Re-vendor the canonical files from sneak/prompts at dd4027b (closes #213)
check / check (push) Successful in 12m47s
check / check (push) Successful in 12m47s
Linting and testing become the lint and test phases of the Dockerfile, and the build stage depends on both. Dockerfile.lint, CHECK_EPOCH and the tests that checked them are removed. Every docker build in script/ passes --no-cache, and script/cibuild runs script/bootstrap first. A host without Go gets the go.mod version from script/install-go in .tool/go, which bootstrap, the Makefile, fmt, fmt-check, precommit and release add to PATH; fmt-check skips .tool. The image takes its version from the VERSION build arg or git describe, dev without .git. This repo's own entries follow the canonical content in .gitignore and .editorconfig. The golangci-lint v2.14.0 findings are fixed. The rules in CLAUDE.md move into AGENTS.md. IsDevVersion counts "unknown". Model: opus-5-5
This commit was merged in pull request #236.
This commit is contained in:
+64
-80
@@ -1,92 +1,76 @@
|
||||
# This file has no lint stage, deliberately.
|
||||
#
|
||||
# Linting lives in Dockerfile.lint, built by script/lint, and
|
||||
# script/cibuild builds both. A lint stage here would have to either
|
||||
# shell out to `make lint` -- which is now `docker build`, so
|
||||
# docker-in-docker inside a BuildKit step with no daemon -- or call
|
||||
# golangci-lint directly, which would mean a second, independently
|
||||
# bumpable digest pin for the linter alongside the one in
|
||||
# Dockerfile.lint. Two pins for one tool is the drift that
|
||||
# https://git.eeqj.de/sneak/vaultik/issues/78 was filed over. See
|
||||
# https://git.eeqj.de/sneak/vaultik/issues/113 for the ruling.
|
||||
#
|
||||
# Consequence, stated rather than left to be discovered: script/docker
|
||||
# builds this file only and therefore does not lint. `make fmt-check`
|
||||
# and `make test` still run here, so what a green build of this file
|
||||
# means is "formatted, tested, and it compiles" -- the lint verdict
|
||||
# comes from script/lint or script/cibuild.
|
||||
|
||||
# Build stage
|
||||
# golang:1.26.1-alpine, 2026-03-17
|
||||
FROM golang:1.26.1-alpine@sha256:2389ebfa5b7f43eeafbd6be0c3700cc46690ef842ad962f6c5bd6be49ed82039 AS builder
|
||||
|
||||
# Build tooling: make, plus a C toolchain because `go test -race` needs cgo,
|
||||
# and git, which derives the version below. The sqlite driver is pure Go
|
||||
# (modernc.org/sqlite), so no sqlite library or CLI is required.
|
||||
RUN apk add --no-cache make build-base git
|
||||
|
||||
# Lint phase. The linter is invoked directly rather than through `make
|
||||
# lint` or `script/lint`, which are themselves a docker build and would
|
||||
# recurse into a daemon that does not exist in a build step.
|
||||
# golangci/golangci-lint:v2.14.0, 2026-10-05
|
||||
FROM golangci/golangci-lint:v2.14.0@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint
|
||||
WORKDIR /src
|
||||
|
||||
# Copy go mod files first for better layer caching
|
||||
COPY go.mod go.sum ./
|
||||
RUN go mod download
|
||||
COPY . .
|
||||
# `golangci-lint run` silently ignores an unknown top-level key in
|
||||
# .golangci.yml, such as a misspelt `linters:`; `config verify` fails on it.
|
||||
RUN golangci-lint config verify --config .golangci.yml
|
||||
RUN golangci-lint run --config .golangci.yml ./...
|
||||
|
||||
# Copy source code
|
||||
# Test phase. -race needs cgo and so a C compiler, which the Debian Go
|
||||
# image ships and the alpine one does not.
|
||||
# golang:1.26.1 (Debian trixie), 2026-10-05
|
||||
FROM golang:1.26.1@sha256:cd78d88e00afadbedd272f977d375a6247455f3a4b1178f8ae8bbcb201743a8a AS test
|
||||
WORKDIR /src
|
||||
COPY go.mod go.sum ./
|
||||
RUN go mod download
|
||||
COPY . .
|
||||
RUN go test -timeout 90s -race -cover ./... || \
|
||||
{ echo "--- Rerunning with -v for details ---"; \
|
||||
go test -timeout 90s -race -v ./...; exit 1; }
|
||||
|
||||
# Build stage. Nothing is wanted from either phase above; the copies
|
||||
# are what make BuildKit build them first, so this stage cannot run
|
||||
# unless lint and test passed.
|
||||
# golang:1.26.1-alpine, 2026-03-17
|
||||
FROM golang:1.26.1-alpine@sha256:2389ebfa5b7f43eeafbd6be0c3700cc46690ef842ad962f6c5bd6be49ed82039 AS builder
|
||||
COPY --from=lint /src/go.sum /dev/null
|
||||
COPY --from=test /src/go.sum /dev/null
|
||||
RUN apk add --no-cache git
|
||||
# A tar-stream context keeps the sender's file owners, which git refuses.
|
||||
RUN git config --system --add safe.directory /src
|
||||
WORKDIR /src
|
||||
COPY go.mod go.sum ./
|
||||
RUN go mod download
|
||||
COPY . .
|
||||
|
||||
# Run the format check and the tests.
|
||||
#
|
||||
# CHECK_EPOCH must stay immediately above these RUNs. These layers are
|
||||
# keyed on its value, so they are cache-eligible only for a value
|
||||
# already built against this same tree. script/cibuild and script/docker
|
||||
# each pass a fresh value on every invocation, which is what makes their
|
||||
# green mean the checks really executed.
|
||||
#
|
||||
# The value is expanded into each check command rather than left to a
|
||||
# bare declaration, so the cache miss does not depend on BuildKit's
|
||||
# unreferenced-ARG handling staying as it is. It also puts the epoch in
|
||||
# the build log, where a reader can see the layer was keyed fresh.
|
||||
#
|
||||
# A build that passes no CHECK_EPOCH, such as a plain `docker build .`,
|
||||
# keys these layers on the empty string, so rebuilding an unchanged
|
||||
# checkout replays them from cache and runs nothing. Only the scripts'
|
||||
# builds mean the checks executed.
|
||||
#
|
||||
# Everything above this line (apk, go.mod, `go mod download`) is
|
||||
# deliberately outside the busted range and keeps caching.
|
||||
ARG CHECK_EPOCH
|
||||
RUN echo "check epoch: ${CHECK_EPOCH}" && make fmt-check
|
||||
RUN echo "check epoch: ${CHECK_EPOCH}" && make test
|
||||
|
||||
# Version, commit and build date: the build args when given (script/docker
|
||||
# and script/cibuild pass the ones they compute on the host), otherwise
|
||||
# derived from the .git in the build context. The version is then `git
|
||||
# describe --tags --always`: the tag on a tagged commit, tag-N-gHASH after
|
||||
# one, the short commit when no tag is reachable. A context that carries
|
||||
# .git and still yields no version fails the build; one without .git, as
|
||||
# from a source tarball, stamps "dev" and an "unknown" commit and date.
|
||||
#
|
||||
# These ARGs sit here, after the checks, rather than at the top of the
|
||||
# stage: every commit changes their values, and a value change
|
||||
# invalidates all layers below the ARG. Declared up top they would bust
|
||||
# `go mod download`; here they only rekey this build layer, which the
|
||||
# COPY of the sources above already rebuilds on any change anyway.
|
||||
# The VERSION build arg when one is given, otherwise
|
||||
# `git describe --tags --always` on the .git in the build context. The
|
||||
# commit and its date always come from that .git. With .git present, a
|
||||
# version that is still empty, dev or unknown, or a commit or date that
|
||||
# is unknown, fails the build: git is missing or could not read the
|
||||
# checkout, as when .git is a file pointing outside the context. A
|
||||
# context without .git, such as a source export, stamps "dev" and an
|
||||
# "unknown" commit and date.
|
||||
ARG VERSION
|
||||
ARG COMMIT
|
||||
ARG COMMIT_DATE
|
||||
|
||||
# Build (pure Go, no CGO required since we use modernc.org/sqlite)
|
||||
RUN version="${VERSION:-$(git describe --tags --always || echo dev)}"; \
|
||||
if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \
|
||||
[ "$version" = unknown ]; }; then \
|
||||
echo "the build context carries .git but yields no version" >&2; \
|
||||
exit 1; \
|
||||
RUN VERSION="${VERSION:-$(git describe --tags --always || echo dev)}"; \
|
||||
commit="$(git rev-parse HEAD || echo unknown)"; \
|
||||
commit_date="$(git show -s --format=%cs HEAD || echo unknown)"; \
|
||||
if [ -e .git ]; then \
|
||||
case "$VERSION" in ""|dev|unknown) \
|
||||
echo "version is '$VERSION' although .git is present" >&2; \
|
||||
exit 1 ;; \
|
||||
esac; \
|
||||
if [ "$commit" = unknown ] || [ "$commit_date" = unknown ]; then \
|
||||
echo "commit is '$commit' and its date '$commit_date'" \
|
||||
"although .git is present" >&2; \
|
||||
exit 1; \
|
||||
fi; \
|
||||
fi; \
|
||||
commit="${COMMIT:-$(git rev-parse HEAD || echo unknown)}"; \
|
||||
commit_date="${COMMIT_DATE:-$(git show -s --format=%cs HEAD || echo unknown)}"; \
|
||||
CGO_ENABLED=0 go build -ldflags "-X 'sneak.berlin/go/vaultik/internal/globals.Version=${version}' -X 'sneak.berlin/go/vaultik/internal/globals.Commit=${commit}' -X 'sneak.berlin/go/vaultik/internal/globals.CommitDate=${commit_date}'" -o /vaultik ./cmd/vaultik
|
||||
globals=sneak.berlin/go/vaultik/internal/globals; \
|
||||
CGO_ENABLED=0 go build -trimpath \
|
||||
-ldflags="-s -w -X ${globals}.Version=${VERSION} \
|
||||
-X ${globals}.Commit=${commit} \
|
||||
-X ${globals}.CommitDate=${commit_date}" \
|
||||
-o /vaultik ./cmd/vaultik
|
||||
|
||||
# Runtime stage
|
||||
# Runtime stage, and the last one: a plain `docker build .` builds this
|
||||
# stage's chain and nothing else.
|
||||
# alpine:3.21, 2026-02-25
|
||||
FROM alpine:3.21@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
|
||||
|
||||
|
||||
Reference in New Issue
Block a user