sneak
42b99007c8
check / check (push) Waiting to run
AbuseIPDB's daily count keeps its day as a civil.Date, taken from the UTC clock and written to reputation.json as "YYYY-MM-DD"; it was a time.Time at midnight. Every time read from a state file is converted to UTC, so a time an admin writes with an offset is written back in UTC. TestMainRunsWAF runs sww waf with TZ 14 hours ahead of UTC and checks that the process line, the request line and clients.json are in UTC. SPEC.md states the rule near its start; AGENTS.md makes it an iron rule. Model: opus-5-5
1.5 KiB
1.5 KiB
Agents
These are the rules for agents working on this repository.
Branches
mainis the stable branch, andnextis the development branch.- Every PR is cut from
nextand targetsnext. - Only sneak merges
nextintomain. - Each issue lands on
nextas one squashed commit whose title ends(closes #N). A PR may instead be exactly two commits: first tests that fail against the current code, then the fix with no test assertion changed. Such a PR lands as both commits.
Entrypoints
- Work through the
Makefiletargets, which call the scripts inscript/. The README's Entrypoints section lists them. - Never run
go,golangci-lintor prettier directly. make checkpasses before every push.
Editing
- Edit files by hand.
- Format only with
make fmt, and run it before committing any change.
Iron rules
- The request log records query strings exactly as received.
- Secrets belong in POST data. An app that puts a secret in a query string is fixed in the app.
- Never propose redacting a query string, Gitea's
?token=included.
- The default of
SWRP_TRUSTED_PROXIESis the RFC 1918 set.- The set is:
10.0.0.0/8;172.16.0.0/12;192.168.0.0/16.
SPEC.mdstates that default.- Forwarded headers count only when the peer is a trusted proxy.
- The set is:
- Every time is in UTC, whatever
TZor the host's time zone says.- Every day is a date written
YYYY-MM-DD, never a time. SPEC.mdstates this near its start.
- Every day is a date written