sneak/upaas
1
0
Fork 1
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

Run all linting in Docker via Dockerfile.lint + script/lint #188

New Issue
Closed
opened 2026-08-10 13:16:35 +02:00 by clawbot · 1 comment
clawbot commented 2026-08-10 13:16:35 +02:00
Collaborator
Copy Link
Copy Source

Owner ruling, sneak 2026-08-09: every lint run happens inside a Docker container, invoked through the script/ entrypoint. Docker is always available. Linting runs independently and does not need a cache. He has directed a PR for every repo not already set up this way.

Reference implementation is sneak/homoicon — copy its shape: a root Dockerfile.lint built FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240, which COPYs the repo in and runs golangci-lint run --config .golangci.yml ./... as a build step, with script/lint reduced to building it. Linting as a build step means a successful build IS a clean lint, and it works even where the docker daemon is remote and bind mounts are impossible.

Two things to get right, both of which would otherwise ship a false green:

  1. A cached build lints nothing. A lint build on an unchanged tree returns success in well under a second having run no linter. Caching is explicitly waived here, so force the lint layers to execute.
  2. golangci-lint config verify fetches its JSON schema over an unpinned live HTTPS call. Decide deliberately whether to include it.

Also remove golangci-lint installation from script/bootstrap — nothing runs on the host any more.

Note this repo has a substantial open lint backlog under its 1.1.0 milestone; containerising the runner does not change what those findings are, but it does mean everyone measures them the same way.

Definition of done

  • script/lint runs the linter only in Docker; no host golangci-lint path remains.
  • Two consecutive script/lint runs on an unchanged tree both demonstrably execute the linter.
  • Negative control: introduce a deliberate lint violation, confirm it fails with that specific finding, revert, confirm clean.
  • make check still green.

Canonical tracking issue: sneak/prompts#40

Owner ruling, sneak 2026-08-09: every lint run happens inside a Docker container, invoked through the `script/` entrypoint. Docker is always available. Linting runs independently and does not need a cache. He has directed a PR for every repo not already set up this way. Reference implementation is `sneak/homoicon` — copy its shape: a root `Dockerfile.lint` built `FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240`, which COPYs the repo in and runs `golangci-lint run --config .golangci.yml ./...` as a build step, with `script/lint` reduced to building it. Linting as a build step means a successful build IS a clean lint, and it works even where the docker daemon is remote and bind mounts are impossible. Two things to get right, both of which would otherwise ship a false green: 1. **A cached build lints nothing.** A lint build on an unchanged tree returns success in well under a second having run no linter. Caching is explicitly waived here, so force the lint layers to execute. 2. **`golangci-lint config verify` fetches its JSON schema over an unpinned live HTTPS call.** Decide deliberately whether to include it. Also remove golangci-lint installation from `script/bootstrap` — nothing runs on the host any more. Note this repo has a substantial open lint backlog under its `1.1.0` milestone; containerising the runner does not change what those findings are, but it does mean everyone measures them the same way. ## Definition of done - `script/lint` runs the linter only in Docker; no host golangci-lint path remains. - Two consecutive `script/lint` runs on an unchanged tree both demonstrably execute the linter. - Negative control: introduce a deliberate lint violation, confirm it fails with that specific finding, revert, confirm clean. - `make check` still green. Canonical tracking issue: https://git.eeqj.de/sneak/prompts/issues/40
clawbot commented 2026-09-22 11:30:18 +02:00
Author
Collaborator
Copy Link
Copy Source

Done in PR #200.

Linting now runs only in Docker. New Dockerfile.lint (pinned golangci-lint v2.12.2) runs the linter as a build step; script/lint is reduced to building it, passing a fresh GATE_RUN build arg each run so the lint layer always executes. script/bootstrap no longer installs golangci-lint. The main Dockerfile lint stage now calls golangci-lint directly instead of make lint, so building it is not docker-in-docker.

config verify is deliberately not run: it fetches its JSON schema over an unpinned live HTTPS call, which REPO_POLICIES.md's hash-pinning rule forbids.

Verified: two consecutive runs on an unchanged tree both executed the linter; a deliberate unused-function violation failed the lint with that exact finding and reverting returned it to clean; make check and the full docker build . are both green.

Model: opus-4-8

Done in PR https://git.eeqj.de/sneak/upaas/pulls/200. Linting now runs only in Docker. New `Dockerfile.lint` (pinned golangci-lint v2.12.2) runs the linter as a build step; `script/lint` is reduced to building it, passing a fresh `GATE_RUN` build arg each run so the lint layer always executes. `script/bootstrap` no longer installs golangci-lint. The main `Dockerfile` lint stage now calls `golangci-lint` directly instead of `make lint`, so building it is not docker-in-docker. `config verify` is deliberately not run: it fetches its JSON schema over an unpinned live HTTPS call, which REPO_POLICIES.md's hash-pinning rule forbids. Verified: two consecutive runs on an unchanged tree both executed the linter; a deliberate unused-function violation failed the lint with that exact finding and reverting returned it to clean; `make check` and the full `docker build .` are both green. Model: opus-4-8
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Something is not working
 critical
Extremely important: data loss, a security hole, production down, or basic use impossible
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 merge-ready
All checks pass, reviewed, rebased, ready for merge
 needs-checks
make check does not pass cleanly
 needs-rebase
PR has merge conflicts or is behind main
 needs-review
Code review not yet done
 needs-rework
Code review found issues to fix
 notplanned
question
More information is needed
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/upaas#188