script/bootstrap does not install goimports, which script/fmt requires #184

Closed
opened 2026-08-07 18:47:47 +02:00 by clawbot · 1 comment
Collaborator

Found while working #175 on a fresh environment: make fmt fails
with script/fmt: goimports: not found after a successful
make bootstrap. script/fmt runs gofmt, goimports, and
npx prettier, but script/bootstrap only installs git, make, go,
and golangci-lint. script/bootstrap's contract is to install ALL
dependencies idempotently, so this is a bootstrap gap.

Remediation: install a pinned goimports in script/bootstrap
(e.g. go install golang.org/x/tools/cmd/goimports@vX.Y.Z with an
exact version constant, integrity covered by the Go module checksum
database). While there, decide whether node/prettier availability
for the static/js formatting step also needs a bootstrap guard,
since script/fmt assumes npx prettier exists.

Definition of done:

  • on a machine without goimports, make bootstrap followed by
    make fmt succeeds
  • the installed version is pinned exactly (no @latest), with a
    version comment per REPO_POLICIES.md
  • lands via PR from a feature branch off main
Found while working #175 on a fresh environment: `make fmt` fails with `script/fmt: goimports: not found` after a successful `make bootstrap`. `script/fmt` runs `gofmt`, `goimports`, and `npx prettier`, but `script/bootstrap` only installs git, make, go, and golangci-lint. `script/bootstrap`'s contract is to install ALL dependencies idempotently, so this is a bootstrap gap. Remediation: install a pinned `goimports` in `script/bootstrap` (e.g. `go install golang.org/x/tools/cmd/goimports@vX.Y.Z` with an exact version constant, integrity covered by the Go module checksum database). While there, decide whether node/prettier availability for the `static/js` formatting step also needs a bootstrap guard, since `script/fmt` assumes `npx prettier` exists. Definition of done: - on a machine without `goimports`, `make bootstrap` followed by `make fmt` succeeds - the installed version is pinned exactly (no `@latest`), with a version comment per `REPO_POLICIES.md` - lands via PR from a feature branch off `main`
clawbot added this to the 1.1.0 milestone 2026-08-07 18:47:47 +02:00
Author
Collaborator

Fixed in #196 (base next).

script/bootstrap now installs goimports when missing: go install golang.org/x/tools/cmd/goimports pinned at v0.49.0 (integrity via the Go module checksum database), placing the binary in /usr/local/bin so it is on PATH. v0.49.0 matches Go 1.25 (go.mod); v0.50.0 would force a Go 1.26 toolchain download.

Verified on a fresh golang:1.25 container lacking goimports: make bootstrap then make fmt succeeds.

Node/prettier left out of scope: npx prettier is separately unpinned and needs node; guarding it properly is a larger, separate change, and make check runs only gofmt so main stays green. Recommend a follow-up issue.

Model: opus-4-8

Fixed in https://git.eeqj.de/sneak/upaas/pulls/196 (base `next`). `script/bootstrap` now installs `goimports` when missing: `go install golang.org/x/tools/cmd/goimports` pinned at `v0.49.0` (integrity via the Go module checksum database), placing the binary in `/usr/local/bin` so it is on PATH. `v0.49.0` matches Go 1.25 (`go.mod`); `v0.50.0` would force a Go 1.26 toolchain download. Verified on a fresh `golang:1.25` container lacking goimports: `make bootstrap` then `make fmt` succeeds. Node/prettier left out of scope: `npx prettier` is separately unpinned and needs node; guarding it properly is a larger, separate change, and `make check` runs only `gofmt` so `main` stays green. Recommend a follow-up issue. Model: opus-4-8
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/upaas#184