sneak
42b99007c8
check / check (push) Waiting to run
AbuseIPDB's daily count keeps its day as a civil.Date, taken from the UTC clock and written to reputation.json as "YYYY-MM-DD"; it was a time.Time at midnight. Every time read from a state file is converted to UTC, so a time an admin writes with an offset is written back in UTC. TestMainRunsWAF runs sww waf with TZ 14 hours ahead of UTC and checks that the process line, the request line and clients.json are in UTC. SPEC.md states the rule near its start; AGENTS.md makes it an iron rule. Model: opus-5-5
43 lines
1.5 KiB
Markdown
43 lines
1.5 KiB
Markdown
# Agents
|
|
|
|
These are the rules for agents working on this repository.
|
|
|
|
## Branches
|
|
|
|
- `main` is the stable branch, and `next` is the development branch.
|
|
- Every PR is cut from `next` and targets `next`.
|
|
- Only sneak merges `next` into `main`.
|
|
- Each issue lands on `next` as one squashed commit whose title ends
|
|
` (closes #N)`. A PR may instead be exactly two commits: first tests that fail
|
|
against the current code, then the fix with no test assertion changed. Such a
|
|
PR lands as both commits.
|
|
|
|
## Entrypoints
|
|
|
|
- Work through the `Makefile` targets, which call the scripts in `script/`. The
|
|
README's [Entrypoints](README.md#entrypoints) section lists them.
|
|
- Never run `go`, `golangci-lint` or prettier directly.
|
|
- `make check` passes before every push.
|
|
|
|
## Editing
|
|
|
|
- Edit files by hand.
|
|
- Format only with `make fmt`, and run it before committing any change.
|
|
|
|
## Iron rules
|
|
|
|
- The request log records query strings exactly as received.
|
|
- Secrets belong in POST data. An app that puts a secret in a query string
|
|
is fixed in the app.
|
|
- Never propose redacting a query string, Gitea's `?token=` included.
|
|
- The default of `SWRP_TRUSTED_PROXIES` is the RFC 1918 set.
|
|
- The set is:
|
|
- `10.0.0.0/8`;
|
|
- `172.16.0.0/12`;
|
|
- `192.168.0.0/16`.
|
|
- `SPEC.md` states that default.
|
|
- Forwarded headers count only when the peer is a trusted proxy.
|
|
- Every time is in UTC, whatever `TZ` or the host's time zone says.
|
|
- Every day is a date written `YYYY-MM-DD`, never a time.
|
|
- `SPEC.md` states this near its start.
|