|
||||
"$IMAGE" \
|
||||
go test -race -timeout 60s ./...
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,77 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/verify-lint-image-pin: fail unless the golangci-lint image
|
||||
# referenced by Dockerfile.lint and the one referenced by the main
|
||||
# Dockerfile's lint stage are the same image at the same digest. Our own
|
||||
# extension to scripts-to-rule-them-all, not one of its entrypoints; run
|
||||
# as a gate in both files. Nothing else keeps the two pins in sync, and
|
||||
# a bump applied to one alone would lint the same tree against different
|
||||
# rulesets, both green.
|
||||
#
|
||||
# Do not hardcode the expected digest here: that is a third copy to keep
|
||||
# in sync.
|
||||
#
|
||||
# A reference that cannot be read is a hard failure, not a skip: two
|
||||
# empty strings compare equal.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
LINT_DOCKERFILE="Dockerfile.lint"
|
||||
MAIN_DOCKERFILE="Dockerfile"
|
||||
|
||||
# Echo the single golangci-lint image reference in the named Dockerfile.
|
||||
# Scans every argument of every FROM instruction rather than assuming a
|
||||
# field position, so `FROM --platform=... img AS stage` reads correctly.
|
||||
# Exits non-zero, with a diagnosis, unless there is exactly one.
|
||||
lint_image_ref() {
|
||||
file="$1"
|
||||
|
||||
if [ ! -f "$file" ]; then
|
||||
echo "verify-lint-image-pin: $file: not found" >&2
|
||||
return 1
|
||||
fi
|
||||
|
||||
refs="$(
|
||||
awk '
|
||||
toupper($1) == "FROM" {
|
||||
for (i = 2; i <= NF; i++) {
|
||||
if ($i ~ /^golangci\/golangci-lint[:@]/) {
|
||||
print $i
|
||||
}
|
||||
}
|
||||
}
|
||||
' "$file"
|
||||
)"
|
||||
|
||||
count="$(printf '%s' "$refs" | grep -c . || true)"
|
||||
if [ "$count" -ne 1 ]; then
|
||||
echo "verify-lint-image-pin: $file: expected exactly one" \
|
||||
"golangci/golangci-lint FROM reference, found $count" >&2
|
||||
return 1
|
||||
fi
|
||||
|
||||
printf '%s\n' "$refs"
|
||||
}
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
lint_ref="$(lint_image_ref "$LINT_DOCKERFILE")"
|
||||
main_ref="$(lint_image_ref "$MAIN_DOCKERFILE")"
|
||||
|
||||
if [ "$lint_ref" != "$main_ref" ]; then
|
||||
echo "verify-lint-image-pin: the linter image is pinned twice and" \
|
||||
"the two pins disagree:" >&2
|
||||
echo "verify-lint-image-pin: $LINT_DOCKERFILE: $lint_ref" >&2
|
||||
echo "verify-lint-image-pin: $MAIN_DOCKERFILE: $main_ref" >&2
|
||||
echo "verify-lint-image-pin: bump both FROM lines together so" \
|
||||
"script/lint and the Dockerfile lint stage keep running the" \
|
||||
"same linter" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "verify-lint-image-pin: $LINT_DOCKERFILE and $MAIN_DOCKERFILE" \
|
||||
"agree on $lint_ref"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
Reference in New Issue
Block a user