clawbot
d946fa68f9
Check / check (pull_request) Successful in 1m29s
Per the owner ruling, linting now runs only inside Docker with the pinned golangci-lint (v2.12.2). A root Dockerfile.lint runs the linter as a build step; script/lint just builds it. A GATE_RUN build arg forces the lint layer to execute every run so a cached build cannot report a false clean. script/bootstrap no longer installs golangci-lint (the goimports install stays). The main Dockerfile lint stage calls golangci-lint directly (no docker-in-docker) and still gates the build. config verify is omitted because it fetches its schema over an unpinned HTTPS call. Model: opus-4-8
24 lines
997 B
Docker
24 lines
997 B
Docker
# Lint image — runs golangci-lint inside a container so every lint uses
|
|
# the pinned linter, never a host binary. Linting is a build step, so a
|
|
# successful build is a clean lint. Built by script/lint.
|
|
# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
|
|
FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240
|
|
|
|
WORKDIR /src
|
|
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
# Caching is waived for linting: on an unchanged tree a cached build runs
|
|
# no linter and still exits 0 in under a second. script/lint passes a
|
|
# fresh GATE_RUN every time, and referencing it here forces this step to
|
|
# re-run, so the linter always executes.
|
|
#
|
|
# `golangci-lint config verify` is deliberately NOT run: it fetches its
|
|
# JSON schema over an unpinned live HTTPS call, which REPO_POLICIES.md
|
|
# forbids (all external references must be pinned by hash).
|
|
ARG GATE_RUN
|
|
RUN echo "lint run: ${GATE_RUN}"; golangci-lint run --config .golangci.yml ./...
|