5 Commits

Include renames

Author	SHA1	Message	Date
clawbot	1d769834de	Vendor pinned prettier/format toolchain from prompts scaffold (closes #203) ... script/fmt ran unpinned npx prettier with an inline --tab-width and no config, so formatting was not reproducible. This vendors the canonical format toolchain from the prompts scaffold: .prettierrc (tabWidth 4, proseWrap always), package.json and yarn.lock pinning prettier 3.8.1, and a script/bootstrap that installs node/yarn from a hash-verified nvm archive. script/fmt now reads the config over static/js and markdown; gofmt/goimports unchanged. .prettierignore keeps the *.min.js rule protecting the vendored alpine.min.js. Existing markdown was reflowed to house style. Disclosure: make check does not gate prettier; the linter's pre-existing gomodguard deprecation warning is unrelated and left as-is. Model: opus-4-8 (implementation and review)	2026-09-22 18:43:58 +00:00
clawbot	d946fa68f9	Run all linting in Docker via Dockerfile.lint (closes #188) ... Per the owner ruling, linting now runs only inside Docker with the pinned golangci-lint (v2.12.2). A root Dockerfile.lint runs the linter as a build step; script/lint just builds it. A GATE_RUN build arg forces the lint layer to execute every run so a cached build cannot report a false clean. script/bootstrap no longer installs golangci-lint (the goimports install stays). The main Dockerfile lint stage calls golangci-lint directly (no docker-in-docker) and still gates the build. config verify is omitted because it fetches its schema over an unpinned HTTPS call. Model: opus-4-8	2026-09-22 12:11:19 +02:00
clawbot	727bd50935	Install pinned goimports in script/bootstrap (closes #184) ... script/fmt runs goimports, but script/bootstrap did not install it, so make fmt failed with goimports: not found on a fresh machine. bootstrap now installs goimports v0.49.0 (pinned; compatible with the repo Go 1.25, so no toolchain download) into /usr/local/bin, guarded to skip when it is already present. Node/prettier pinning is left to a separate issue; the check gate runs only gofmt, so main is unaffected. Model: opus-4-8	2026-09-22 11:11:15 +02:00
clawbotandsneak	7a34fc999c	Update golangci-lint to v2.12.2 with canonical config (#187) ... Bumps golangci-lint from v2.10.1 to v2.12.2 everywhere it is pinned and installs the canonical `.golangci.yml`, then fixes every finding the new linter surfaces so `make check` is green. ## Version pins - `Dockerfile` lint stage: `golangci/golangci-lint:v2.12.2` (Debian-based), tag plus digest pin - `script/bootstrap`: `GOLANGCI_LINT_VERSION=2.12.2` with updated `linux-amd64`/`linux-arm64` release-archive sha256 pins ## Config `.golangci.yml` replaced with the canonical config. Material change: the old file declared `version: "2"` but kept settings under the legacy top-level `linters-settings` key, which golangci-lint v2 ignores — so the intended thresholds (`lll` 88, `funlen` 80/50, `cyclop` 15, `dupl` 100) were not being applied. The canonical file moves them under `linters.settings` and drops `issues.exclude-use-default`. ## Lint fixes (216 findings) - `lll` (96): wrapped lines to the 88-column limit - `noctx` (46): `httptest.NewRequestWithContext` with `t.Context()` throughout the tests - `goconst` (24): shared constants for template/JSON keys in `internal/handlers` and repeated test literals - `gosec` (23): app-page redirects now go through a `redirectToApp` helper that path-escapes the app ID (G710 open redirect); `http.ServeFile` of the internally derived deployment log path annotated like the adjacent `os.Stat` (G703) - `dupl` (22): extracted a generic `findAllByAppID` in `internal/models`, a `deleteAppResource` helper in `internal/handlers`, a shared `parsePush` in `internal/service/webhook`, and table-driven/helper-based dedup in tests - `nolintlint` (5): removed `//nolint:funlen` directives made obsolete by the new limits (plus one more that became obsolete after refactoring) - `nilerr` (3, surfaced during fixing): resource-delete lookups now propagate the find error to the caller No behavior changes intended; all tests pass and `make check` is green. Note: golangci-lint v2.12 warns that `gomodguard` is deprecated in favor of `gomodguard_v2` — a future canonical-config update should address this centrally. Co-authored-by: sneak <sneak@sneak.berlin> Reviewed-on: #187 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-08-07 22:21:42 +02:00
sneak	291f85f3ed	scripts-to-rule-them-all (#174) ... Reviewed-on: #174 Co-authored-by: sneak <sneak@sneak.berlin> Co-committed-by: sneak <sneak@sneak.berlin>	2026-07-07 02:15:20 +02:00