clawbot
9bcbe5a3c8
check / check (push) Waiting to run
Every time the program stores, logs or compares is in UTC, whatever TZ says, and AbuseIPDB's day in `reputation.json` is a `YYYY-MM-DD` date. Times read from a state file are converted to UTC as they are read, so a file is written back with `Z` times only. A test runs `sww waf` with `TZ=Pacific/Kiritimati` and checks the process line, the request line and `clients.json`. `SPEC.md` states the rule and `AGENTS.md` makes it an iron rule. - The rate limit's `day` and `day_bytes` buckets keep a start time: each is a 24-hour bucket begun at an instant, not a calendar day. - New dependency `cloud.google.com/go`, of which only `civil` is built. - No migration: a `reputation.json` holding the old day form fails to load, naming the file. Model: opus-5-5
43 lines
1.5 KiB
Markdown
43 lines
1.5 KiB
Markdown
# Agents
|
|
|
|
These are the rules for agents working on this repository.
|
|
|
|
## Branches
|
|
|
|
- `main` is the stable branch, and `next` is the development branch.
|
|
- Every PR is cut from `next` and targets `next`.
|
|
- Only sneak merges `next` into `main`.
|
|
- Each issue lands on `next` as one squashed commit whose title ends
|
|
` (closes #N)`. A PR may instead be exactly two commits: first tests that fail
|
|
against the current code, then the fix with no test assertion changed. Such a
|
|
PR lands as both commits.
|
|
|
|
## Entrypoints
|
|
|
|
- Work through the `Makefile` targets, which call the scripts in `script/`. The
|
|
README's [Entrypoints](README.md#entrypoints) section lists them.
|
|
- Never run `go`, `golangci-lint` or prettier directly.
|
|
- `make check` passes before every push.
|
|
|
|
## Editing
|
|
|
|
- Edit files by hand.
|
|
- Format only with `make fmt`, and run it before committing any change.
|
|
|
|
## Iron rules
|
|
|
|
- The request log records query strings exactly as received.
|
|
- Secrets belong in POST data. An app that puts a secret in a query string
|
|
is fixed in the app.
|
|
- Never propose redacting a query string, Gitea's `?token=` included.
|
|
- The default of `SWRP_TRUSTED_PROXIES` is the RFC 1918 set.
|
|
- The set is:
|
|
- `10.0.0.0/8`;
|
|
- `172.16.0.0/12`;
|
|
- `192.168.0.0/16`.
|
|
- `SPEC.md` states that default.
|
|
- Forwarded headers count only when the peer is a trusted proxy.
|
|
- Every time is in UTC, whatever `TZ` or the host's time zone says.
|
|
- Every day is a date written `YYYY-MM-DD`, never a time.
|
|
- `SPEC.md` states this near its start.
|