Re-vendor the standard files from sneak/prompts dd4027b (closes #33)

REPO_POLICIES.md, .golangci.yml, the CI workflow and the scripts the
policy keeps identical across repositories are copies of the files at
that commit. .gitignore, .editorconfig and the new .dockerignore are the
canonical files followed by this repository's own entries. The lint
stage moves to the golangci-lint image the policy pins, in the same
commit as .golangci.yml. The format check leaves the lint stage and runs
on the host from script/check, which script/cibuild now runs after
script/bootstrap. The last Dockerfile stage runs script/bootstrap, which
installs goimports with go install at a pinned commit; script/fmt runs
that goimports.

Model: opus-5-5

script/bootstrap

@@ -7,6 +7,11 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# goimports from golang.org/x/tools v0.30.0, 2025-02-10: the last release
+# that Go 1.22, the Go of go.mod and the Dockerfile, can build.
+GOIMPORTS_COMMIT="09747cdf594a7924dcecb506312be3bd6e437962"
+GOIMPORTS_VERSION="v0.30.0"
+
 PKGMGR=""
 SUDO=""
 
@@ -47,6 +52,35 @@ missing() {
     ! command -v "$1" >/dev/null 2>&1
 }
 
+# Print the golang.org/x/tools version that the goimports on PATH was
+# built from, or nothing. goimports has no --version flag; `go version -m`
+# prints the module versions Go records in every binary it builds.
+goimports_version() {
+    bin="$(command -v goimports)" || return 0
+    go version -m "$bin" 2>/dev/null |
+        awk '$1 == "mod" && $2 == "golang.org/x/tools" { print $3 }'
+}
+
+# Install goimports at the pinned commit unless the one on PATH already
+# reports the pinned version. go install writes to GOBIN, or to the bin
+# directory of GOPATH when GOBIN is unset, which need not be on the
+# caller's PATH; script/fmt puts that directory first on PATH the same
+# way, so the check here sees the goimports that script/fmt runs.
+ensure_goimports() {
+    gobin="$(go env GOBIN)"
+    PATH="${gobin:-$(go env GOPATH)/bin}:$PATH"
+    if [ "$(goimports_version)" != "$GOIMPORTS_VERSION" ]; then
+        go install "golang.org/x/tools/cmd/goimports@$GOIMPORTS_COMMIT"
+        hash -r
+        if [ "$(goimports_version)" != "$GOIMPORTS_VERSION" ]; then
+            echo "bootstrap: goimports on PATH is not $GOIMPORTS_VERSION" \
+                "after installing it: $(command -v goimports || echo none)" >&2
+            exit 1
+        fi
+    fi
+    echo "goimports $GOIMPORTS_VERSION at $(command -v goimports)"
+}
+
 main() {
     cd "$ROOT"
 
@@ -55,6 +89,7 @@ main() {
 
     if missing go; then pkg_install go golang go go; fi
     # golangci-lint is not installed: it runs only in docker (script/lint).
+    ensure_goimports
 
     go mod download
 

script/check

@@ -1,6 +1,8 @@
 #!/bin/sh
 # script/check: run all checks (test, lint, fmt-check). Our own
-# extension to scripts-to-rule-them-all. Must not modify any files.
+# extension to scripts-to-rule-them-all. test and lint are Docker
+# phases; fmt-check is native, because a formatter writes the working
+# tree. Must not modify any files.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"

script/cibuild

@@ -1,7 +1,10 @@
 #!/bin/sh
-# script/cibuild: run the CI build. The Dockerfile runs the format check,
-# the linter and the tests, so a successful build means they all pass.
-# --no-cache because a cached check step is a check that did not run.
+# script/cibuild: run the CI build. It bootstraps first: a CI runner
+# checks out and runs this and nothing else, and script/fmt-check runs
+# the formatter on the host, which a pristine checkout cannot do.
+# --no-cache for the same reason as script/docker: the gate phases the
+# final stage depends on are RUN steps, and a cached one is a check that
+# did not run.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -9,7 +12,17 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build --no-cache -t "$("$SCRIPT_DIR/projectname")" .
+    "$SCRIPT_DIR/bootstrap"
+    "$SCRIPT_DIR/check"
+    # Own line: a failing command substitution inside an argument does
+    # not trip `set -e`, so the inline form degrades silently to an
+    # empty constant. The VERSION build argument takes precedence over
+    # the version a build stage derives from the .git in the context.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    docker build --no-cache \
+        --build-arg VERSION="$version" \
+        -t "$("$SCRIPT_DIR/projectname")" .
 }
 
 main "$@"

script/docker

@@ -12,9 +12,8 @@ main() {
     cd "$ROOT"
     # Own line: a failing command substitution inside an argument does
     # not trip `set -e`, so the inline form degrades silently to an
-    # empty constant. VERSION is computed here because .dockerignore
-    # excludes .git, so `git describe` in a build stage yields an empty
-    # version without failing.
+    # empty constant. The VERSION build argument takes precedence over
+    # the version a build stage derives from the .git in the context.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
     docker build --no-cache \

script/fmt

@@ -1,11 +1,16 @@
 #!/bin/sh
-# script/fmt: format all files (writes).
+# script/fmt: format all files (writes) with the goimports that
+# script/bootstrap installs. It puts Go's bin directory first on PATH, as
+# script/bootstrap does, so it runs that goimports even when the directory
+# is not on the caller's PATH.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
+    gobin="$(go env GOBIN)"
+    PATH="${gobin:-$(go env GOPATH)/bin}:$PATH"
     goimports -l -w .
 }