Adopt the standard STRTA scaffold (Makefile/scripts diverge from the org standard) #1

New Issue

2026-07-25T13:16:16+02:00

clawbot commented

2026-07-25 13:16:16 +02:00

The Makefile diverges from our standard scripts-to-rule-them-all (STRTA) scaffold. Under STRTA, the Makefile is a set of thin shims that delegate to script/* POSIX-sh entrypoints, and CI runs script/cibuild. The living reference is the netwatch repo (Makefile + script/ + .gitea/workflows/check.yml); mirror it exactly.

Current state (nonconformance)

Makefile targets are inline recipes rather than @script/* shims: test, lint, fmt, fmt-check, check, docker, and hooks all contain inline commands.
Missing standard targets: bootstrap, setup.
No script/ directory.
.gitea/workflows/check.yml exists but runs docker build . directly instead of script/cibuild.

Definition of done

Makefile has a .PHONY declaration listing at least the nine standard targets: bootstrap, setup, test, lint, fmt, fmt-check, check, docker, hooks.
Each of those nine standard targets is a thin shim whose recipe is exactly @script/NAME (test calls @script/test, hooks calls @script/install-precommit, etc.). Repo-specific extra targets are allowed but must not replace the standard shims.
A script/ directory holds executable POSIX-sh entrypoints (#!/bin/sh, set -e) for bootstrap, setup, test, lint, fmt, fmt-check, check, docker, install-precommit, plus cibuild. The real logic currently inline in the Makefile moves into these scripts.
script/check runs the repo's full local verification (fmt-check + lint + test); script/cibuild is the CI entrypoint (typically docker build .), and the Dockerfile build runs make check so the image build fails on any check failure.
.gitea/workflows/check.yml invokes script/cibuild rather than a bare docker build ..
make check passes locally and docker build . succeeds (green) before the change lands.

The finishing commit's title must end with (closes #N) referencing this issue.

The `Makefile` diverges from our standard scripts-to-rule-them-all (STRTA) scaffold. Under STRTA, the `Makefile` is a set of thin shims that delegate to `script/*` POSIX-`sh` entrypoints, and CI runs `script/cibuild`. The living reference is the `netwatch` repo (`Makefile` + `script/` + `.gitea/workflows/check.yml`); mirror it exactly. ## Current state (nonconformance) - `Makefile` targets are inline recipes rather than `@script/*` shims: `test`, `lint`, `fmt`, `fmt-check`, `check`, `docker`, and `hooks` all contain inline commands. - Missing standard targets: `bootstrap`, `setup`. - No `script/` directory. - `.gitea/workflows/check.yml` exists but runs `docker build .` directly instead of `script/cibuild`. ## Definition of done 1. `Makefile` has a `.PHONY` declaration listing at least the nine standard targets: `bootstrap`, `setup`, `test`, `lint`, `fmt`, `fmt-check`, `check`, `docker`, `hooks`. 2. Each of those nine standard targets is a thin shim whose recipe is exactly `@script/NAME` (`test` calls `@script/test`, `hooks` calls `@script/install-precommit`, etc.). Repo-specific extra targets are allowed but must not replace the standard shims. 3. A `script/` directory holds executable POSIX-`sh` entrypoints (`#!/bin/sh`, `set -e`) for `bootstrap`, `setup`, `test`, `lint`, `fmt`, `fmt-check`, `check`, `docker`, `install-precommit`, plus `cibuild`. The real logic currently inline in the `Makefile` moves into these scripts. 4. `script/check` runs the repo's full local verification (`fmt-check` + `lint` + `test`); `script/cibuild` is the CI entrypoint (typically `docker build .`), and the `Dockerfile` build runs `make check` so the image build fails on any check failure. 5. `.gitea/workflows/check.yml` invokes `script/cibuild` rather than a bare `docker build .`. 6. `make check` passes locally and `docker build .` succeeds (green) before the change lands. The finishing commit's title must end with ` (closes #N)` referencing this issue.

sneak referenced this issue from a commit

2026-07-26 18:23:43 +02:00

Add scripts-to-rule-them-all scaffold (refs #1)

clawbot commented

2026-07-26 18:29:22 +02:00

Landed on main as 3abeacf and independently reviewed (a reviewer separate from the author) — verdict PASS. The reviewer re-ran make check and docker build . (both green), confirmed the image builds and runs make check as the non-root builder user (uid 1000), and verified TestScanHardlinkRunFailsTogether is genuinely exercised as non-root (open ...: permission denied) rather than weakened — scan_test.go is untouched. All nine standard targets are pure @script/* shims, checks are honest, scope is limited to the scaffold, and there are no AI/trailer hygiene issues. Definition of done met; closing.

Landed on `main` as `3abeacf` and independently reviewed (a reviewer separate from the author) — verdict PASS. The reviewer re-ran `make check` and `docker build .` (both green), confirmed the image builds and runs `make check` as the non-root `builder` user (uid 1000), and verified `TestScanHardlinkRunFailsTogether` is genuinely exercised as non-root (`open ...: permission denied`) rather than weakened — `scan_test.go` is untouched. All nine standard targets are pure `@script/*` shims, checks are honest, scope is limited to the scaffold, and there are no AI/trailer hygiene issues. Definition of done met; closing.

clawbot closed this issue

2026-07-26 18:29:23 +02:00

clawbot referenced this issue

2026-08-09 03:48:04 +02:00

Update golangci-lint to v2.12.2 with canonical config #2

clawbot referenced this issue

2026-08-09 03:57:56 +02:00

Update golangci-lint to v2.12.2 with canonical config #2

clawbot referenced this issue

2026-08-09 03:59:43 +02:00

TODO.md Next Step is stale: the STRTA conversion it names already landed #27

clawbot referenced this issue