sneak
d4eaf5fed2
All checks were successful
check / check (push) Successful in 1m38s
Per the owner ruling the linter runs in a container invoked through the script/ entrypoint, never installed on a host. Dockerfile.lint COPYs the repo into the digest-pinned golangci/golangci-lint:v2.12.2 image and runs `golangci-lint config verify` and `golangci-lint run` as build steps, so a successful build IS a clean lint. script/lint is reduced to building it, and works with a remote docker daemon, where bind mounts are impossible. script/bootstrap loses the `go install`, the pin constants, the version parser and verify_golangci_lint: with nothing linting on the host, the $GOPATH/bin versus PATH shadowing they diagnosed has no subject. It keeps the git/make/go presence checks and `go mod download`, and warns rather than fails when docker is absent. Traps for anyone changing this. A lint build on an unchanged tree exits 0 in under a second having run no linter -- #32 and #39 again. Caching is waived by ruling: Dockerfile.lint carries ARG CHECK_EPOCH referenced inside every gate RUN, because BuildKit hashes the expanded command and a declared but unreferenced ARG invalidates nothing. script/lint passes "$(date +%s)-$$"; the PID is there because two runs land in the same second easily and a bare epoch would cache the second. Nothing inside an image build may shell out to docker. The main Dockerfile's lint stage therefore invokes golangci-lint directly rather than `make lint`, and its build stage runs `make test` and `make fmt-check` rather than the `make check` aggregate, which reaches script/lint. Both stay `make` invocations rather than bare scripts because the Makefile's `export CGO_ENABLED = 0` only reaches what it invokes. COPY --from=lint /usr/bin/golangci-lint becomes COPY --from=lint /src/go.sum /dev/null. The copied binary was the only edge forcing BuildKit to finish linting before the build stage starts; dropping it without replacing the edge would have ended fail-fast linting silently under a still-green build. That no-op copy is the ordering edge canonical REPO_POLICIES.md prescribes. Nothing in the build stage runs the linter now, so ENV PATH=/home/builder/go/bin:$PATH goes with the `go install` that justified it. script/verify-linter-pin is retired with its README entry: it compared a linter binary against GOLANGCI_LINT_VERSION in script/bootstrap and neither subject still exists. The drift moved rather than went away -- the linter is pinned twice, as the FROM line of Dockerfile.lint and the FROM line of the Dockerfile lint stage, which is what #42 made a build failure. script/verify-lint-image-pin compares those two references to each other and restates neither pin; a hardcoded digest would be a third copy and the same drift one file further out. It runs as a gate in both files, and an unreadable reference is a hard failure rather than a vacuous pass. `golangci-lint config verify` is included per the ruling, and its unpinned live HTTPS schema fetch was measured rather than assumed: under --network none the pinned binary passes a valid config and rejects an invalid one with the jsonschema error, so it validates against a schema it embeds. That holds for the gate steps, none of which makes a network call, but not for the build around them -- Dockerfile.lint runs `go mod download` above the gates, so a cold cache needs the network and only a warm one lints offline, until go.mod or go.sum changes. Verified. `make lint` green with every PATH directory containing a golangci-lint removed and `command -v golangci-lint` empty. Two consecutive script/lint runs on an untouched tree both executed the linter, 27.7s and 28.7s under distinct epochs with the COPY layer CACHED above them. A planted unused variable failed script/lint with that finding, and failed `make docker` at the lint stage with the build stage stopped before its COPY --from=lint; reverted clean. The drift guard fails on tag-only, digest-only and unreadable-reference cases, naming both sides. `make check` green; `make docker` green in 5m35s with all six gates executing and the test gate reporting real coverage rather than a cached ok. In the builder image with the Go test cache off, --user 0:0 still fails TestScanHardlinkRunFailsTogether where the unprivileged user passes, so the non-root quirk is intact.
85 lines
3.0 KiB
Bash
Executable File
85 lines
3.0 KiB
Bash
Executable File
#!/bin/sh
|
|
# script/verify-lint-image-pin: fail unless the golangci-lint image
|
|
# referenced by Dockerfile.lint and the one referenced by the main
|
|
# Dockerfile's lint stage are the same image at the same digest. Our own
|
|
# extension to scripts-to-rule-them-all, not one of its entrypoints.
|
|
#
|
|
# The linter version is pinned in two independent files. That is the
|
|
# shape #42 turned into a build failure rather than tolerate: nothing
|
|
# else keeps the two in sync, and a bump applied to one file alone would
|
|
# leave `make lint` and the fail-fast lint stage of `make docker`
|
|
# linting the same tree against different rulesets, both green. This is
|
|
# the single guard that stops it, run as a gate in both files.
|
|
#
|
|
# It deliberately restates neither pin. A hardcoded expected digest here
|
|
# would be a third copy — one more thing to bump, and the same drift one
|
|
# file further out. It compares the two files to each other and knows
|
|
# nothing about which version is correct.
|
|
#
|
|
# A reference that cannot be read is a hard failure, not a skip: a
|
|
# comparison of two empty strings succeeds, which would turn this guard
|
|
# into exactly the unearned green it exists to prevent.
|
|
set -eu
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
|
|
|
LINT_DOCKERFILE="Dockerfile.lint"
|
|
MAIN_DOCKERFILE="Dockerfile"
|
|
|
|
# Echo the single golangci-lint image reference in the named Dockerfile.
|
|
# Scans every argument of every FROM instruction rather than assuming a
|
|
# field position, so `FROM --platform=... img AS stage` reads correctly.
|
|
# Exits non-zero, with a diagnosis, unless there is exactly one.
|
|
lint_image_ref() {
|
|
file="$1"
|
|
|
|
if [ ! -f "$file" ]; then
|
|
echo "verify-lint-image-pin: $file: not found" >&2
|
|
return 1
|
|
fi
|
|
|
|
refs="$(
|
|
awk '
|
|
toupper($1) == "FROM" {
|
|
for (i = 2; i <= NF; i++) {
|
|
if ($i ~ /^golangci\/golangci-lint[:@]/) {
|
|
print $i
|
|
}
|
|
}
|
|
}
|
|
' "$file"
|
|
)"
|
|
|
|
count="$(printf '%s' "$refs" | grep -c . || true)"
|
|
if [ "$count" -ne 1 ]; then
|
|
echo "verify-lint-image-pin: $file: expected exactly one" \
|
|
"golangci/golangci-lint FROM reference, found $count" >&2
|
|
return 1
|
|
fi
|
|
|
|
printf '%s\n' "$refs"
|
|
}
|
|
|
|
main() {
|
|
cd "$ROOT"
|
|
|
|
lint_ref="$(lint_image_ref "$LINT_DOCKERFILE")"
|
|
main_ref="$(lint_image_ref "$MAIN_DOCKERFILE")"
|
|
|
|
if [ "$lint_ref" != "$main_ref" ]; then
|
|
echo "verify-lint-image-pin: the linter image is pinned twice and" \
|
|
"the two pins disagree:" >&2
|
|
echo "verify-lint-image-pin: $LINT_DOCKERFILE: $lint_ref" >&2
|
|
echo "verify-lint-image-pin: $MAIN_DOCKERFILE: $main_ref" >&2
|
|
echo "verify-lint-image-pin: bump both FROM lines together, tag and" \
|
|
"digest, so script/lint and the Dockerfile lint stage keep" \
|
|
"running the same linter" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "verify-lint-image-pin: $LINT_DOCKERFILE and $MAIN_DOCKERFILE" \
|
|
"agree on $lint_ref"
|
|
}
|
|
|
|
main "$@"
|