sneak
c516e34145
check / check (push) Waiting to run
Every setting of waf and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)
43 lines
1.5 KiB
Markdown
43 lines
1.5 KiB
Markdown
# Agents
|
|
|
|
These are the rules for agents working on this repository.
|
|
|
|
## Branches
|
|
|
|
- `main` is the stable branch, and `next` is the development branch.
|
|
- Every PR is cut from `next` and targets `next`.
|
|
- Only sneak merges `next` into `main`.
|
|
- Each issue lands on `next` as one squashed commit whose title ends
|
|
` (closes #N)`. A PR may instead be exactly two commits: first tests that fail
|
|
against the current code, then the fix with no test assertion changed. Such a
|
|
PR lands as both commits.
|
|
|
|
## Entrypoints
|
|
|
|
- Work through the `Makefile` targets, which call the scripts in `script/`. The
|
|
README's [Entrypoints](README.md#entrypoints) section lists them.
|
|
- Never run `go`, `golangci-lint` or prettier directly.
|
|
- `make check` passes before every push.
|
|
|
|
## Editing
|
|
|
|
- Edit files by hand.
|
|
- Format only with `make fmt`, and run it before committing any change.
|
|
|
|
## Iron rules
|
|
|
|
- The request log records query strings exactly as received.
|
|
- Secrets belong in POST data. An app that puts a secret in a query string
|
|
is fixed in the app.
|
|
- Never propose redacting a query string, Gitea's `?token=` included.
|
|
- The default of `SWW_RPROXY_TRUSTED_PROXIES` is the RFC 1918 set.
|
|
- The set is:
|
|
- `10.0.0.0/8`;
|
|
- `172.16.0.0/12`;
|
|
- `192.168.0.0/16`.
|
|
- `SPEC.md` states that default.
|
|
- Forwarded headers count only when the peer is a trusted proxy.
|
|
- Every time is in UTC, whatever `TZ` or the host's time zone says.
|
|
- Every day is a date written `YYYY-MM-DD`, never a time.
|
|
- `SPEC.md` states this near its start.
|