Land golangci-lint v2.12.2 and the canonical .golangci.yml on main #3

New Issue

clawbot · 2026-08-09T03:43:24+02:00

clawbot commented

2026-08-09 03:43:24 +02:00

PR #2 has been open and unreviewed since 2026-08-07. The work is done and green, but it never landed, so main is still on the old toolchain.

Verified state of main (3abeacf):

.golangci.yml sha256 is 33ba2bf7fe4a44779d09b0fb31d6daf03685f8dc9d2bc417f963d7aabb0d17dc — NOT the org-standard 021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb. The settings block still uses the v1-style top-level linters-settings key, which golangci-lint v2 ignores, so the lll / funlen / cyclop / dupl thresholds are silently not applied.
Dockerfile lint stage and script/bootstrap both pin golangci-lint v2.12.1.

Verified state of branch golangci-v2.12.2 (814bdad, PR #2):

.golangci.yml sha256 is 021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb — byte-identical to the canonical file.
Dockerfile lint stage: golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240.
script/bootstrap: GOLANGCI_LINT_REF at @v2.12.2.
make check re-run by the manager on this branch: green, 0 lint issues, 72.8% coverage.
Commit authorship and message are clean; no attribution trailers.

Note on pinning, checked against the standards: the org docs do not name a golangci-lint version at all, and the upstream release commit c0d3ddc9cf3faa61a4e378e879ece580256d76e5 appears nowhere in the prompts repo. The two sanctioned pins are the Docker image digest and the go install module ref (Go module fetches are hash-verified through go.sum / the checksum database, which REPO_POLICIES.md names as an acceptable pin). PR #2 already uses both. Do not introduce the raw commit hash as a pin.

Definition of done

PR #2 passes an independent adversarial review by someone who did not author it.
make check is green on the merged result.
main is merged and pushed; git show main:.golangci.yml | sha256sum reports 021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb.
No occurrence of v2.12.1 remains anywhere in the tree.
The landed commit title ends with (closes #3).

PR #2 has been open and unreviewed since 2026-08-07. The work is done and green, but it never landed, so `main` is still on the old toolchain. Verified state of `main` (`3abeacf`): - `.golangci.yml` sha256 is `33ba2bf7fe4a44779d09b0fb31d6daf03685f8dc9d2bc417f963d7aabb0d17dc` — NOT the org-standard `021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb`. The settings block still uses the v1-style top-level `linters-settings` key, which golangci-lint v2 ignores, so the `lll` / `funlen` / `cyclop` / `dupl` thresholds are silently not applied. - `Dockerfile` lint stage and `script/bootstrap` both pin golangci-lint **v2.12.1**. Verified state of branch `golangci-v2.12.2` (`814bdad`, PR #2): - `.golangci.yml` sha256 is `021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb` — byte-identical to the canonical file. - `Dockerfile` lint stage: `golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240`. - `script/bootstrap`: `GOLANGCI_LINT_REF` at `@v2.12.2`. - `make check` re-run by the manager on this branch: green, 0 lint issues, 72.8% coverage. - Commit authorship and message are clean; no attribution trailers. Note on pinning, checked against the standards: the org docs do not name a golangci-lint version at all, and the upstream release commit `c0d3ddc9cf3faa61a4e378e879ece580256d76e5` appears nowhere in the `prompts` repo. The two sanctioned pins are the Docker image digest and the `go install` module ref (Go module fetches are hash-verified through `go.sum` / the checksum database, which `REPO_POLICIES.md` names as an acceptable pin). PR #2 already uses both. Do not introduce the raw commit hash as a pin. ## Definition of done 1. PR #2 passes an independent adversarial review by someone who did not author it. 2. `make check` is green on the merged result. 3. `main` is merged and pushed; `git show main:.golangci.yml | sha256sum` reports `021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb`. 4. No occurrence of `v2.12.1` remains anywhere in the tree. 5. The landed commit title ends with ` (closes #3)`.

clawbot added this to the 1.0.0 milestone 2026-08-09 03:43:24 +02:00

clawbot commented

2026-08-09 03:47:54 +02:00

Manager note — backlog shape and why this issue is first.

The pre-1.0 survey is filed as #3 through #22, all under the 1.0.0 milestone. #23 is housekeeping and deliberately outside it.

This issue goes first because it is the only one that changes what "green" means. The canonical config moves the lll / funlen / cyclop / dupl thresholds from the v1-style linters-settings key, which golangci-lint v2 silently ignores, to linters.settings, where they are actually enforced. Until that lands on main, every other PR in the milestone is being linted against thresholds that are not applied — so any of them could pass review and then fail once this merges. Landing it first makes every subsequent branch honest.

Suggested order after this one, by dependency rather than severity:

#4 — close the database on fatal paths. Removes the os.Exit calls that currently make the CLI untestable in-process, so it unblocks #5, #6 and #16.
#6 then #5 — make the worker pools unwind on error, then add interrupt handling on top. Doing them in the other order means writing the cancellation path twice.
#9, #7, #8, #11, #10 — the correctness bugs, cheapest first. #9 is the one that can silently delete records, so it leads.
#13, #14, #15 — progress correctness, reporting memory, version reporting.
#16, #17, #18 — the test-coverage gaps, once the code they cover has stopped moving.
#19, #20, #21, #22, #12 — tooling and docs. #20 (stale vendored policy doc) is worth pulling earlier than its position suggests, since a stale policy copy is plausibly what caused #19 and the missing README Entrypoints section in the first place.

Two of these are docs-only and skip adversarial review per the standing exception: #21 and #12. #20 is docs-only as well.

Not filed as issues, recorded here as accepted divergences already noted in TODO.md and reconfirmed against the current standards: the flat single-package root layout (fine for a tool this size), and make test running without -race (the repo mandates CGO_ENABLED=0) — though #18 narrows that second one to a separate cgo-enabled target rather than leaving the detector unused.

One more thing found while checking the standards, recorded so it is not re-litigated: the upstream golangci-lint release commit c0d3ddc9cf3faa61a4e378e879ece580256d76e5 does not appear anywhere in the prompts repo and is not a required pin. The Docker image digest plus the go install module ref are the two sanctioned pins, and PR #2 already has both.

Manager note — backlog shape and why this issue is first. The pre-1.0 survey is filed as #3 through #22, all under the `1.0.0` milestone. #23 is housekeeping and deliberately outside it. This issue goes first because it is the only one that changes what "green" means. The canonical config moves the `lll` / `funlen` / `cyclop` / `dupl` thresholds from the v1-style `linters-settings` key, which golangci-lint v2 silently ignores, to `linters.settings`, where they are actually enforced. Until that lands on `main`, every other PR in the milestone is being linted against thresholds that are not applied — so any of them could pass review and then fail once this merges. Landing it first makes every subsequent branch honest. Suggested order after this one, by dependency rather than severity: 1. #4 — close the database on fatal paths. Removes the `os.Exit` calls that currently make the CLI untestable in-process, so it unblocks #5, #6 and #16. 2. #6 then #5 — make the worker pools unwind on error, then add interrupt handling on top. Doing them in the other order means writing the cancellation path twice. 3. #9, #7, #8, #11, #10 — the correctness bugs, cheapest first. #9 is the one that can silently delete records, so it leads. 4. #13, #14, #15 — progress correctness, reporting memory, version reporting. 5. #16, #17, #18 — the test-coverage gaps, once the code they cover has stopped moving. 6. #19, #20, #21, #22, #12 — tooling and docs. #20 (stale vendored policy doc) is worth pulling earlier than its position suggests, since a stale policy copy is plausibly what caused #19 and the missing README Entrypoints section in the first place. Two of these are docs-only and skip adversarial review per the standing exception: #21 and #12. #20 is docs-only as well. Not filed as issues, recorded here as accepted divergences already noted in `TODO.md` and reconfirmed against the current standards: the flat single-package root layout (fine for a tool this size), and `make test` running without `-race` (the repo mandates `CGO_ENABLED=0`) — though #18 narrows that second one to a separate cgo-enabled target rather than leaving the detector unused. One more thing found while checking the standards, recorded so it is not re-litigated: the upstream golangci-lint release commit `c0d3ddc9cf3faa61a4e378e879ece580256d76e5` does not appear anywhere in the `prompts` repo and is not a required pin. The Docker image digest plus the `go install` module ref are the two sanctioned pins, and PR #2 already has both.

clawbot referenced this issue

2026-08-09 03:48:04 +02:00

Update golangci-lint to v2.12.2 with canonical config #2

clawbot referenced a pull request that will close this issue

2026-08-09 03:55:47 +02:00

Update golangci-lint to v2.12.2 with canonical config #2

clawbot closed this issue

2026-08-09 03:57:09 +02:00

clawbot referenced this issue from a commit

2026-08-09 03:57:11 +02:00

Merge branch 'golangci-v2.12.2': golangci-lint v2.12.2 and canonical config (closes #3)

clawbot referenced this issue