script/fmt runs gofmt, goimports, and npx prettier, but script/bootstrap installed only git, make, go, and golangci-lint, so make fmt failed with goimports: not found on a fresh machine —
bootstrap is contracted to install all dependencies idempotently.
Change
ensure_goimports skips when goimports is already on PATH, otherwise go installs golang.org/x/tools/cmd/goimports at a pinned version and
installs the binary into /usr/local/bin so it is reachable regardless
of shell config — the landing spot the golangci-lint release install
already uses (go install's default GOPATH/bin is not on a fresh
machine's PATH).
Pinned v0.49.0 (2026-08-13), integrity via the Go module checksum
database. v0.49.0 requires Go 1.25, matching go.mod / golang:1.25-alpine; v0.50.0 needs Go 1.26 and would force a toolchain
download.
Node/prettier — deliberately out of scope
make fmt also calls npx prettier, itself unpinned (a hash-pinning
violation) and needing node. Guarding it properly means pinned nvm node
plus a hash-locked prettier and dropping npx — a larger change for its
own issue. make fmt-check / make check runs only gofmt, so main
stays green regardless; goimports is the stated blocker.
Verification
Fresh golang:1.25 container without goimports: make bootstrap
installs goimports v0.49.0 to /usr/local/bin (no toolchain download);
with node present, make bootstrap then make fmt exits 0. Docker gate
(docker build .) green.
Model: opus-4-8
Fixes https://git.eeqj.de/sneak/upaas/issues/184.
`script/fmt` runs `gofmt`, `goimports`, and `npx prettier`, but
`script/bootstrap` installed only git, make, go, and golangci-lint, so
`make fmt` failed with `goimports: not found` on a fresh machine —
bootstrap is contracted to install all dependencies idempotently.
## Change
`ensure_goimports` skips when `goimports` is already on PATH, otherwise
`go install`s `golang.org/x/tools/cmd/goimports` at a pinned version and
installs the binary into `/usr/local/bin` so it is reachable regardless
of shell config — the landing spot the golangci-lint release install
already uses (`go install`'s default `GOPATH/bin` is not on a fresh
machine's PATH).
Pinned `v0.49.0` (2026-08-13), integrity via the Go module checksum
database. `v0.49.0` requires Go 1.25, matching `go.mod` /
`golang:1.25-alpine`; `v0.50.0` needs Go 1.26 and would force a toolchain
download.
## Node/prettier — deliberately out of scope
`make fmt` also calls `npx prettier`, itself unpinned (a hash-pinning
violation) and needing node. Guarding it properly means pinned nvm node
plus a hash-locked prettier and dropping `npx` — a larger change for its
own issue. `make fmt-check` / `make check` runs only `gofmt`, so `main`
stays green regardless; goimports is the stated blocker.
## Verification
Fresh `golang:1.25` container without goimports: `make bootstrap`
installs goimports v0.49.0 to `/usr/local/bin` (no toolchain download);
with node present, `make bootstrap` then `make fmt` exits 0. Docker gate
(`docker build .`) green.
Model: opus-4-8
script/fmt runs gofmt, goimports, and npx prettier, but bootstrap
installed only git, make, go, and golangci-lint, so `make fmt` failed
with `goimports: not found` on a fresh machine. bootstrap's contract is
to install all dependencies idempotently.
Add ensure_goimports: it skips when goimports is already on PATH,
otherwise `go install`s golang.org/x/tools/cmd/goimports at a pinned
exact version (v0.49.0; integrity via the Go module checksum database)
and places the binary in /usr/local/bin so it is on PATH regardless of
shell config, mirroring the golangci-lint release install. v0.49.0
requires Go 1.25, matching go.mod; v0.50.0 would force a Go 1.26
toolchain download.
Model: opus-4-8
PASS. Rebased onto current next (TODO.md changelog conflict only, both entries kept) and gated the rebased tree: the pinned Docker build and make check are green, and on a fresh golang:1.25 container lacking goimports the bootstrap change installs goimports v0.49.0 to /usr/local/bin with no forced toolchain download, idempotently, satisfying the definition of done; leaving node/prettier for a separate hash-pinning issue is reasonable and stated, since fmt-check runs only gofmt.
Model: opus-4-8
PASS. Rebased onto current `next` (`TODO.md` changelog conflict only, both entries kept) and gated the rebased tree: the pinned Docker build and `make check` are green, and on a fresh `golang:1.25` container lacking `goimports` the bootstrap change installs `goimports` v0.49.0 to `/usr/local/bin` with no forced toolchain download, idempotently, satisfying the definition of done; leaving node/prettier for a separate hash-pinning issue is reasonable and stated, since `fmt-check` runs only `gofmt`.
Model: opus-4-8
clawbot
merged commit 727bd50935 into next2026-09-22 11:11:16 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes #184.
script/fmtrunsgofmt,goimports, andnpx prettier, butscript/bootstrapinstalled only git, make, go, and golangci-lint, somake fmtfailed withgoimports: not foundon a fresh machine —bootstrap is contracted to install all dependencies idempotently.
Change
ensure_goimportsskips whengoimportsis already on PATH, otherwisego installsgolang.org/x/tools/cmd/goimportsat a pinned version andinstalls the binary into
/usr/local/binso it is reachable regardlessof shell config — the landing spot the golangci-lint release install
already uses (
go install's defaultGOPATH/binis not on a freshmachine's PATH).
Pinned
v0.49.0(2026-08-13), integrity via the Go module checksumdatabase.
v0.49.0requires Go 1.25, matchinggo.mod/golang:1.25-alpine;v0.50.0needs Go 1.26 and would force a toolchaindownload.
Node/prettier — deliberately out of scope
make fmtalso callsnpx prettier, itself unpinned (a hash-pinningviolation) and needing node. Guarding it properly means pinned nvm node
plus a hash-locked prettier and dropping
npx— a larger change for itsown issue.
make fmt-check/make checkruns onlygofmt, somainstays green regardless; goimports is the stated blocker.
Verification
Fresh
golang:1.25container without goimports:make bootstrapinstalls goimports v0.49.0 to
/usr/local/bin(no toolchain download);with node present,
make bootstrapthenmake fmtexits 0. Docker gate(
docker build .) green.Model: opus-4-8
ba9e7198c7to8fb3f0c9b5Rebased onto current
next; resolved theTODO.mdconflict (kept both Completed Steps entries). make check green.Model: opus-4-8
8fb3f0c9b5to8f88094307PASS. Rebased onto current
next(TODO.mdchangelog conflict only, both entries kept) and gated the rebased tree: the pinned Docker build andmake checkare green, and on a freshgolang:1.25container lackinggoimportsthe bootstrap change installsgoimportsv0.49.0 to/usr/local/binwith no forced toolchain download, idempotently, satisfying the definition of done; leaving node/prettier for a separate hash-pinning issue is reasonable and stated, sincefmt-checkruns onlygofmt.Model: opus-4-8