Re-vendor the canonical files from sneak/prompts at dd4027b (closes #95)

The shared files are the copies at sneak/prompts commit dd4027b, with this
repository's own entries kept after them. script/lint, script/test and
REPO_POLICIES.md come from its next at c55a0cb, so the lint and test
builds write no image. golangci-lint is v2.14.0 and raises no findings.
Lint and test are phases of the Dockerfile; the tests run under the race
detector as nobody, so Dockerfile.lint, script/verify-lint-image-pin and
make test-race are gone. Every docker build in script/ passes --no-cache.
Formatting runs on the host: script/bootstrap installs the pinned node and
yarn, and the prettier and markdown stages are gone. .claude/settings.json
is deleted.

Deviation: the workflow keeps fetch-depth: 0.
Deviation: .gitignore keeps the scan database patterns.
Over the cap: make test takes 82 to 100 seconds on this host.

Model: opus-5-5

Dockerfile

@@ -1,6 +1,6 @@
 # Lint phase, built alone by script/lint. The tools are invoked directly
-# rather than through `make lint` or `make fmt-check`, which run docker
-# themselves and so cannot run inside a build step.
+# rather than through `make lint`, which runs docker itself and so cannot
+# run inside a build step.
 # golangci/golangci-lint:v2.14.0, 2026-10-07
 FROM golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint
 WORKDIR /src
@@ -8,9 +8,9 @@ COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 
-# The gofmt half of `make fmt-check`; the markdown stage is its prettier
-# half. gofmt's output is assigned to a variable first so that its own
-# exit status, as when it cannot parse a file, still fails the step.
+# The gofmt half of `make fmt-check`. gofmt's output is assigned to a
+# variable first so that its own exit status, as when it cannot parse a
+# file, still fails the step.
 RUN files="$(gofmt -s -l .)" && \
     if [ -n "$files" ]; then \
         echo "gofmt: files not formatted:" >&2; echo "$files" >&2; exit 1; \
@@ -38,43 +38,19 @@ RUN go test -timeout 90s -race -cover ./... || \
     { echo "--- Rerunning with -v for details ---"; \
       go test -timeout 90s -race -v ./...; exit 1; }
 
-# Prettier stage: the prettier that formats this repository's Markdown,
-# never installed on a host. script/fmt and script/fmt-check build this
-# stage alone and run it with the repository mounted on /src. prettier
-# is installed in /tools so that the repository, mounted or copied onto
-# /src, cannot hide it.
-# node:22-alpine, 2026-02-22
-FROM node@sha256:e4bf2a82ad0a4037d28035ae71529873c069b13eb0455466ae0bc13363826e34 AS prettier
-WORKDIR /tools
-# yarn.lock pins prettier by hash, and --frozen-lockfile fails rather
-# than install anything yarn.lock does not name.
-COPY package.json yarn.lock ./
-RUN yarn install --frozen-lockfile
-ENV PATH=/tools/node_modules/.bin:$PATH
-WORKDIR /src
-
-# Markdown stage: the Markdown half of `make fmt-check`, as a gate.
-FROM prettier AS markdown
-COPY . .
-RUN prettier --check '**/*.md' --tab-width 4 --prose-wrap always
-
-# Build stage. Nothing is wanted from the lint, test and markdown stages;
-# the copies are what make BuildKit build them first, so this stage
-# cannot run unless all three passed.
+# Build stage. Nothing is wanted from either phase above; the copies are
+# what make BuildKit build them first, so this stage cannot run unless
+# lint and test passed.
 # golang:1.25-alpine, 2026-07-23
 FROM golang@sha256:56961d79ea8129efddcc0b8643fd8a5416b4e6228cfd477e3fd61deb2672c587 AS builder
 COPY --from=lint /src/go.sum /dev/null
 COPY --from=test /src/go.sum /dev/null
-COPY --from=markdown /src/go.sum /dev/null
-WORKDIR /src
-
-# script/bootstrap installs the git and make this image lacks, and ends
-# in `go mod download`.
-COPY script/ script/
-COPY go.mod go.sum ./
-RUN script/bootstrap
+RUN apk add --no-cache git make
 # A tar-stream context keeps the sender's file owners, which git refuses.
 RUN git config --system --add safe.directory /src
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
 COPY . .
 
 # The version stamped into the binary: the VERSION build argument when

README.md

@@ -738,50 +738,47 @@ entrypoints are:
 - `script/bootstrap` — install everything needed to build and develop this
   repository, idempotently, assuming nothing is present. `git`, `make`, and `go`
   come from the first of nix, apt, brew, or apk found on the host, and are
-  presence-checked only. `golangci-lint` and prettier are deliberately **not**
-  installed: they run in Docker (see `script/lint` and `script/fmt`) and never
-  from a host install, so there is no host copy to drift from the pin. A missing
-  `docker` is warned about rather than installed or treated as fatal:
-  `make build` works without it, and testing, linting, formatting and the image
-  build need it. Ends with `go mod download`.
+  presence-checked only. An installed node is used as it is; otherwise node
+  22.17.0 is installed through nvm, which comes from a release archive whose
+  sha256 the script checks. yarn 1.22.22 comes through corepack, and
+  `yarn install --frozen-lockfile` installs the prettier that `package.json` and
+  `yarn.lock` pin. `golangci-lint` is never installed: it runs in Docker (see
+  `script/lint`). `docker` is not installed either; testing, linting and the
+  image build need it. Ends with `go mod download`.
 - `script/setup` — make a fresh clone ready for development: runs
   `script/bootstrap`, then `script/install-precommit`.
 - `script/projectname` — print this project's name (`sfdupes`). Scripts that
   need the name call it, so they stay identical across repositories.
 - `script/test` — run the test suite under the race detector, with a 90-second
   timeout and coverage enabled, rerunning verbosely on failure so the logs show
-  which test failed. It builds the `Dockerfile`'s `test` phase alone, tagged
-  `sfdupes-test`. The race detector needs cgo and a C compiler, which the build
-  never uses, so the phase starts from a digest-pinned Debian `golang` image,
-  which has `gcc`. The tests run as `nobody`, because several of them make a
-  file unreadable and root reads it anyway.
+  which test failed. It builds the `Dockerfile`'s `test` phase alone and writes
+  no image. The race detector needs cgo and a C compiler, which the build never
+  uses, so the phase starts from a digest-pinned Debian `golang` image, which
+  has `gcc`. The tests run as `nobody`, because several of them make a file
+  unreadable and root reads it anyway.
 - `script/lint` — run the linter. It builds the `Dockerfile`'s `lint` phase
-  alone, tagged `sfdupes-lint`: in the digest-pinned `golangci/golangci-lint`
+  alone and writes no image: in the digest-pinned `golangci/golangci-lint`
   image, the gofmt check, `golangci-lint config verify` and `golangci-lint run`
   run as build steps, so a successful build is a clean lint. The linter is never
   run on the host, which makes a working `docker` the one prerequisite for
   linting.
 - `script/fmt` — format in place: the Go sources with `gofmt -s -w`, and every
   Markdown file with prettier, at the settings in `.prettierrc` (4-space
-  indents, prose wrapped at 80 columns). prettier is pinned by hash through
-  `package.json` and `yarn.lock` and never installed on the host: this builds
-  the `Dockerfile`'s `prettier` stage, a digest-pinned node image into which
-  `yarn install --frozen-lockfile` installs it, tagged `sfdupes-prettier`, and
-  runs that with the repository mounted, as the calling user. Needs `docker`,
-  and because of the mount, unlike `script/lint`, a local docker daemon.
-- `script/fmt-check` — the read-only counterpart of `script/fmt`, with the
-  repository mounted read-only: prints any unformatted file and exits non-zero
-  instead of writing. gofmt and prettier both run every time, and each names
-  itself when it fails. The `Dockerfile` runs the same two checks as gates: the
-  gofmt check in its `lint` phase, prettier in its `markdown` stage.
+  indents, prose wrapped at 80 columns). Both run on the host, prettier through
+  yarn at the version `yarn.lock` pins. When yarn is not on `PATH`, this loads
+  the node 22.17.0 that `script/bootstrap` installed through nvm.
+- `script/fmt-check` — the read-only counterpart of `script/fmt`: prints any
+  unformatted file and exits non-zero instead of writing. gofmt and prettier
+  both run every time, and each names itself when it fails. The `Dockerfile`'s
+  `lint` phase runs the same gofmt check.
 - `script/check` — run `script/test`, `script/lint`, and `script/fmt-check`, in
-  that order. Modifies nothing. Needs `docker`, because all three do.
+  that order. Modifies nothing. The first two need `docker`, the third what
+  `script/bootstrap` installs.
 - `script/docker` — build the Docker image, tagged with the name from
   `script/projectname`, passing the output of
   `git describe --tags --always --dirty` (or `unknown` when that is empty) as
   the `VERSION` build argument. The `Dockerfile`'s build stage depends on its
-  `lint`, `test` and `markdown` stages, so this is also the check a developer or
-  reviewer runs by hand.
+  `lint` and `test` phases, so this also runs the tests and the linter.
 - `script/cibuild` — run `script/bootstrap`, then `script/check`, then build the
   image as `script/docker` does. This is what the Gitea workflow runs on push; a
   successful run means every check passed. The tests and the linter run twice:
@@ -796,9 +793,7 @@ entrypoints are:
 Every `docker build` in `script/` passes `--no-cache`. On an unchanged tree
 Docker would serve the gate steps from its cache, and the build would pass
 having run no test and no linter. Every run therefore downloads the Go modules
-again and needs the network. `script/test` and `script/lint` send the daemon
-only a build context, so they work against a remote docker daemon; `script/fmt`
-and `script/fmt-check` mount the repository and need a local one.
+again and needs the network.
 
 ## Build
 
@@ -815,10 +810,10 @@ compile recipe:
 - `make lint` — run `golangci-lint` with the repo config and the gofmt check, in
   Docker (see `script/lint`); requires `docker`.
 - `make fmt` / `make fmt-check` — format the Go sources and the Markdown /
-  verify formatting without writing; requires `docker`, for prettier (see
-  `script/fmt`).
+  verify formatting without writing, on the host; requires `go` and what
+  `make bootstrap` installs (see `script/fmt`).
 - `make check` — `test`, `lint`, and `fmt-check`; modifies nothing. Requires
-  `docker`.
+  `docker` and what `make bootstrap` installs.
 - `make docker` — build the Docker image, which runs the gates as build stages.
 - `make hooks` — install the pre-commit hook.
 - `make clean` — remove the binary.

REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-10-04
+last_modified: 2026-10-07
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -118,8 +118,8 @@ style conventions are in separate documents:
   and nothing else:
 
     ```sh
-    docker build --no-cache --target lint -t "$(script/projectname)-lint" .
-    docker build --no-cache --target test -t "$(script/projectname)-test" .
+    docker build --no-cache --target lint --output type=cacheonly .
+    docker build --no-cache --target test --output type=cacheonly .
     ```
 
     **A stage that is not the last one in the file is built only when the final
@@ -129,10 +129,15 @@ style conventions are in separate documents:
     plain `docker build .` builds the last stage alone and exits 0 having linted
     and tested nothing.
 
-    **Every `docker build` in `script/` is tagged**, here and in
-    `script/cibuild` and `script/docker`. An untagged build leaves a dangling
-    image behind on every invocation, on every developer host and every CI
-    runner; a tagged one replaces the previous image.
+    **The gate builds write no image.** With `--output type=cacheonly` the phase
+    runs and a failing step fails the build, but the result is not exported.
+    Nothing uses those images, and writing one out is slow: a Go test phase's
+    image holds the toolchain and every compiled package. A build given neither
+    `--output` nor `-t` writes an untagged image and leaves it dangling, on
+    every developer host and every CI runner. `script/cibuild` and
+    `script/docker` build the image that ships and tag it, so each build
+    replaces the previous image; each assigns the tag on its own line before the
+    build, so `set -e` stops it where `script/projectname` fails.
 
     Inside a phase the tool is invoked directly — `golangci-lint`, `go test`,
     `eslint`, `prettier` — never through `make lint` or `script/test`, which are
@@ -278,20 +283,39 @@ style conventions are in separate documents:
       `.git` and the version still comes out empty, `dev` or `unknown`. A plain
       `docker build .` with no build arguments must succeed; a Dockerfile that
       refuses an empty build argument drops that refusal and keeps the argument.
+      A checkout whose `.git` is a file (a linked worktree, or a repository
+      checked out as a submodule) is the exception: that file points to a git
+      directory outside the build context, so the build cannot read the version
+      and a plain `docker build .` fails; pass the version with
+      `--build-arg VERSION=...`, as `script/docker` and `script/cibuild` already
+      do.
 
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` on push, and checks out the repo as its only other step.
-  That script bootstraps, runs the gate phases, and then builds the image, so a
-  successful run means every check passed; a bare `docker build .` does not
+  runs `script/cibuild` on push, and checks out the repo as its only other step,
+  with `persist-credentials: false`: `script/cibuild` needs no token, and
+  without it the checkout leaves the job's token in `.git/config` for every
+  later step. The checkout step also sets `fetch-depth: 0`, which fetches the
+  tags `git describe` needs: by default it clones shallow with no tags, and a
+  tagged repository's CI build would stamp a bare short commit id. The
+  workflow's `concurrency` block groups runs by workflow and branch
+  (`${{ github.workflow }}-${{ github.ref }}`) with `cancel-in-progress: true`,
+  so a new push cancels the older run on the same branch, queued or running, and
+  no other: runs for replaced commits do not hold up the shared runner.
+  `script/cibuild` bootstraps, runs the gate phases, and then builds the image,
+  so a successful run means every check passed; a bare `docker build .` does not
   carry the same guarantee, because its gate phases may come from the cache. The
   image build is uncached and so runs the gate phases a second time. That is the
   price of the rule above, and it is worth paying: the image that ships is built
-  from a run of its own gates rather than from a cache entry. A separate
-  workflow limited to `main` by a `branches` list under `on: push` cannot be
-  checked by review: to try a change to it, add the feature branch to that list
-  and push, then remove the branch from the list again before merging. Keep any
-  job in it that publishes behind `if: github.ref_name == 'main'`, so the run
-  from the feature branch publishes nothing.
+  from a run of its own gates rather than from a cache entry. The `check` job
+  sets `timeout-minutes: 20`, so a hung build frees the shared runner after 20
+  minutes. That allows for the three Docker builds described above (the test
+  phase, the lint phase, then the image), each held to the 5-minute Docker build
+  limit below, plus the bootstrap. A separate workflow limited to `main` by a
+  `branches` list under `on: push` cannot be checked by review: to try a change
+  to it, add the feature branch to that list and push, then remove the branch
+  from the list again before merging. Keep any job in it that publishes behind
+  `if: github.ref_name == 'main'`, so the run from the feature branch publishes
+  nothing.
 
 - Use platform-standard formatters: `black` for Python, `prettier` for
   JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -384,9 +408,12 @@ style conventions are in separate documents:
 
 - `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`),
   editor files (`.swp`, `*~`), in-repo agent scratch directories (`.claude/`),
-  language build artifacts, and `node_modules/`. Fetch the standard `.gitignore`
-  from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when
-  setting up a new repo. These patterns are written to `.gitignore`'s own
+  `node_modules/`, and the repo's own build outputs. Fetch the standard
+  `.gitignore` from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
+  a new repo. A repo's `.gitignore` is the standard file followed by the repo's
+  own entries, such as its binaries; a re-vendor replaces the standard part and
+  keeps those entries. These patterns are written to `.gitignore`'s own
   semantics, in which an unanchored pattern already matches at every depth; they
   are not a `.dockerignore` and must not be transplanted into one unmodified.
 
@@ -434,13 +461,15 @@ style conventions are in separate documents:
   byte-identically across repos:
 
     ```sh
-    # Own line: a failing command substitution inside an argument does not
-    # trip `set -e`, so the inline form degrades to an empty constant.
+    # The version and the tag each get their own line: a failing command
+    # substitution inside an argument does not trip `set -e`, so the inline
+    # form degrades to an empty constant.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
+    tag="$(script/projectname)"
     docker build --no-cache \
         --build-arg VERSION="$version" \
-        -t "$(script/projectname)" .
+        -t "$tag" .
     ```
 
     `--always` makes an untagged repo yield an abbreviated commit hash rather
@@ -452,8 +481,8 @@ style conventions are in separate documents:
     there because `ARG` is stage-scoped; passing `VERSION` to a repo whose
     Dockerfile declares no such `ARG` is ignored and costs nothing, which is why
     the scripts stay byte-identical. One consequence for CI: the standard
-    checkout action clones shallow and fetches no tags, so a repo that embeds a
-    tag-derived version must set `fetch-depth: 0` on its checkout step.
+    checkout action clones shallow and fetches no tags, so the canonical
+    `.gitea/workflows/check.yml` sets `fetch-depth: 0` on its checkout step.
 
 - **Verify `.dockerignore` by enumerating the image, not by reading the
   patterns.** Plant files at the root _and_ at least two directories deep, build
@@ -636,7 +665,11 @@ style conventions are in separate documents:
       Never edit existing migrations after release.
 
 - All repos should have an `.editorconfig` enforcing the project's indentation
-  settings.
+  settings: the standard file from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.editorconfig`, which sets
+  tabs for `Makefile` and Go files, followed by the repo's own sections, such as
+  one for another language it uses. A re-vendor replaces the standard part and
+  keeps those sections.
 
 - Avoid putting files in the repo root unless necessary. Root should contain
   only project-level config files (`README.md`, `AGENTS.md`, `Makefile`,

TODO.md

@@ -29,12 +29,16 @@
 
 # Completed Steps
 
-- re-vendor the canonical files from `sneak/prompts` commit `dd4027b`:
-  golangci-lint v2.14.0; lint and test are phases of the `Dockerfile`, and
-  `make test` runs the suite under the race detector, so `Dockerfile.lint`,
-  `script/verify-lint-image-pin` and `make test-race` are gone; every
-  `docker build` in `script/` passes `--no-cache`; `.claude/settings.json` is
-  deleted (2026-10-07, https://git.eeqj.de/sneak/sfdupes/issues/95)
+- re-vendor the canonical files from `sneak/prompts` commit `dd4027b`, with
+  `script/lint`, `script/test` and `REPO_POLICIES.md` from its `next` at
+  `c55a0cb`: golangci-lint v2.14.0; lint and test are phases of the `Dockerfile`
+  that write no image, and `make test` runs the suite under the race detector,
+  so `Dockerfile.lint`, `script/verify-lint-image-pin` and `make test-race` are
+  gone; every `docker build` in `script/` passes `--no-cache`; prettier runs on
+  the host, from the node and yarn `script/bootstrap` installs, so the
+  `prettier` and `markdown` stages are gone and the build stage installs `git`
+  and `make` itself; `.claude/settings.json` is deleted (2026-10-08,
+  https://git.eeqj.de/sneak/sfdupes/issues/95)
 
 - cut the narration from `TODO.md` Completed Steps and from the comments in
   `script/` and both Dockerfiles; §Workflow now branches from and merges to
@@ -44,12 +48,15 @@
   container, outside `make check` (2026-10-04,
   https://git.eeqj.de/sneak/sfdupes/issues/18)
 
-- a bare `docker build .` fails with a message naming `script/cibuild` and
-  `script/docker` instead of serving the gates from cache (2026-10-04,
-  https://git.eeqj.de/sneak/sfdupes/issues/39)
+- a bare `docker build .` failed, naming `script/cibuild` and `script/docker`,
+  rather than serve the gates from cache (2026-10-04,
+  https://git.eeqj.de/sneak/sfdupes/issues/39). Since
+  https://git.eeqj.de/sneak/sfdupes/issues/95 a bare build succeeds, as
+  `REPO_POLICIES.md` requires, and may serve the gates from cache; the builds in
+  `script/` pass `--no-cache`, so theirs always run
 
-- `make fmt` and `make fmt-check` run prettier over all Markdown, in Docker, and
-  CI checks it; all Markdown reformatted (2026-10-04,
+- `make fmt` and `make fmt-check` run prettier over all Markdown, and CI checks
+  it; all Markdown reformatted (2026-10-04,
   https://git.eeqj.de/sneak/sfdupes/issues/19)
 
 - `script/lint` writes no image, so a run no longer leaves an untagged one

script/bootstrap

@@ -1,13 +1,22 @@
 #!/bin/sh
 # script/bootstrap: install all dependencies needed to build and develop
-# this repo. Idempotent; assumes nothing is present (not git, make, or
-# go). Base tooling comes from nix, apt, brew, or apk (detected in that
-# order). golangci-lint and prettier are never installed: they run via
-# docker only (script/lint, script/fmt, script/fmt-check).
+# this repo. Idempotent: every install is guarded by a check so already
+# installed tools are skipped. Base tooling comes from nix, apt, brew,
+# or apk (detected in that order); assumes nothing is present. Node is
+# used directly if installed; otherwise it is installed at a pinned
+# version via nvm (installing nvm itself first, from a hash-verified
+# release archive, never curl | sh).
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# Pinned versions, 2026-07-06
+NODE_VERSION="22.17.0"
+NVM_VERSION="0.40.3"
+# sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
+NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
+YARN_VERSION="1.22.22"
+
 PKGMGR=""
 SUDO=""
 APT_UPDATED=""
@@ -40,6 +49,7 @@ pkg_install() {
     case "$PKGMGR" in
         nix) nix-env -iA "nixpkgs.$1" ;;
         apt)
+            # Package lists may be empty (fresh images); refresh once per run.
             if [ -z "$APT_UPDATED" ]; then
                 $SUDO env DEBIAN_FRONTEND=noninteractive apt-get update
                 APT_UPDATED=1
@@ -55,24 +65,82 @@ missing() {
     ! command -v "$1" >/dev/null 2>&1
 }
 
+# verify_sha256 <file> <expected-hash>
+verify_sha256() {
+    if command -v sha256sum >/dev/null 2>&1; then
+        actual="$(sha256sum "$1" | cut -d' ' -f1)"
+    else
+        actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
+    fi
+    if [ "$actual" != "$2" ]; then
+        echo "bootstrap: sha256 mismatch for $1" >&2
+        echo "  expected: $2" >&2
+        echo "  actual:   $actual" >&2
+        exit 1
+    fi
+}
+
+# nvm is a bash script; run a command in a bash with nvm loaded
+nvm_sh() {
+    bash -c ". \"\$HOME/.nvm/nvm.sh\" && $*"
+}
+
+ensure_nvm() {
+    [ -s "$HOME/.nvm/nvm.sh" ] && return 0
+    # nvm prerequisites; nvm itself requires bash
+    if missing bash; then pkg_install bash bash bash bash; fi
+    if missing curl; then pkg_install curl curl curl curl; fi
+    if missing git; then pkg_install git git git git; fi
+    tmp="$(mktemp -d)"
+    curl -fsSL -o "$tmp/nvm.tar.gz" \
+        "https://github.com/nvm-sh/nvm/archive/refs/tags/v${NVM_VERSION}.tar.gz"
+    verify_sha256 "$tmp/nvm.tar.gz" "$NVM_SHA256"
+    mkdir -p "$HOME/.nvm"
+    tar -xzf "$tmp/nvm.tar.gz" -C "$HOME/.nvm" --strip-components=1
+    rm -rf "$tmp"
+}
+
+ensure_node() {
+    if ! missing node; then return 0; fi
+    ensure_nvm
+    nvm_sh "nvm install $NODE_VERSION"
+}
+
+ensure_yarn() {
+    if ! missing yarn; then return 0; fi
+    if ! missing corepack; then
+        corepack enable
+        corepack prepare "yarn@$YARN_VERSION" --activate
+    elif [ -s "$HOME/.nvm/nvm.sh" ]; then
+        nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
+            corepack prepare yarn@$YARN_VERSION --activate"
+    else
+        npm install -g "yarn@$YARN_VERSION"
+    fi
+}
+
+install_js_deps() {
+    if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
+        nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
+            yarn install --frozen-lockfile"
+    else
+        yarn install --frozen-lockfile
+    fi
+}
+
 main() {
     cd "$ROOT"
 
-    # Deliberately unpinned, so presence is the whole check: go.mod
-    # governs the Go version, and reproducible builds run in the
-    # digest-pinned Docker images.
-    if missing git; then pkg_install git git git git; fi
     if missing make; then pkg_install gnumake make make make; fi
+    if missing git; then pkg_install git git git git; fi
+    # Go builds the binary and runs gofmt. Presence is the whole check:
+    # go.mod names the Go version, and the tests and the linter run in
+    # digest-pinned images.
     if missing go; then pkg_install go golang go go; fi
 
-    # Warn, do not fail: only the targets named below, and the
-    # pre-commit hook, need docker.
-    if missing docker; then
-        echo "bootstrap: WARNING: docker not found; make test, make lint," >&2
-        echo "bootstrap: make fmt, make fmt-check, make check and" >&2
-        echo "bootstrap: make docker require it." >&2
-    fi
-
+    ensure_node
+    ensure_yarn
+    install_js_deps
     go mod download
 
     echo "bootstrap complete"

script/fmt

@@ -1,23 +1,32 @@
 #!/bin/sh
-# script/fmt: format all files (writes): the Go sources with gofmt, the
-# Markdown with prettier. prettier is never installed on the host: it
-# runs from the Dockerfile's prettier stage with the repository mounted,
-# as the calling user so the files it rewrites keep their owner. The
-# build passes --no-cache, as every docker build in script/ does. The tag
-# makes each build replace the previous image instead of leaving another
-# one behind.
+# script/fmt: format all files (writes).
 set -eu
 
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+# Must match the pin in script/bootstrap.
+NODE_VERSION="22.17.0"
+
+# script/bootstrap installs node and yarn under nvm and leaves neither
+# on the PATH of the shell that called it, so resolve the pinned
+# toolchain here the way bootstrap's own install step does. nvm is a
+# bash script, hence the subshell.
+run_yarn() {
+    if command -v yarn >/dev/null 2>&1; then
+        exec yarn "$@"
+    fi
+    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
+        echo "fmt: no yarn; run script/bootstrap first" >&2
+        exit 1
+    fi
+    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
+        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
+}
 
 main() {
     cd "$ROOT"
     gofmt -s -w .
-    image="$("$SCRIPT_DIR/projectname")-prettier"
-    docker build -q --no-cache --target prettier -t "$image" . >/dev/null
-    docker run --rm --user "$(id -u):$(id -g)" -v "$ROOT:/src" "$image" \
-        prettier --write '**/*.md' --tab-width 4 --prose-wrap always
+    run_yarn run prettier --write '**/*.md' --tab-width 4 --prose-wrap always
 }
 
 main "$@"

script/fmt-check

@@ -1,19 +1,35 @@
 #!/bin/sh
-# script/fmt-check: check formatting (read-only). Same scope as
-# script/fmt, but fails instead of writing. gofmt and prettier both run
-# every time and each reports its own failure, so the output says which
-# one failed.
+# script/fmt-check: check formatting (read-only).
 set -eu
 
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+# Must match the pin in script/bootstrap.
+NODE_VERSION="22.17.0"
+
+# script/bootstrap installs node and yarn under nvm and leaves neither
+# on the PATH of the shell that called it, so resolve the pinned
+# toolchain here the way bootstrap's own install step does. nvm is a
+# bash script, hence the subshell.
+run_yarn() {
+    if command -v yarn >/dev/null 2>&1; then
+        exec yarn "$@"
+    fi
+    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
+        echo "fmt-check: no yarn; run script/bootstrap first" >&2
+        exit 1
+    fi
+    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
+        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
+}
 
 main() {
     cd "$ROOT"
     status=0
 
-    # Under set -e a bare assignment would end the script when gofmt
-    # fails (a Go file it cannot parse), and prettier would never run.
+    # gofmt and prettier both run every time, so the output names each
+    # one that fails. Under set -e a bare assignment would end the
+    # script when gofmt fails (a Go file it cannot parse).
     if ! files="$(gofmt -s -l .)"; then
         echo "gofmt: failed; see its errors above" >&2
         status=1
@@ -24,14 +40,9 @@ main() {
         status=1
     fi
 
-    # Same image as script/fmt; see there.
-    image="$("$SCRIPT_DIR/projectname")-prettier"
-    docker build -q --no-cache --target prettier -t "$image" . >/dev/null
-    if ! docker run --rm -v "$ROOT:/src:ro" "$image" \
-        prettier --check '**/*.md' --tab-width 4 --prose-wrap always; then
-        echo "prettier: Markdown not formatted; run make fmt" >&2
+    # run_yarn ends in exec; the subshell returns here afterwards.
+    (run_yarn run prettier --check '**/*.md' --tab-width 4 --prose-wrap always) ||
         status=1
-    fi
 
     exit "$status"
 }

script/lint

@@ -6,8 +6,8 @@
 #
 # The phase is not the last stage in the file, so it is built only when
 # --target names it. --no-cache because a cached lint layer is a lint
-# that did not run. The tag makes each build replace the previous image
-# instead of leaving a dangling one behind.
+# that did not run. --output type=cacheonly writes no image, since
+# nothing uses one.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -17,7 +17,7 @@ main() {
     cd "$ROOT"
     docker build --no-cache \
         --target lint \
-        -t "$("$SCRIPT_DIR/projectname")-lint" .
+        --output type=cacheonly .
 }
 
 main "$@"

script/test

@@ -2,8 +2,8 @@
 # script/test: run the test suite. Testing is a phase of the Dockerfile
 # and this builds that phase alone, on the same terms as script/lint:
 # --target because a phase that is not the last stage is built only when
-# named, --no-cache because a cached test layer is a test that did not
-# run, and a tag so each build replaces the previous image.
+# named, and --no-cache because a cached test layer is a test that did
+# not run. --output type=cacheonly writes no image, since nothing uses one.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -13,7 +13,7 @@ main() {
     cd "$ROOT"
     docker build --no-cache \
         --target test \
-        -t "$("$SCRIPT_DIR/projectname")-test" .
+        --output type=cacheonly .
 }
 
 main "$@"