Split out of issue #115 — part 2 of 3. #115 was scoped too large to finish in one sitting and died three times to infrastructure kills before producing anything. Do only the work below. The here-document blindness in shellCode is issue #116 and is out of scope here — do not touch shellCode or heredocTerminator.
Ordering note:#116 also edits cmd/vaultik/lintdocker_test.go. If #116 has already merged to next, rebase on it before starting. If it has not, stay strictly inside assertLinterIsContainerised and its new helper so the two changes do not collide.
The defect
assertLinterIsContainerised in cmd/vaultik/lintdocker_test.go (on next, d257f8f, around line 265) accepts any line where the substring docker occurs anywhere before the linter. So a one-line native fallback passes. Inserted into the real script/lint's main():
command -v docker >/dev/null 2>&1||{ golangci-lint run --config .golangci.yml ./...;return;}
make test stays green. That is precisely the escape hatch an earlier review mutated with, in its most natural spelling: a docker-availability check falling back to the host linter. The commit message and PR body both claim the property is established structurally; it is not.
Implementation requirements
In assertLinterIsContainerised, split the joined line on ;, &&, || and |, and require the command containing the linter to begin with docker (after stripping any leading { or ().
script/lint-fix must still pass on its merits, with no exemption added. Its continuation-joined docker run … golangci-lint run … contains none of those operators, so it is a single segment beginning with docker.
Extract the predicate as a pure function so it gets its own table test, covering at minimum the || fallback spelling above, the script/lint-fix shape, and a plain host call.
Do not re-litigate the containerised gate itself; it is verified and out of scope.
Definition of done
The command -v docker >/dev/null 2>&1 || { …; return; } mutation inserted into the realscript/lint, shown failingmake test with a message naming the offending script and line, then reverted. Output recorded verbatim in a comment on the PR.
script/lint-fix still passes the tightened assertion, demonstrated, with no exemption added for it.
The existing 17 scripts still scan clean (no false positives introduced).
make check green, evidence on the PR. script/cibuild is not required — this touches test code only.
Branch off next. PR based on next, notmain.
Commit title ends with a bare (closes #N) naming this issue's number — a bare #N, never a markdown link, or Gitea will not auto-close it.
Split out of [issue #115](https://git.eeqj.de/sneak/vaultik/issues/115) — **part 2 of 3**. #115 was scoped too large to finish in one sitting and died three times to infrastructure kills before producing anything. Do **only** the work below. The here-document blindness in `shellCode` is [issue #116](https://git.eeqj.de/sneak/vaultik/issues/116) and is **out of scope here** — do not touch `shellCode` or `heredocTerminator`.
**Ordering note:** #116 also edits `cmd/vaultik/lintdocker_test.go`. If #116 has already merged to `next`, rebase on it before starting. If it has not, stay strictly inside `assertLinterIsContainerised` and its new helper so the two changes do not collide.
## The defect
`assertLinterIsContainerised` in `cmd/vaultik/lintdocker_test.go` (on `next`, `d257f8f`, around line 265) accepts **any** line where the substring `docker` occurs anywhere before the linter. So a one-line native fallback passes. Inserted into the real `script/lint`'s `main()`:
```sh
command -v docker >/dev/null 2>&1 || { golangci-lint run --config .golangci.yml ./...; return; }
```
`make test` stays green. That is precisely the escape hatch an earlier review mutated with, in its most natural spelling: a docker-availability check falling back to the host linter. The commit message and PR body both claim the property is established structurally; it is not.
## Implementation requirements
1. In `assertLinterIsContainerised`, **split the joined line on `;`, `&&`, `||` and `|`**, and require the command **containing the linter** to *begin* with `docker` (after stripping any leading `{` or `(`).
2. `script/lint-fix` must still pass **on its merits, with no exemption added**. Its continuation-joined `docker run … golangci-lint run …` contains none of those operators, so it is a single segment beginning with `docker`.
3. Extract the predicate as a **pure function** so it gets its own table test, covering at minimum the `||` fallback spelling above, the `script/lint-fix` shape, and a plain host call.
Do **not** re-litigate the containerised gate itself; it is verified and out of scope.
## Definition of done
- The `command -v docker >/dev/null 2>&1 || { …; return; }` mutation inserted into the **real** `script/lint`, shown **failing** `make test` with a message naming the offending script and line, then reverted. Output recorded **verbatim** in a comment on the PR.
- `script/lint-fix` still passes the tightened assertion, demonstrated, with no exemption added for it.
- The existing 17 scripts still scan clean (no false positives introduced).
- `make check` green, evidence on the PR. `script/cibuild` is **not** required — this touches test code only.
- Branch off `next`. PR based on `next`, **not** `main`.
- Commit title ends with a bare ` (closes #N)` naming **this** issue's number — a bare `#N`, never a markdown link, or Gitea will not auto-close it.
clawbot
added this to the 1.0.0 milestone 2026-09-03 23:55:18 +02:00
clawbot
self-assigned this 2026-09-03 23:55:18 +02:00
Closed at sneak's instruction, 2026-09-05: this was opened by an agent running on another machine outside the managed fleet, under superseded rules. Reopen if the content is wanted.
Model: fable-5-1
Closed at sneak's instruction, 2026-09-05: this was opened by an agent running on another machine outside the managed fleet, under superseded rules. Reopen if the content is wanted.
Model: fable-5-1
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Split out of issue #115 — part 2 of 3. #115 was scoped too large to finish in one sitting and died three times to infrastructure kills before producing anything. Do only the work below. The here-document blindness in
shellCodeis issue #116 and is out of scope here — do not touchshellCodeorheredocTerminator.Ordering note: #116 also edits
cmd/vaultik/lintdocker_test.go. If #116 has already merged tonext, rebase on it before starting. If it has not, stay strictly insideassertLinterIsContainerisedand its new helper so the two changes do not collide.The defect
assertLinterIsContainerisedincmd/vaultik/lintdocker_test.go(onnext,d257f8f, around line 265) accepts any line where the substringdockeroccurs anywhere before the linter. So a one-line native fallback passes. Inserted into the realscript/lint'smain():make teststays green. That is precisely the escape hatch an earlier review mutated with, in its most natural spelling: a docker-availability check falling back to the host linter. The commit message and PR body both claim the property is established structurally; it is not.Implementation requirements
assertLinterIsContainerised, split the joined line on;,&&,||and|, and require the command containing the linter to begin withdocker(after stripping any leading{or().script/lint-fixmust still pass on its merits, with no exemption added. Its continuation-joineddocker run … golangci-lint run …contains none of those operators, so it is a single segment beginning withdocker.||fallback spelling above, thescript/lint-fixshape, and a plain host call.Do not re-litigate the containerised gate itself; it is verified and out of scope.
Definition of done
command -v docker >/dev/null 2>&1 || { …; return; }mutation inserted into the realscript/lint, shown failingmake testwith a message naming the offending script and line, then reverted. Output recorded verbatim in a comment on the PR.script/lint-fixstill passes the tightened assertion, demonstrated, with no exemption added for it.make checkgreen, evidence on the PR.script/cibuildis not required — this touches test code only.next. PR based onnext, notmain.(closes #N)naming this issue's number — a bare#N, never a markdown link, or Gitea will not auto-close it.clawbot referenced this issue2026-09-03 23:56:35 +02:00
clawbot referenced this issue2026-09-03 23:56:49 +02:00
Closed at sneak's instruction, 2026-09-05: this was opened by an agent running on another machine outside the managed fleet, under superseded rules. Reopen if the content is wanted.
Model: fable-5-1