## Summary
Rewrites the Dockerfile to use sha256-pinned images and proper multi-stage build structure. Adds missing Makefile targets and a Gitea CI workflow.
## Changes
### Dockerfile
- **Lint stage**: `golangci/golangci-lint` v1.64.8 pinned by sha256 — runs `make fmt-check` + `make lint`
- **Test stage**: `golang` 1.22.12 pinned by sha256 — runs `make test` with dependency on lint stage
- Removed redundant final stage (this is a library with no binary to build)
- Both images pinned by digest with version+date comments
### Makefile
- Added `fmt-check` target: verifies `gofmt` compliance without modifying files
- Added `check` target: runs `fmt-check`, `lint`, `test` in sequence
- Added `hooks` target: installs a pre-commit hook that runs `make check`
- Separated `gofmt` check from `lint` target (was previously bundled)
- Changed default target from `test` to `check`
### CI
- Added `.gitea/workflows/check.yml`: runs `docker build .` on push to main and on PRs
## Verification
`docker build --progress plain .` passes — all stages complete successfully.
closes https://git.eeqj.de/sneak/simplelog/issues/9
<!-- session: agent:sdlc-manager:subagent:fffa0a5a-5127-4489-a2e0-314c5eaaed68 -->
- Pin golangci-lint to v1.64.8 by sha256 digest
- Pin golang to 1.22.12 by sha256 digest
- Lint stage runs make fmt-check + make lint
- Test stage runs make test with dependency on lint stage
- Remove redundant final stage (library has no binary)
- Add fmt-check, check, hooks targets to Makefile
- Add .gitea/workflows/check.yml for CI
closes #9
@clawbot please fix this branch. it's not in line with our repo policies - images need to be cryptographically pinned otherwise it's RCE as image tags are mutable. also the CI should run on push on every branch, not just main.
@clawbot please fix this branch. it's not in line with our repo policies - images need to be cryptographically pinned otherwise it's RCE as image tags are mutable. also the CI should run on push on every branch, not just main.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Rewrites the Dockerfile to use sha256-pinned images and proper multi-stage build structure. Adds missing Makefile targets and a Gitea CI workflow.
Changes
Dockerfile
golangci/golangci-lintv1.64.8 pinned by sha256 — runsmake fmt-check+make lintgolang1.22.12 pinned by sha256 — runsmake testwith dependency on lint stageMakefile
fmt-checktarget: verifiesgofmtcompliance without modifying fileschecktarget: runsfmt-check,lint,testin sequencehookstarget: installs a pre-commit hook that runsmake checkgofmtcheck fromlinttarget (was previously bundled)testtocheckCI
.gitea/workflows/check.yml: runsdocker build .on push to main and on PRsVerification
docker build --progress plain .passes — all stages complete successfully.closes #9
Closing — split Dockerfile work was cancelled. All related issues are closed.
Review: PASS ✅
Reviewed PR #14 closing issue #9.
Checklist
golangci/golangci-lint@sha256:2987913e...golang@sha256:1cf6c45b...COPY --from=lintdependencyCOPY --from=lint /src/go.sum /dev/nullensures lint runs before testsfmt-checktargetcheckprereqscheck: fmt-check lint test(correct order)hookstargetmake check.golangci.ymlunmodified.golangci.ymlexists (unchanged).gitea/workflows/check.ymlrunsdocker build .on push/PRdocker build .Summary
Clean single-commit PR. The Dockerfile is rewritten from scratch with:
go mod downloadcaching layer in each stageCOPY --from=lintto ensure both stages always executeMakefile additions are correct and complete. CI workflow is minimal and appropriate.
Branch is already up-to-date with
main(no rebase needed). Labelledmerge-ready, assigned to @sneak.@clawbot please fix this branch. it's not in line with our repo policies - images need to be cryptographically pinned otherwise it's RCE as image tags are mutable. also the CI should run on push on every branch, not just main.
in this case the image i am referring to is the CI runner image in the CI config. the dockerfile looks ok
Rework Complete
Addressed both review items:
actions/checkoutby SHA —actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683(v4.2.2) instead of mutable@v4tag, eliminating the RCE vector.branches: [main]filter so every push triggers the workflow.docker build .passes locally (fmt-check ✅, lint ✅, tests ✅).