sneak
73ea8a536f
All checks were successful
check / check (push) Successful in 1m23s
Per the owner ruling, the linter runs inside a container invoked through the script/ entrypoint and is never installed on a host. A new root Dockerfile.lint COPYs the repo into the digest-pinned golangci/golangci-lint:v2.12.2 image and runs `golangci-lint config verify` and `golangci-lint run` as build steps, so a successful build IS a clean lint. script/lint is reduced to building it, which also works when the docker daemon is remote and bind mounts are impossible. script/bootstrap loses the `go install`, the pin constants, the version parser and verify_golangci_lint outright rather than being hardened: with nothing linting on the host, the $GOPATH/bin versus PATH shadowing problem those existed to diagnose has no subject. It keeps the git/make/go presence checks and `go mod download`, and warns rather than fails when docker is absent. Two traps. A lint build on an unchanged tree returns success in well under a second having run no linter, which is #32 and #39 over again. Caching is waived by ruling, so Dockerfile.lint carries ARG CHECK_EPOCH referenced inside every gate RUN -- BuildKit hashes the expanded command, not the declaration, so a declared but unreferenced ARG invalidates nothing -- and script/lint passes "$(date +%s)-$$". The PID is in that value because two lint runs land inside the same second easily and a bare epoch would cache the second one. Nothing inside an image build may shell out to docker. The main Dockerfile's lint stage therefore invokes golangci-lint directly instead of `make lint`, and its build stage runs `make test` and `make fmt-check` instead of the `make check` aggregate, which reaches script/lint. Those two remain `make` invocations rather than the bare scripts because the Makefile's `export CGO_ENABLED = 0` only applies to what it invokes, and today's `make check` gets it. COPY --from=lint /usr/bin/golangci-lint is replaced by COPY --from=lint /src/go.sum /dev/null. The copied binary was the only edge forcing BuildKit to finish linting before the build stage starts; dropping it without replacing the edge would have ended fail-fast linting silently under a still-green build. That no-op copy is the ordering edge canonical REPO_POLICIES.md prescribes. Nothing in the build stage runs the linter any more, so the binary itself is not wanted there, and ENV PATH=/home/builder/go/bin:$PATH goes with the `go install` that justified it. script/verify-linter-pin is retired -- deleted along with its README entry -- because both of its subjects ceased to exist in this same change: it compared a linter binary against GOLANGCI_LINT_VERSION in script/bootstrap, and there is now neither a binary crossing between stages nor a version pin in bootstrap. The drift it guarded has not gone away, it has moved. The linter is still pinned twice, now as the FROM line of Dockerfile.lint and the FROM line of the Dockerfile lint stage, with nothing syncing them, which is exactly what #42 made a build failure. Its replacement is one new script/verify-lint-image-pin that compares those two references to each other and deliberately restates neither pin: a hardcoded expected digest would be a third copy and the same drift one file further out. It runs as a gate in both files, so `make lint`, `make check` and `make docker` all catch drift, and an unreadable reference is a hard failure rather than a vacuous pass. `golangci-lint config verify` is included per the ruling. The concern about its unpinned live HTTPS schema fetch was measured rather than assumed: under --network none the pinned binary both passes a valid config and rejects an invalid one with the jsonschema error, so it validates against a schema it embeds and linting needs no network beyond pulling the image. The README states that rather than a requirement that does not exist. Verified. `make lint` green with every PATH directory containing a golangci-lint removed and `command -v golangci-lint` empty. Two consecutive script/lint runs on an untouched tree both executed the linter, 27.7s and 28.7s in the lint step under distinct epochs with the COPY layer CACHED above them. A planted unused variable failed script/lint with that exact finding and failed `make docker` at the lint stage with the build stage stopped before its COPY --from=lint, then reverted clean. The drift guard fails on tag-only, digest-only and unreadable-reference cases, naming both sides. `make check` green; `make docker` green in 5m35s with all six gates executing and the test gate reporting real coverage rather than a cached ok. In the builder image with the Go test cache off, --user 0:0 still fails TestScanHardlinkRunFailsTogether where the unprivileged user passes, so the non-root quirk is intact.
60 lines
2.9 KiB
Docker
60 lines
2.9 KiB
Docker
# Lint-only image: this is how the linter runs, everywhere. The repo is
|
|
# COPYed into the pinned golangci-lint image and the linter runs as a
|
|
# build step, so a successful build IS a clean lint. golangci-lint is
|
|
# never installed on a host — one toolchain, pinned by digest, identical
|
|
# on a laptop and in CI — and this works even when the docker daemon is
|
|
# remote and bind mounts are impossible.
|
|
#
|
|
# script/lint builds this file. It is a separate image from the lint
|
|
# stage of the main Dockerfile because script/lint must not depend on
|
|
# the rest of that build; the two FROM lines are kept identical by
|
|
# script/verify-lint-image-pin, run as a gate below.
|
|
# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
|
|
FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240
|
|
|
|
WORKDIR /src
|
|
|
|
# Dependency layers first, so they stay cached across lint runs.
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
# Cache-buster for the gate layers, and only for them. Caching of the
|
|
# lint run is waived by ruling: COPY is invalidated only by changed
|
|
# content, so on an unchanged tree the gates below would be served from
|
|
# cache and this build would exit 0 in under a second having run no
|
|
# linter at all. That exact false green has bitten this repo twice
|
|
# already (#32, #39). script/lint passes a fresh value on every
|
|
# invocation.
|
|
#
|
|
# Each gate RUN must reference the value, because BuildKit hashes the
|
|
# expanded command and not the ARG declaration: a declared but
|
|
# unreferenced ARG invalidates nothing. The ARG sits below the
|
|
# dependency layers deliberately — everything above it keeps its cache,
|
|
# only the gates go cold.
|
|
ARG CHECK_EPOCH
|
|
|
|
# The linter version is pinned in two places, here and in the main
|
|
# Dockerfile's lint stage. Nothing else keeps them in sync, so a
|
|
# half-applied bump is a build failure; see the script.
|
|
RUN echo "gate lint-image-pin, epoch ${CHECK_EPOCH}" && \
|
|
script/verify-lint-image-pin
|
|
|
|
# Validates .golangci.yml against golangci-lint's JSON schema. The
|
|
# concern about this step was that it fetches that schema over a live,
|
|
# unpinned HTTPS call; measured on the pinned image, it does not. The
|
|
# binary carries the schema for its own version, so under
|
|
# `--network none` this both passes on a valid config and still rejects
|
|
# an invalid one with the jsonschema error. That holds for the gate
|
|
# steps generally — none of them makes a network call — but not for
|
|
# this build as a whole: `go mod download` above needs the network on a
|
|
# cold cache, and under `--network none` a first build fails there
|
|
# before reaching any gate. That layer stays cached, so only a warm
|
|
# cache lints offline, until go.mod or go.sum changes.
|
|
RUN echo "gate config verify, epoch ${CHECK_EPOCH}" && \
|
|
golangci-lint config verify --config .golangci.yml
|
|
|
|
RUN echo "gate lint, epoch ${CHECK_EPOCH}" && \
|
|
golangci-lint run --config .golangci.yml ./...
|