Files

T

sneak 8fb3f0c9b5

Check / check (pull_request) Skipped

Install pinned goimports in script/bootstrap (closes #184 )

script/fmt runs gofmt, goimports, and npx prettier, but bootstrap
installed only git, make, go, and golangci-lint, so `make fmt` failed
with `goimports: not found` on a fresh machine. bootstrap's contract is
to install all dependencies idempotently.

Add ensure_goimports: it skips when goimports is already on PATH,
otherwise `go install`s golang.org/x/tools/cmd/goimports at a pinned
exact version (v0.49.0; integrity via the Go module checksum database)
and places the binary in /usr/local/bin so it is on PATH regardless of
shell config, mirroring the golangci-lint release install. v0.49.0
requires Go 1.25, matching go.mod; v0.50.0 would force a Go 1.26
toolchain download.

Model: opus-4-8

2026-09-22 08:03:07 +00:00

2.5 KiB

Raw Blame History

Workflow

branch (from main)
do the work in Next Step
move Next Step to the top of Completed Steps
move the top item of Future Steps into Next Step
commit (TODO.md changes in the same commit as the work)
merge to main if the branch is not protected, otherwise open a PR
push

Status

1.0+. Tagged 1.0.0 on 2026-02-26; 8 commits on main since. make check is green as of the golangci-lint v2.12.2 update.

Next Step

Confirm .gitea/workflows/check.yml gates merges on make check so main cannot regress.

Completed Steps

2026-09-22: Added .prettierignore so make fmt no longer rewrites the vendored static/js/alpine.min.js bundle (#185).
2026-09-22: script/bootstrap now installs a pinned goimports (golang.org/x/tools v0.49.0) into /usr/local/bin, so make fmt succeeds on a fresh machine after make bootstrap (#184).
2026-09-09: Fixed four deployability blockers found by QA: CSRF origin check over plain HTTP (UPAAS_PLAINTEXT_HTTP, #189), pulling the git image when absent (#190), the env-var editor CSRF token lookup (#191), and the port-mapping delete form's CSRF field (#192).
2026-08-07: Updated golangci-lint to v2.12.2 (canonical .golangci.yml, Dockerfile lint stage pin, script/bootstrap release-archive pins) and fixed all resulting lint findings (noctx, gosec, goconst, lll, dupl, nolintlint); make check green.
2026-07-07 Adopted scripts-to-rule-them-all: script/ entrypoints, Makefile shims, README Entrypoints section
2026-03-11: Monolithic env var editing with bulk save (#158).
2026-03-10: Webhook event history UI page (#164); added missing Makefile docker and hooks targets plus test timeout (#159); notification settings passed from create form (#160).
2026-03-03: REPO_POLICIES compliance file set added (#155).
2026-03-01: Module path changed to sneak.berlin/go/upaas (#143); Dockerfile split into lint and build stages with forced lint execution (#152, #154).
2026-02-26: 1.0.0 tagged; dashboard CSRFField crash fixed (#146).
1.0 audit bug fixes (#120-#125): deferred rollback on commit error, deployment log size cap, error path rendering, docker-compose bind mount, domain type refactor.
CI simplified to docker build only (#130).
2025-12-29 onward: core PaaS built out: deploys with real-time build log streaming, container start/stop/restart and logs, TCP/UDP port mapping, Alpine.js UI, Slack notifications, ULID app IDs, session handling.

Future Steps

Resume feature work only after main is green.