3 Commits

Include renames

Author	SHA1	Message	Date
sneak	dcf5f7555b	Re-vendor the canonical files from sneak/prompts at dd4027b (closes #213) ... Linting and testing become the lint and test phases of the Dockerfile, and the build stage depends on both. Dockerfile.lint, CHECK_EPOCH and the tests that checked them are removed. Every docker build in script/ passes --no-cache, and script/cibuild runs script/bootstrap first, which now fetches apt package lists so a fresh CI runner can install Go. The image takes its version from the VERSION build arg or git describe, dev without .git, and still stamps the commit and its date. This repo's own entries follow the canonical content in .gitignore and .editorconfig. The golangci-lint v2.14.0 findings are fixed in the code. The rules in CLAUDE.md move into AGENTS.md. IsDevVersion now counts "unknown". Model: opus-5-5	2026-10-06 03:00:12 +00:00
clawbot	75a10d3a22	Hash-verify the Go toolchain in the release workflow (closes #105) ... The release workflow installed Go with actions/setup-go, which pins the action but not the Go archive it downloads, so the compiler that builds the published binaries was verified against nothing in this repo. New script/install-go, modelled on script/install-goreleaser, downloads the go.dev archive for the version in go.mod and refuses it unless its sha256 matches the value committed in the script. It fails if its version disagrees with go.mod, and on any OS or architecture other than the Linux release runners. GOTOOLCHAIN=local on the release step keeps the verified toolchain from switching itself. Judgement call: release path only; script/bootstrap still uses the host Go. model: claude-opus-4-8 (implementation, review); claude-fable-5-1 (merge)	2026-09-21 19:48:52 +02:00
clawbot	e3f407b440	Make the tagged-release path work on Gitea (closes #65) ... No tag could be cut at all: .goreleaser.yaml had no gitea_urls block, so goreleaser defaulted to the GitHub API, and the repo has zero tags. .goreleaser.yaml now points at git.eeqj.de. Version derives from git via a new script/version - exact tag with any leading v stripped, else dev-<12-char sha>, with a -dirty suffix when tracked files are modified - replacing the hardcoded 1.0.0-rc.1 that every local build was stamping regardless of git state. A tag-triggered .gitea/workflows/release.yml runs goreleaser with a scoped token (RELEASE_TOKEN); script/bootstrap installs a sha256-verified goreleaser, and make release / release-snapshot become script shims like every other target. Two fabrications were removed rather than merely replaced. goreleaser's snapshot.version_template was `{{ incpatch .Version }}-next`, which invents a release number from the last tag - and with no tags, from goreleaser's own fabricated v0.0.0. And internal/cli/version.go gated its development-build notice on Version == "dev" exactly, so the moment untagged builds carried a sha that notice would have gone silent and an unreleased binary would have read as a release. Replaced with a tested IsDevVersion predicate, and closed at both layers: the Makefile now refuses to build when script/version yields nothing, and an empty version counts as a development build - reachable today via `docker build --build-arg VERSION=`. The release workflow installs Go from a sha-pinned actions/setup-go (v5.6.0) using go-version-file, so the compiler that produces released binaries is pinned like every other external reference. Without it the first tag push would either fail at goreleaser's before-hook or compile the published artifacts with whatever unpinned Go the runner happened to carry - the one unpinned thing in a release path that already refuses an unpinned goreleaser. Known gap: the Go tarball setup-go fetches is version-pinned but not checksum-verified against a value in this repo, unlike the goreleaser install and the Dockerfile digest.	2026-08-09 18:03:18 +02:00