sneak
b65d273077
Check / check (pull_request) Skipped
golangci-lint now runs only in Docker. New Dockerfile.lint (pinned golangci-lint v2.12.2) COPYs the tree and runs the linter as a build step; script/lint just builds it. A GATE_RUN build arg differs every run, so the lint layer always executes -- a cached build would exit 0 having linted nothing. config verify is deliberately omitted: it fetches its JSON schema over an unpinned live HTTPS call, which REPO_POLICIES.md forbids. script/bootstrap no longer installs golangci-lint (goimports kept). The main Dockerfile lint stage now invokes golangci-lint directly rather than make lint, so building it is not docker-in-docker. Model: opus-4-8
25 lines
775 B
Bash
Executable File
25 lines
775 B
Bash
Executable File
#!/bin/sh
|
|
# script/lint: run golangci-lint. The linter is never installed on the
|
|
# host; it runs only inside Docker, from the pinned image in
|
|
# Dockerfile.lint, so every run uses the same linter version everywhere.
|
|
# Linting is a build step there, so a successful build is a clean lint.
|
|
#
|
|
# GATE_RUN differs every run so the lint layer always executes; a cached
|
|
# build would otherwise exit 0 in under a second having linted nothing.
|
|
# --output=type=cacheonly discards the image and keeps only build cache,
|
|
# so no tagged image is left behind.
|
|
set -eu
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
|
|
|
main() {
|
|
cd "$ROOT"
|
|
docker build \
|
|
--build-arg GATE_RUN="$(date +%s)-$$" \
|
|
--output=type=cacheonly \
|
|
-f Dockerfile.lint \
|
|
.
|
|
}
|
|
|
|
main "$@"
|