From 3bba2df314fd7ecf9e3c95ca22458e2072b1036d Mon Sep 17 00:00:00 2001 From: clawbot <35+clawbot@noreply.example.org> Date: Tue, 6 Oct 2026 00:00:11 +0000 Subject: [PATCH] Re-vendor the shared files from sneak/prompts at dd4027b (closes #504) Fetches the shared files unchanged from sneak/prompts commit dd4027b and adds .prettierignore; .dockerignore keeps this repository's anchored host artifacts at its end. Linting moves into the Dockerfile's lint phase on the golangci-lint v2.14.0 image, which also runs the js-lint stage, and Dockerfile.lint is gone. Tests move into a test phase on the golang bookworm image. script/lint, test, docker and cibuild are the model scripts, every docker build in script/ passes --no-cache, and the .ci-fingerprint barrier is gone. The workflow no longer calls script/ci-mark-superseded, so it and its tests are removed. make build passes -trimpath and -s -w. Model: opus-5-5 --- .dockerignore | 106 +++-- .gitea/workflows/check.yml | 42 +- .gitignore | 85 ++-- .golangci.yml | 69 ++- .prettierignore | 2 + Dockerfile | 164 ++++--- Dockerfile.browser | 2 +- Dockerfile.lint | 43 -- Makefile | 6 +- README.md | 266 +++++------ REPO_POLICIES.md | 443 +++++++++++++++---- go.mod | 2 +- internal/ciscript/ci_mark_superseded_test.go | 387 ---------------- internal/ciscript/doc.go | 10 - internal/ciscript/fakegitea_test.go | 162 ------- internal/middleware/loginguard_test.go | 6 +- script/assets | 4 +- script/bootstrap | 6 +- script/check | 4 +- script/ci-mark-superseded | 152 ------- script/cibuild | 25 +- script/css | 6 +- script/css-check | 5 +- script/docker | 18 +- script/fmt | 6 +- script/fmt-check | 5 +- script/lint | 74 +--- script/test | 85 +--- script/test-browser | 5 +- script/version | 8 +- 30 files changed, 863 insertions(+), 1335 deletions(-) create mode 100644 .prettierignore delete mode 100644 Dockerfile.lint delete mode 100644 internal/ciscript/ci_mark_superseded_test.go delete mode 100644 internal/ciscript/doc.go delete mode 100644 internal/ciscript/fakegitea_test.go delete mode 100755 script/ci-mark-superseded diff --git a/.dockerignore b/.dockerignore index fe1d815..691399a 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1,30 +1,78 @@ -# .git is sent so the build can derive the version it stamps into the binary -# (script/version). Its config, which can hold a remote URL carrying a -# credential and which `git describe` does not need, is left out of a -# directory context. A context sent as a tar is not filtered by this file, so -# it carries .git/config unless its sender leaves it out. -.git/config - -# No tracked file may be listed here: git in the build would see it as -# deleted and mark the version -dirty. +# .dockerignore does NOT use .gitignore semantics. Docker matches with +# moby/patternmatcher: filepath.Match plus `**`, so `*` does not cross +# `/` and an unprefixed pattern is anchored at the context root. Every +# depth-independent pattern therefore needs `**/`, or `config/.env` and +# `certs/server.key` still ship while this file reads as solved. Only +# genuinely root-anchored entries go unprefixed. Never transplant these +# into .gitignore, where `**/` is wrong. # -# .ci-fingerprint is deliberately NOT excluded: it is the CI cache barrier -# that keeps the check stages from replaying a cached pass. See the lint -# stage of the Dockerfile. -bin/ -# Extracted from 3p/ by `make assets` inside the build; a host copy is not -# needed. The tarball in 3p/ must stay in the context. -static/js/alpine.min.js -# The js-deps stage installs ESLint and prettier; a host copy would overwrite -# them at the `COPY . .` of the stages built on it. -node_modules/ -.env -.env.* -*.db -*.sqlite -*.sqlite3 -.DS_Store -.idea/ -.vscode/ -tmp/ -temp/ +# Matching is case-sensitive, so secrets use character ranges rather +# than an ALL-CAPS twin, which would still miss `Server.Key`. +# +# Extend with this repo's own host-built artifacts, written anchored: +# `/myapp`, never `**/myapp`, which also matches `cmd/myapp/` and +# deletes the package directory from the context. + +# .git is sent without its config. Without a VERSION build argument the +# stage that compiles runs `git describe --tags --always` on .git, which +# does not need .git/config; that file can hold a credential, such as a +# password in a remote URL or the token the CI checkout step stores there. +# Each submodule keeps a config with the same exposure in its git directory +# under .git/modules/, nested again for a submodule's own submodules, or in +# its own .git directory when it keeps one. +# KNOWN GAP: a submodule whose name has a `config` segment (`config`, +# `deploy/config`, `config/lib`) loses its whole git directory, because +# `**/.git/modules/**/config` also matches that segment's directory +# under .git/modules/. Go's version stamping then fails the build; +# nothing leaks. Name such a submodule without that segment: +# `git submodule add --name`. +**/.git/config +**/.git/modules/**/config + +# Agent scratch: one full checkout of the repo per in-flight agent. +# Anchored because it occurs once where agents run at the repo root. +# KNOWN GAP: a repo running agents in subdirectories still ships +# `services/api/.claude/` and must add its own anchored entry. +.claude + +# Environment files. `*.env` covers bare `.env` and the `prod.env` +# convention. Re-include a committed template with a negation if the +# build needs one: `!docs/example.env`. +**/*.[eE][nN][vV] +**/.[eE][nN][vV].* +**/.[eE][nN][vV][rR][cC] + +# Private keys and the bundles carrying them. Public certificates +# (*.crt, *.cer) are deliberately absent: they are legitimate inputs. +**/*.[pP][eE][mM] +**/*.[kK][eE][yY] +**/*.[pP]12 +**/*.[pP][fF][xX] +**/[iI][dD]_[rR][sS][aA] +**/[iI][dD]_[dD][sS][aA] +**/[iI][dD]_[eE][cC][dD][sS][aA] +**/[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK] +**/[iI][dD]_[eE][dD]25519 +**/[iI][dD]_[eE][dD]25519_[sS][kK] + +# Dependencies: restored inside the image, never copied in. +**/node_modules + +# OS metadata. +**/.DS_Store +**/Thumbs.db + +# Editor state: never a build input, and it churns COPY. +**/*.swp +**/*.swo +**/*~ +**/*.bak +**/.idea +**/.vscode +**/*.sublime-* + +# This repository's own host-built artifacts: the binary `make build` +# writes, and the Alpine.js file `make assets` extracts from 3p/ (the +# build extracts its own). +/bin +/static/js/alpine.min.js diff --git a/.gitea/workflows/check.yml b/.gitea/workflows/check.yml index 8143c1a..ee73864 100644 --- a/.gitea/workflows/check.yml +++ b/.gitea/workflows/check.yml @@ -1,37 +1,9 @@ name: check - -on: - push: - branches: - - '**' - +on: [push] jobs: - check: - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 2024-10-23 - with: - # The superseded-status step needs history to walk ancestors (it - # aborts on a shallow clone). - fetch-depth: 0 - - - name: Mark superseded run statuses - # Gitea cancels the in-flight run when another commit is pushed to the - # same branch and records the cancellation as `failure`, so a commit - # that was never tested reads as a test result. The script rewrites - # those statuses to say what happened. See its header for why the - # state stays `failure` and not `skipped`. - env: - GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }} - run: script/ci-mark-superseded - - - name: Fingerprint the build context - # Writes the hash of the commit being checked into the context, which - # invalidates the `COPY . .` layer of every check stage: a commit - # that was never linted, format-checked, stylesheet-checked, tested - # and built cannot report success from cache. - run: git rev-parse HEAD > .ci-fingerprint - - - name: Build Docker image (runs the gofmt check, golangci-lint, the stylesheet check, ESLint, the Markdown check, make test, make build) - run: script/cibuild + check: + runs-on: ubuntu-latest + steps: + # actions/checkout v4.2.2, 2026-02-22 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - run: script/cibuild diff --git a/.gitignore b/.gitignore index d11c6f5..534d4e2 100644 --- a/.gitignore +++ b/.gitignore @@ -1,54 +1,47 @@ -# Binaries -*.exe -*.dll -*.so -*.dylib -bin/ -/webhooker - -# Test binary, built with `go test -c` -*.test - -# Output of the go coverage tool -*.out - -# Go vendor directory -vendor/ - -# ESLint, prettier and their dependencies, installed from yarn.lock -node_modules/ - -# IDE specific files -.idea/ -*.swp -*.swo -*~ -.vscode/ - -# OS specific files +# OS .DS_Store Thumbs.db -# Environment and config files -.env -.env.local +# Editors +*.swp +*.swo +*~ +*.bak +.idea/ +.vscode/ +*.sublime-* -# Data directory (SQLite databases) -data/ -*.db -*.sqlite -*.sqlite3 +# Agent scratch (worktrees of this repo, created and destroyed by +# in-flight tooling). Unanchored: .gitignore patterns already match at +# every depth, so no prefix is wanted here. This is not a .dockerignore +# entry and must not be given a `**/` prefix on the way into one. +.claude/ -# Log files -*.log +# Node +node_modules/ -# Temporary files -tmp/ -temp/ +# Secrets. Unanchored like every entry above, so each matches at every +# depth. Matching is case-sensitive on Linux, so names use character +# ranges rather than a lowercase form that misses `Server.Key`. -# CI cache barrier, written into the build context by the check workflow -.ci-fingerprint +# Environment files. `*.env` covers bare `.env` and the `prod.env` +# convention. Only the templates `example.env` and `sample.env` are +# re-included below. A repository that commits any other template adds +# its own negation after these lines, for example `!.env.example`. +*.[eE][nN][vV] +.[eE][nN][vV].* +.[eE][nN][vV][rR][cC] +!example.env +!sample.env -# Alpine.js, extracted by `make assets` from its tarball in 3p/, which is -# what is committed. -/static/js/alpine.min.js +# Private keys and the bundles carrying them. +*.[pP][eE][mM] +*.[kK][eE][yY] +*.[pP]12 +*.[pP][fF][xX] +[iI][dD]_[rR][sS][aA] +[iI][dD]_[dD][sS][aA] +[iI][dD]_[eE][cC][dD][sS][aA] +[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK] +[iI][dD]_[eE][dD]25519 +[iI][dD]_[eE][dD]25519_[sS][kK] diff --git a/.golangci.yml b/.golangci.yml index 26b1610..1b73eb9 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -10,14 +10,21 @@ run: linters: default: all + enable: + # Successor to the deprecated gomodguard. Named explicitly, rather than + # left to `default: all`, because it carries the module policy below. + - gomodguard_v2 disable: # Genuinely incompatible with project patterns - exhaustruct # Requires all struct fields - - depguard # Dependency allow/block lists + - exhaustruct_v5 # Requires all struct fields (successor to exhaustruct) - godot # Requires comments to end with periods - - wsl # Deprecated, replaced by wsl_v5 - wrapcheck # Too verbose for internal packages - varnamelen # Short names like db, id are idiomatic Go + # Deprecated: the warning is attached to the old name, so it is + # silenced by disabling that name, not by enabling the successor. + - wsl # Deprecated, replaced by wsl_v5 + - gomodguard # Deprecated, replaced by gomodguard_v2 settings: lll: line-length: 88 @@ -28,6 +35,64 @@ linters: max-complexity: 15 dupl: threshold: 100 + depguard: + # Test-support code must not be compiled into the shipped binary. A + # test-support package exists to hand a test privileges the program + # itself must never have, so a file that is not a test must not import + # one. Test files, and the files inside a package whose directory name + # ends in `test`, are where that code belongs, and are exempt. + # + # The deny list below is the one part of this file a repository is + # expected to extend, and the only part it may. depguard matches an + # import path against a list of prefixes, so it cannot be told "any path + # whose last segment ends in test"; a repository's own test-support + # packages have to be named here one at a time, by full import path, + # under a module path that differs from repository to repository. Add + # them; change nothing else. + rules: + test-support: + list-mode: lax + files: + - "$all" + - "!$test" + - "!**/*test/**" + deny: + - pkg: net/http/httptest + desc: >- + Test-support code belongs in test files and in packages whose + directory name ends in test, not in the shipped binary. + # Only decisions already recorded in the Go package defaults are + # listed here. Every entry matches the module path exactly. + gomodguard_v2: + blocked: + - module: github.com/rs/zerolog + recommendations: + - log/slog + reason: "Structured logging is stdlib log/slog." + # One entry per pre-fork module path, because the later releases + # are separate paths. A prefix match would be shorter but would + # also reach github.com/go-redis/redismock, the test double for + # the successor these entries recommend. + - module: github.com/go-redis/redis + recommendations: + - github.com/redis/go-redis/v9 + reason: "Pre-fork module; use the maintained go-redis v9." + - module: github.com/go-redis/redis/v7 + recommendations: + - github.com/redis/go-redis/v9 + reason: "Pre-fork module; use the maintained go-redis v9." + - module: github.com/go-redis/redis/v8 + recommendations: + - github.com/redis/go-redis/v9 + reason: "Pre-fork module; use the maintained go-redis v9." + - module: github.com/sergi/go-diff + recommendations: + - github.com/aymanbagabas/go-udiff + reason: "No unified diff output; use go-udiff." + - module: github.com/hexops/gotextdiff + recommendations: + - github.com/aymanbagabas/go-udiff + reason: "Unmaintained fork; use go-udiff." issues: max-issues-per-linter: 0 diff --git a/.prettierignore b/.prettierignore new file mode 100644 index 0000000..23d67fc --- /dev/null +++ b/.prettierignore @@ -0,0 +1,2 @@ +node_modules/ +yarn.lock diff --git a/Dockerfile b/Dockerfile index e116b5d..7a61e9a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,34 +1,3 @@ -# Lint stage -# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07 -# Using Debian-based image because mattn/go-sqlite3 (CGO) does not -# compile on Alpine musl (off64_t is a glibc type). -FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint - -WORKDIR /src - -# Copy go mod files first for better layer caching -COPY go.mod go.sum ./ -RUN go mod download - -# Copy source code. In CI the context also carries .ci-fingerprint, which -# holds the hash of the commit being checked (see -# .gitea/workflows/check.yml). That invalidates this layer, so the checks -# below cannot report success by replaying a cached pass. Do not add it to -# .dockerignore. -COPY . . - -# Run the Go formatting check and the linter. gofmt and golangci-lint are -# invoked directly rather than through `make fmt-check` and `make lint`: this -# stage is already the pinned linter image, and both scripts build docker -# stages, so calling them here would need a docker daemon inside the build. -# The Markdown half of `make fmt-check` is the markdown-check stage below. -# Keep the golangci-lint steps in step with Dockerfile.lint, including -# --network=none (see its header for why). -RUN if [ -n "$(gofmt -s -l .)" ]; then echo "gofmt needed on:"; gofmt -s -l .; exit 1; fi -RUN script/assets -RUN --network=none golangci-lint config verify --config .golangci.yml -RUN --network=none golangci-lint run --config .golangci.yml --build-tags browser ./... - # Stylesheet stages. static/css/tailwind.css is generated, by this pinned # tailwindcss, from static/css/input.css and the files its @source lines # name. `make css` (script/css) writes it out from the css-output stage. @@ -67,10 +36,7 @@ RUN sed 's/}/}\n/g' static/css/tailwind.css > /tmp/committed.css \ # JavaScript lint stages: ESLint, at the version package.json and yarn.lock # pin, checks static/js/ against eslint.config.mjs. js-deps installs it, and -# prettier for the Markdown stages below, and stays cached until package.json, -# yarn.lock or .yarnrc.yml changes. script/lint forces only js-lint to re-run, -# and the build stage below runs it too. COPY . . brings in the CI cache -# barrier described in the lint stage above. +# prettier for the Markdown stages below. The lint phase below runs js-lint. # # The image's own corepack runs the yarn that package.json's packageManager # field names, yarn 4.18.1 (released 2026-09-24), and checks it against the @@ -104,23 +70,109 @@ FROM js-deps AS markdown-check COPY . . RUN --network=none node_modules/.bin/prettier --check '**/*.md' +# Lint phase: the Go formatting check and golangci-lint over the Go code, +# and ESLint over static/js/ through the copy from js-lint at the end. +# `make lint` (script/lint) builds this stage alone; the build stage below +# depends on it. +# +# golangci/golangci-lint:v2.14.0 (Debian-based), 2026-09-24 +# Using Debian-based image because mattn/go-sqlite3 (CGO) does not +# compile on Alpine musl (off64_t is a glibc type). +FROM golangci/golangci-lint:v2.14.0@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint + +WORKDIR /src + +# Copy go mod files first for better layer caching +COPY go.mod go.sum ./ +RUN go mod download + +COPY . . + +# gofmt and golangci-lint are invoked directly rather than through `make +# fmt-check` and `make lint`, which are themselves docker builds and would +# need a docker daemon inside this one. The Markdown half of `make +# fmt-check` is the markdown-check stage above. +RUN if [ -n "$(gofmt -s -l .)" ]; then echo "gofmt needed on:"; gofmt -s -l .; exit 1; fi + +# static/static.go embeds the Alpine.js file this extracts from 3p/; without +# it the static package does not compile and cannot be linted. +RUN script/assets + +# The golangci-lint steps run with --network=none. `golangci-lint config +# verify` is documented as fetching its JSON schema over HTTPS; this pinned +# image resolves the schema without any network, and --network=none enforces +# that. It also proves no linter reaches out at analysis time. +# +# `run` silently ignores config keys it does not recognize, so a typo would +# disable a setting without a word. `config verify` is what catches that. +RUN --network=none golangci-lint config verify --config .golangci.yml +# --build-tags browser also lints the browser test, which is built only with +# that tag (make test-browser). +RUN --network=none golangci-lint run --config .golangci.yml --build-tags browser ./... + +# Nothing is wanted from js-lint; the copy is what makes this phase run it. +COPY --from=js-lint /src/yarn.lock /dev/null + +# Test phase. -race needs cgo and so a C compiler, which the Debian Go image +# ships and the alpine one does not. `make test` (script/test) builds this +# stage alone; the build stage below depends on it. +# +# golang:1.26.1-bookworm (Debian-based), 2026-03-17 +FROM golang:1.26.1-bookworm@sha256:4465644228bc2857a954b092167e12aa59c006a3492282a6c820bf4755fd64a4 AS test + +WORKDIR /src + +COPY go.mod go.sum ./ +RUN go mod download + +COPY . . + +# static/static.go embeds the Alpine.js file this extracts from 3p/. +RUN script/assets + +# -timeout applies to each package on its own, so 90s has only to clear the +# slowest one. -p 4 -parallel 8 keep the run under 2 GB of memory: at most +# four test binaries build or run at once, each with at most eight parallel +# tests. Under -race every test binary and every link costs a few hundred MB, +# so the defaults (one per core) add up to several GB on a many-core host. +# +# The first run has no -v: go test then prints one result line per package, +# with its coverage, and for a package that fails, everything its tests +# wrote. Verbose output from the whole suite passes the 2 MiB at which the +# Docker build cuts off a step's log, so on a failure only the tests that +# failed run again, with -v. go test reports a failed test as a line starting +# "--- FAIL: TestName" (a failed subtest's line is indented, and reruns with +# its parent) and a failed package as "FAILpackage/path...". A +# failure that names no test, such as a build error or a timeout, is already +# shown in full, so there is nothing to rerun. The step fails after the rerun +# whatever its result: the first run already showed the suite is broken. +# +# bash with pipefail, so that the first run's status is go test's, not tee's. +SHELL ["/bin/bash", "-o", "pipefail", "-c"] +RUN go test -race -cover -p 4 -parallel 8 -timeout 90s ./... 2>&1 | tee /tmp/go-test.log && exit 0; \ + tests="$(awk '/^--- FAIL: / { print $3 }' /tmp/go-test.log | paste -s -d '|' -)"; \ + packages="$(awk '/^FAIL\t/ { print $2 }' /tmp/go-test.log)"; \ + if [ -n "$tests" ]; then \ + echo "--- Rerunning the failed tests with -v for details ---"; \ + go test -race -v -p 4 -parallel 8 -timeout 90s -run "^($tests)\$" $packages; \ + fi; \ + exit 1 + # Build stage # golang:1.26.1-bookworm (Debian-based), 2026-03-17 # Using Debian-based image because gorm.io/driver/sqlite pulls in -# mattn/go-sqlite3 (CGO), which does not compile on Alpine musl. +# mattn/go-sqlite3 (CGO), which does not compile on Alpine musl. The image +# ships git and make, which the version step below uses. FROM golang:1.26.1-bookworm@sha256:4465644228bc2857a954b092167e12aa59c006a3492282a6c820bf4755fd64a4 AS builder -# Depend on the lint, stylesheet check, JavaScript lint and Markdown check -# stages passing +# Nothing is wanted from the lint and test phases or from the stylesheet and +# Markdown checks; the copies are what make BuildKit build them first, so +# this stage cannot run unless they all passed. COPY --from=lint /src/go.sum /dev/null +COPY --from=test /src/go.sum /dev/null COPY --from=css-check /out/tailwind.css /dev/null -COPY --from=js-lint /src/yarn.lock /dev/null COPY --from=markdown-check /src/yarn.lock /dev/null -# jq is a runtime dependency of script/ci-mark-superseded, which the test -# suite executes. git is what script/version derives the version with. -RUN apt-get update && apt-get install -y --no-install-recommends make curl ca-certificates jq git && rm -rf /var/lib/apt/lists/* - # A build context sent as a tar archive keeps its files' owners, and git # refuses to read a checkout owned by another user. Trust this one # whoever owns it. @@ -132,31 +184,27 @@ WORKDIR /build COPY go.mod go.sum ./ RUN go mod download -# Copy source code, including the .ci-fingerprint cache barrier described in -# the lint stage above. COPY . . -# Run tests and build. Both first run script/assets, which extracts Alpine.js -# from its tarball in 3p/. -RUN make test - # Version stamped into the binary: the VERSION build arg when one is # given, otherwise what script/version derives from the .git the build # context carries, so any `docker build .` of a clone stamps its commit. # With neither, as from a source tarball, it is "unknown". -# -# Declared here, below the test step, so a changed version does not -# invalidate its cached layer. ARG VERSION -# A context that carries .git must not stamp "unknown": that means git is -# missing here or could not read the checkout, and the image could not be -# traced back to its commit. -RUN if [ -d .git ] && [ "$(make version VERSION="$VERSION")" = unknown ]; then \ - echo "version is unknown although the build context carries .git" >&2; \ - exit 1; \ +# A context that carries .git must not stamp an empty version, "dev" or +# "unknown": that means git is missing here or could not read the +# checkout, and the image could not be traced back to its commit. +RUN version="$(make version VERSION="$VERSION")"; \ + if [ -e .git ]; then \ + case "$version" in ""|dev|unknown) \ + echo "version is '$version' although .git is present" >&2; \ + exit 1 ;; \ + esac; \ fi +# Builds through the Makefile's build target, which runs script/assets +# (Alpine.js, extracted from its tarball in 3p/) first. RUN make build VERSION="$VERSION" # Rebuild with static linking for Alpine runtime. diff --git a/Dockerfile.browser b/Dockerfile.browser index 9ead22e..d86835e 100644 --- a/Dockerfile.browser +++ b/Dockerfile.browser @@ -16,7 +16,7 @@ COPY . . # The test binary embeds the templates and static files, so the browser # stage needs nothing else. -p 4 keeps the compile's memory down, as in -# script/test. +# the test phase of Dockerfile. RUN make assets && go test -c -p 4 -tags browser -o /browser.test ./internal/server # chromedp/headless-shell:151.0.7922.109 (Debian trixie), 2026-08-11. The diff --git a/Dockerfile.lint b/Dockerfile.lint deleted file mode 100644 index 621e692..0000000 --- a/Dockerfile.lint +++ /dev/null @@ -1,43 +0,0 @@ -# Lint-only image, built by script/lint. golangci-lint is never installed on -# the host: the repo is COPYed into the pinned image and linted as a build -# step, so a successful build IS a clean lint. This works even when the docker -# daemon is remote and bind mounts are impossible. -# -# script/lint passes --no-cache-filter=lint. Without it an unchanged tree -# replays the lint stage from cache and the build succeeds in under a second -# having run no linter at all. Do not drop that flag. -# -# The lint steps run with --network=none. `golangci-lint config verify` is -# documented as fetching its JSON schema over HTTPS, which would make linting -# depend on an unpinned remote artifact; this pinned image resolves the schema -# without any network, and --network=none enforces that rather than trusting -# it. It also proves no linter reaches out at analysis time. If a future image -# bump makes either step need the network, this build fails loudly instead of -# quietly acquiring an unpinned dependency. - -# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07 -# Using Debian-based image because mattn/go-sqlite3 (CGO) does not -# compile on Alpine musl (off64_t is a glibc type). -FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS deps - -WORKDIR /src - -# Copy go mod files first for better layer caching. This stage is cacheable; -# only the lint stage below is forced to re-execute. -COPY go.mod go.sum ./ -RUN go mod download - -FROM deps AS lint - -COPY . . - -# static/static.go embeds the Alpine.js file this extracts from 3p/; without -# it the static package does not compile and cannot be linted. -RUN script/assets - -# `run` silently ignores config keys it does not recognize, so a typo would -# disable a setting without a word. `config verify` is what catches that. -RUN --network=none golangci-lint config verify --config .golangci.yml -# --build-tags browser also lints the browser test, which is built only with -# that tag (make test-browser). -RUN --network=none golangci-lint run --config .golangci.yml --build-tags browser ./... diff --git a/Makefile b/Makefile index 59afeeb..ea25515 100644 --- a/Makefile +++ b/Makefile @@ -19,6 +19,10 @@ override VERSION := $(or $(strip $(VERSION)),$(shell script/version)) # Extra linker flags for the build target. The static relink in the # Dockerfile adds -extldflags here rather than passing its own -ldflags, # so composing flags cannot drop the version stamp. +# +# The build target itself always passes -trimpath and -s -w, as the Go +# Dockerfile in REPO_POLICIES.md does: no build paths, symbol table or +# debug information in the binary. GO_LDFLAGS ?= bootstrap: @@ -49,7 +53,7 @@ check: @script/check build: assets - go build -ldflags '$(strip -X main.version=$(VERSION) $(GO_LDFLAGS))' -o bin/webhooker ./cmd/webhooker + go build -trimpath -ldflags '$(strip -s -w -X main.version=$(VERSION) $(GO_LDFLAGS))' -o bin/webhooker ./cmd/webhooker run: build ./bin/webhooker diff --git a/README.md b/README.md index d97a78f..5b500d6 100644 --- a/README.md +++ b/README.md @@ -17,14 +17,14 @@ before deploying one. ### Prerequisites - Go 1.26.1+ (the version in `go.mod`) -- Docker (for `make lint`, `make fmt` and `make css`, and so for `make check`, - for the browser test in `make test-browser`, for the CI gate, and for - containerized deployment) +- Docker (for `make test`, `make lint`, `make fmt` and `make css`, and so for + `make check`, for the browser test in `make test-browser`, for the CI gate, + and for containerized deployment) golangci-lint is not a prerequisite and must not be installed on the host: `script/bootstrap` does not install it, and `make lint` runs the digest-pinned -linter image via `Dockerfile.lint`. The same holds for tailwindcss (see -[Stylesheet](#stylesheet)). ESLint, prettier, node and yarn are not +linter image in the Dockerfile's `lint` phase. The same holds for tailwindcss +(see [Stylesheet](#stylesheet)). ESLint, prettier, node and yarn are not prerequisites either, and `make lint` and `make fmt` never use a host copy of them (see [Linting](#linting)). @@ -43,8 +43,9 @@ make check # Run the server from the clone. DATA_DIR defaults to # /var/lib/webhooker in every environment, so set it (in .env or the -# shell) to a writable directory. -DATA_DIR=./data make dev +# shell) to a writable directory outside the clone: the databases hold +# the session key, and git does not ignore them. +DATA_DIR=../webhooker-data make dev # Build Docker image make docker @@ -55,11 +56,11 @@ make docker ```bash make bootstrap # Install all dependencies (idempotent) make setup # Bootstrap + install git pre-commit hook -make assets # Extract Alpine.js from 3p/ (test, check, build, dev run it) +make assets # Extract Alpine.js from 3p/ (build and dev run it) make fmt # Format Go (gofmt + goimports) and Markdown (prettier, in Docker) make fmt-check # Fail if gofmt or prettier would change anything (writes nothing) make lint # Run golangci-lint and ESLint in Docker -make test # Run tests with race detection +make test # Run tests with race detection, in Docker make test-browser # Run the browser test in Docker (Dockerfile.browser) make check # test + lint + fmt-check + css-check (CI gate) make build # Build binary to bin/webhooker (version-stamped) @@ -1095,7 +1096,9 @@ field), in the UI footer, and in the startup log line (`msg=starting`, The value is stamped in at build time by the linker; it is not read from a file at runtime, so it identifies the build itself. -`script/version` produces the value and both build paths use it: +`script/version` produces the value for `make build`, and the image build runs +`make build` too; `script/docker` and `script/cibuild` run the same +`git describe --tags --always --dirty` on the host. All of them report: | Build | What it reports | | ----------------------- | --------------------------------------------------- | @@ -1110,18 +1113,19 @@ carries, so any `docker build .` of a clone, with no build arguments, stamps the commit it was built from; a shallow clone of one branch has no tags and stamps the short SHA. `.dockerignore` must therefore leave out neither `.git` nor any tracked file, which git in the build would see as deleted, marking the version -`-dirty`. It does leave `.git/config`, which can hold a remote URL carrying a -credential and which `git describe` does not need, out of a directory context. A -context sent as a tar is not filtered by `.dockerignore`, so it carries -`.git/config` unless its sender leaves it out; for upaas, that is +`-dirty`. It does leave out every git `config` (`**/.git/config`, +`**/.git/modules/**/config`), which can hold a remote URL carrying a credential +and which `git describe` does not need, from a directory context. A context sent +as a tar is not filtered by `.dockerignore`, so it carries `.git/config` unless +its sender leaves it out; for upaas, that is https://git.eeqj.de/sneak/upaas/issues/274. git in the build reads the checkout whoever owns its files, since a context sent as a tar archive keeps the sender's owners and git otherwise refuses a checkout owned by another user. A `VERSION` build arg (`--build-arg VERSION=...`) takes precedence; `script/docker` (and so -`make docker`) passes the one `script/version` resolves on the host. The image -build fails if its context carries `.git` and the version still comes out -`unknown`, which means git is missing from the build or could not read the -checkout. +`make docker`) and `script/cibuild` pass the one they resolve on the host, or +`unknown` where git gives none. The image build fails if its context carries +`.git` and the version still comes out empty, `dev` or `unknown`, which means +git is missing from the build or could not read the checkout. `unknown` is what a source tarball, or a `docker build` with no `.git` in its context and no `VERSION` build arg, reports. A build that reports `unknown` is a @@ -1135,7 +1139,9 @@ to a commit. Nothing that varies between two builds of the same commit is stamped — no timestamp, no hostname, no builder identity — so two builds of one commit still -produce a byte-identical binary. +produce a byte-identical binary. `make build` passes `-trimpath`, so the +directory it builds in is not recorded either, and `-s -w`, which leave out the +symbol table and debug information. ### Backups contain secrets @@ -1213,11 +1219,14 @@ commands with no script behind them, though `build`, `run` and `dev` first run `script/assets`, and `build` and `version` both take their value from `script/version`. -`script/test`, `make build` and `make dev` each run `script/assets` first, which -writes the ignored `static/js/alpine.min.js` (see -[Third-party browser assets](#third-party-browser-assets)), so `make test`, -`make check` and the pre-commit hook work on a fresh clone without a separate -step. +`make build` and `make dev` each run `script/assets` first, which writes the +uncommitted `static/js/alpine.min.js` (see +[Third-party browser assets](#third-party-browser-assets)), so they work on a +fresh clone without a separate step. The Docker stages that compile the code run +it themselves. + +Every `docker build` in `script/` passes `--no-cache`: a check served from the +build cache is a check that did not run. We provide: @@ -1227,10 +1236,12 @@ We provide: - `script/projectname` — output the project name ("webhooker") - `script/assets` — extract Alpine.js from its tarball in `3p/` (see [Third-party browser assets](#third-party-browser-assets)) -- `script/test` — run the test suite +- `script/test` — run the test suite: builds the Dockerfile's `test` phase, + tagged `webhooker-test` - `script/test-browser` — run the browser test in Docker (see [Third-party browser assets](#third-party-browser-assets)) -- `script/lint` — run golangci-lint and ESLint in Docker (see Linting below) +- `script/lint` — run the `gofmt` check, golangci-lint and ESLint: builds the + Dockerfile's `lint` phase, tagged `webhooker-lint` (see Linting below) - `script/fmt` — format the Go code and, in Docker, the Markdown (writes) - `script/fmt-check` — check formatting (read-only) - `script/css` — regenerate `static/css/tailwind.css` in Docker (writes; see @@ -1241,11 +1252,11 @@ We provide: - `script/version` — output the version to stamp into the binary (see [Version stamping](#version-stamping)) - `script/docker` — build the Docker image tagged via `script/projectname`, - passing `script/version`'s output in as the `VERSION` build arg -- `script/cibuild` — CI entrypoint: `docker build .` (the Dockerfile runs the - checks, so a green build implies a green repo) -- `script/ci-mark-superseded` — CI helper: mark the commits whose run a newer - push cancelled (see [CI gate honesty](#ci-gate-honesty)) + passing the version `git describe` gives on the host in as the `VERSION` build + arg +- `script/cibuild` — CI entrypoint: `script/bootstrap`, then `script/check`, + then the same image build as `script/docker`, whose gate phases run again (see + [CI gate honesty](#ci-gate-honesty)) - `script/precommit` — pre-commit checks (`go mod tidy` guard, then `script/check`) - `script/install-precommit` — install the git pre-commit hook that runs @@ -1298,12 +1309,12 @@ apply. The directory is `3p/` rather than `vendor/` because Go treats a root `script/assets` (`make assets`) extracts the browser build, `package/dist/cdn.min.js`, from the tarball to `static/js/alpine.min.js`, where -`go:embed` picks it up. `script/test`, `make build` and `make dev` run it first, -and the Dockerfile builds through `make test` and `make build`, so nothing -downloads Alpine.js. The extracted file is not committed, and `.dockerignore` -keeps any host copy out of the build context. `static/static.go` names every -file it embeds, so a build that skips the extraction, such as a bare `go build`, -fails with an error naming `js/alpine.min.js`. +`go:embed` picks it up. `make build` and `make dev` run it first, and so do the +Dockerfile's lint, test and build stages, so nothing downloads Alpine.js. The +extracted file is not committed, and `.dockerignore` keeps any host copy out of +the build context. `static/static.go` names every file it embeds, so a build +that skips the extraction, such as a bare `go build`, fails with an error naming +`js/alpine.min.js`. To move to a new version: download `https://registry.npmjs.org/@alpinejs/csp/-/csp-.tgz`, check it against @@ -2969,8 +2980,6 @@ webhooker/ ├── internal/ │ ├── banner/ │ │ └── banner.go # Ruled block for the one credential shown in the clear -│ ├── ciscript/ -│ │ └── doc.go # Tests for the CI shell scripts in script/; no runtime code │ ├── resetpw/ │ │ └── resetpw.go # `webhooker resetpw`: set an account's password, stopped deployments only │ ├── config/ @@ -3075,8 +3084,7 @@ webhooker/ │ └── js/alpine.min.js # Alpine.js CSP build, extracted from 3p/ by make assets, not committed ├── templates/ # Go HTML templates (base, login, sources, etc.) ├── script/ # Scripts to Rule Them All entrypoints -├── Dockerfile # Stages: lint, stylesheet, JavaScript lint, Markdown, test+build, Alpine runtime -├── Dockerfile.lint # Lint-only image built by script/lint +├── Dockerfile # Stages: stylesheet, JavaScript lint, Markdown, lint, test, build, Alpine runtime ├── Dockerfile.browser # Browser test image built by script/test-browser ├── Makefile # 13 of 19 targets shim script/; 6 are inline ├── go.mod / go.sum @@ -3084,6 +3092,7 @@ webhooker/ ├── .yarnrc.yml # yarn settings: install into node_modules/ ├── eslint.config.mjs # ESLint configuration for static/js/ ├── .prettierrc # prettier settings for the Markdown +├── .prettierignore # Files prettier skips └── .golangci.yml # golangci-lint configuration ``` @@ -3339,47 +3348,36 @@ Two operational consequences follow from bounding the sequence: ### Linting -golangci-lint never runs on the host. `script/lint` builds `Dockerfile.lint`, -which copies the repo into the digest-pinned golangci-lint image and lints as a -build step, so a successful build is a clean lint. A host binary would share one -cache and one lock with every other checkout on the machine, which has produced -both invented findings attributed to other worktrees and unearned passes. +golangci-lint never runs on the host. `script/lint` builds the Dockerfile's +`lint` phase, which copies the repo into the digest-pinned golangci-lint image +and lints as a build step, so a successful build is a clean lint. A host binary +would share one cache and one lock with every other checkout on the machine, +which has produced both invented findings attributed to other worktrees and +unearned passes. -Three properties are load-bearing: +Two properties are load-bearing: -- `script/lint` passes `--no-cache-filter=lint`. Without it an unchanged tree - replays the lint layer from cache and the build exits 0 in under a second - having linted nothing. The `deps` stage stays cacheable, so module downloads - are not repeated. Invalidation is scoped to the one stage; never prune the - shared build cache. -- `script/lint` does not trust that flag. Docker silently ignores - `--no-cache-filter` for a stage name that does not match, so a stage rename or - a one-character typo would restore the cached false green with no warning and - a fast exit 0. The script therefore tees the build output and treats a run as - a pass only if golangci-lint's own summary line (`N issues.` / `N issues:`) - appears in it: no summary, no lint, whatever the exit code says. -- Both lint steps use `RUN --network=none`. `golangci-lint config verify` is - documented as fetching its JSON schema over HTTPS, which would be an unpinned - remote dependency; the pinned image resolves the schema without network - access, and `--network=none` enforces that instead of trusting it. Verify is - worth keeping because `golangci-lint run` silently ignores config keys it does - not recognize, so a typo would disable a setting with no warning. +- `script/lint` passes `--no-cache`. Without it an unchanged tree replays the + lint layer from cache and the build exits 0 in under a second having linted + nothing. Never prune the shared build cache instead. +- Both golangci-lint steps use `RUN --network=none`. + `golangci-lint config verify` is documented as fetching its JSON schema over + HTTPS, which would be an unpinned remote dependency; the pinned image resolves + the schema without network access, and `--network=none` enforces that instead + of trusting it. Verify is worth keeping because `golangci-lint run` silently + ignores config keys it does not recognize, so a typo would disable a setting + with no warning. ESLint never runs on the host either. It lints `static/js/` (not the extracted -Alpine.js) in the Dockerfile's `js-lint` stage, which `script/lint` builds after -`Dockerfile.lint` and the image build runs before the builder stage. Its version -is pinned in `package.json` and every package's hash in `yarn.lock`. The -`js-deps` stage before it installs ESLint with `yarn install --immutable`, which -fails rather than change `yarn.lock`. The yarn it runs is the one the -`packageManager` field in `package.json` pins by version and hash, which the -node image's own corepack fetches and checks. The stage stays cached until -`package.json`, `yarn.lock` or `.yarnrc.yml` changes, so only the lint step -re-runs and ESLint is not downloaded again. `eslint.config.mjs` turns on the -rules of the JavaScript styleguide `REPO_POLICIES.md` links to that a linter can -check: `no-var` and `prefer-const`. ESLint prints nothing on a pass, so -`script/lint` has no summary line to look for; it names the stage once for both -`--target` and `--no-cache-filter`, and `--target` fails on a name that matches -no stage. +Alpine.js) in the Dockerfile's `js-lint` stage. The `lint` phase copies a file +from it, so `make lint` and the image build both run ESLint. Its version is +pinned in `package.json` and every package's hash in `yarn.lock`. The `js-deps` +stage before it installs ESLint with `yarn install --immutable`, which fails +rather than change `yarn.lock`. The yarn it runs is the one the `packageManager` +field in `package.json` pins by version and hash, which the node image's own +corepack fetches and checks. `eslint.config.mjs` turns on the rules of the +JavaScript styleguide `REPO_POLICIES.md` links to that a linter can check: +`no-var` and `prefer-const`. prettier formats the Markdown, and it never runs on the host either. It is pinned in `package.json` and `yarn.lock` beside ESLint, installed by the same @@ -3391,103 +3389,81 @@ on any Markdown file prettier would change. ### Docker The Dockerfile uses a multi-stage build. Each stage is pinned by digest, and the -lint and builder stages are separate images so the linter's version is fixed -independently of the compiler's: +lint phase and the Go stages are separate images so the linter's version is +fixed independently of the compiler's: -1. **Lint stage** (`golangci/golangci-lint:v2.12.2`, Debian-based) — downloads - dependencies, copies the source, and runs the `gofmt` check, then - `script/assets` to extract Alpine.js from `3p/`, then - `golangci-lint config verify` and `golangci-lint run`, both with - `--network=none`. -2. **Stylesheet stages** (`debian:bookworm-slim`, with the Tailwind standalone +1. **Stylesheet stages** (`debian:bookworm-slim`, with the Tailwind standalone CLI pinned by version and sha256, one binary per architecture) — generate `static/css/tailwind.css` from `static/css/input.css` and the files its `@source` lines name. `css-check` fails when the committed file differs from the generated one, and `make css` writes the generated file out from `css-output` (see [Stylesheet](#stylesheet)). -3. **JavaScript lint stages** (`node:24.21.0-alpine`, with the yarn +2. **JavaScript lint stages** (`node:24.21.0-alpine`, with the yarn `package.json` pins, run through the image's corepack) — `js-deps` installs ESLint and prettier from `yarn.lock` and `js-lint` runs ESLint over `static/js/` (see [Linting](#linting)). -4. **Markdown stages** (on `js-deps`) — `markdown-check` runs prettier over the +3. **Markdown stages** (on `js-deps`) — `markdown-check` runs prettier over the Markdown and fails on any file it would change, and `make fmt` writes the formatted files out from `markdown-output`. -5. **Builder stage** (`golang:1.26.1-bookworm`) — depends on the lint, - `css-check`, `js-lint` and `markdown-check` stages passing (it copies a file - from each), runs `make test` and `make build` (both extract Alpine.js from - `3p/` first), and finally rebuilds the binary with `CGO_ENABLED=1` and static - linking so it runs on musl. Both builds go through `make build`, the relink - adding its `-extldflags` via `GO_LDFLAGS`, so neither can drop the `-X` that - stamps the version. The version is the `VERSION` build arg if one is given, +4. **Lint phase** (`lint`, `golangci/golangci-lint:v2.14.0`, Debian-based) — + downloads dependencies, copies the source, and runs the `gofmt` check, then + `script/assets` to extract Alpine.js from `3p/`, then + `golangci-lint config verify` and `golangci-lint run`, both with + `--network=none`, and depends on `js-lint` (it copies a file from it). + `make lint` builds this stage alone. +5. **Test phase** (`test`, `golang:1.26.1-bookworm`, whose C compiler `-race` + needs) — extracts Alpine.js, then runs `go test -race -cover` at most four + packages and eight tests at a time, with a 90-second timeout per package. On + a failure it runs only the failed tests again with `-v`, since verbose output + from the whole suite would pass the 2 MiB at which the Docker build cuts off + a step's log, and then fails. `make test` builds this stage alone. +6. **Builder stage** (`golang:1.26.1-bookworm`) — depends on the lint and test + phases and the `css-check` and `markdown-check` stages passing (it copies a + file from each), runs `make build` (which extracts Alpine.js from `3p/` + first), and then rebuilds the binary with `CGO_ENABLED=1` and static linking + so it runs on musl. Both builds go through `make build`, the relink adding + its `-extldflags` via `GO_LDFLAGS`, so neither can drop the `-X` that stamps + the version. The version is the `VERSION` build arg if one is given, otherwise derived from the `.git` in the context, and the stage fails if a - context with `.git` would stamp `unknown` (see + context with `.git` would stamp an empty version, `dev` or `unknown` (see [Version stamping](#version-stamping)). -6. **Runtime stage** (`alpine:3.21`) — copies the static binary and +7. **Runtime stage** (`alpine:3.21`) — copies the static binary and `deploy/docker-entrypoint.sh`, creates the `/var/lib/webhooker` directory for all SQLite databases, exposes port 8080, and includes a health check against `/.well-known/healthcheck`. It sets no `USER`: the `ENTRYPOINT` script starts as root, sets the data directory's owner and mode, and runs the app as the non-root `webhooker` user (UID 1000) through `su-exec`. -The lint stage invokes `gofmt` and `golangci-lint` directly rather than -`make fmt-check` and `make lint`: it is already the pinned linter image, and -both targets build docker stages, which would need a docker daemon inside this -build. +The lint and test phases invoke `gofmt`, `golangci-lint` and `go test` directly +rather than `make fmt-check`, `make lint` and `make test`: those targets build +docker stages, which would need a docker daemon inside this build. -The lint and builder stages use Debian rather than Alpine because +The lint phase and the Go stages use Debian rather than Alpine because `gorm.io/driver/sqlite` pulls in `mattn/go-sqlite3`, which needs CGO and does not compile against musl. Only the final binary is statically linked, which is what lets it run on the Alpine runtime image. -`script/cibuild` — `docker build .` — is the CI gate: the checks run inside the -image, so a build that succeeds is a repo that is formatted, linted, tested and -compiled, with a current stylesheet. `script/lint` also uses Docker -(`Dockerfile.lint` and the `js-lint` stage, see Linting above), so `make lint` -and `make check` run the same pinned linter versions the gate does; of the steps -`make check` runs, only `script/test` and the `gofmt` check in -`script/fmt-check` run on the host. +`script/cibuild` is the CI gate: it runs `script/bootstrap`, then +`script/check`, then builds the image, whose build runs the lint and test phases +and the stylesheet and Markdown checks again. A build that succeeds is a repo +that is formatted, linted, tested and compiled, with a current stylesheet. +`make check` runs the same stages the gate does; of its steps, only the `gofmt` +check in `script/fmt-check` runs on the host. #### CI gate honesty A layer cache lets `docker build .` exit 0 in seconds with the lint and test stages replayed rather than executed, which would make a green check -meaningless. The `check` workflow therefore writes `.ci-fingerprint` into the -build context before building. Its value is the hash of the commit being -checked, so every commit, docs-only ones and a squash merge whose tree matches -an already-built branch included, gets a new fingerprint, invalidates the -`COPY . .` layer of every check stage, and really runs the `gofmt` check, -`golangci-lint`, the stylesheet check, ESLint, the Markdown check, `make test`, -and `make build`. A run that reports success ran them. +meaningless. Every `docker build` in `script/` therefore passes `--no-cache`, so +on every run the `gofmt` check, `golangci-lint`, ESLint, the stylesheet check, +the Markdown check, `go test` and `make build` really execute. A run that +reports success ran them. A bare `docker build .` carries no such guarantee. -The module download layer sits above `COPY . .` and stays cached. - -A separate workflow step, run before the fingerprint is written, covers a second -way the gate lied: Gitea cancels an in-flight run when a newer commit lands on -the same branch and records that cancellation as a `failure` status, so a commit -nothing ever tested reads as a test result. Cancellation is unconditional -server-side for push events, so the superseding run calls -`script/ci-mark-superseded`, which rewrites that exact status to `failure` / -`Superseded by a newer commit; never tested`. - -The state stays `failure` on purpose: Gitea's combined status folds `skipped` -into `success`, so marking a never-tested commit `skipped` made the status API -report green for it, indistinguishable from a commit that passed. Reading a -commit's status on this repo therefore goes: - -- `success` / `Successful in ...` — the checks ran and passed. -- `failure` / `Failing after ...` — the checks ran and failed. -- `failure` / `Superseded by a newer commit; never tested` — the run was - cancelled, by a newer push or by hand, and nothing was verified about this - commit. Test the commit itself before concluding anything about it. - -Genuine failures and successes are never touched, and no status is left -`pending`, which would block the commit indefinitely. The step derives its -context string from the workflow name, the job **id** and the event. That is -deliberately not byte-identical to Gitea's own rule, which uses the job's -display `name:` where the runner exports the id, so giving the job a `name:` — -or renaming the workflow — makes the derived context stop matching. The step -fails loudly when no status on the commit carries that context, so no rename can -silently disable the rewrite. +The `check` workflow is the shared one from `REPO_POLICIES.md`: it checks out +the repository and runs `script/cibuild`, nothing else. Gitea cancels an +in-flight run when a newer commit lands on the same branch and records that as +`failure` / `Has been cancelled`: nothing was verified about that commit, so +test the commit itself before concluding anything about it. ## TODO diff --git a/REPO_POLICIES.md b/REPO_POLICIES.md index 9aba6b0..20382d1 100644 --- a/REPO_POLICIES.md +++ b/REPO_POLICIES.md @@ -1,6 +1,6 @@ --- title: Repository Policies -last_modified: 2026-08-07 +last_modified: 2026-10-04 --- This document covers repository structure, tooling, and workflow standards. Code @@ -60,17 +60,28 @@ style conventions are in separate documents: prerequisite since nvm requires bash. yarn is then pinned via `corepack prepare yarn@ --activate`. Never install "latest" or "lts"; always exact versions. `script/cibuild` runs the CI build: it changes to the - repo root and runs `docker build .`; the Gitea workflow calls it. Four further - scripts are our own extensions to the standard: `script/check` runs - `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is - what the git pre-commit hook runs, and it calls `script/check`; - `script/install-precommit` installs the git pre-commit hook (the `make hooks` - target shims to it); and `script/projectname` (literally that filename) simply - outputs the project's name. Scripts that need the name call - `script/projectname` — e.g. `script/docker` assembles its image tag from it — - so those scripts stay byte-identical across all repos. Repo-type-specific - pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in - `script/precommit`, not in the hook itself. Model scripts are at + repo root, runs `script/bootstrap`, runs `script/check`, and builds the image + with the version; the Gitea workflow calls it. **`script/cibuild` runs + `script/bootstrap` first**, because the workflow checks out the repo and runs + nothing else, while `script/fmt-check` runs the formatter on the host: on a + pristine checkout with nothing installed the run dies there, after the + containerised gates have passed. **The bootstrap alone is not enough**: + `script/bootstrap` installs node and yarn under nvm and leaves neither on the + `PATH` of the shell that called it, so a bare `yarn` still exits 127. The host + entrypoints that need yarn — `script/fmt` and `script/fmt-check` — therefore + source nvm for the pinned node version before invoking it, exactly as + `script/bootstrap`'s own install step does. A runner carrying nothing but + docker and git then gets through `script/check`. Four further scripts are our + own extensions to the standard: `script/check` runs `script/test`, + `script/lint` and `script/fmt-check`; `script/precommit` is what the git + pre-commit hook runs, and it calls `script/check`; `script/install-precommit` + installs the git pre-commit hook (the `make hooks` target shims to it); and + `script/projectname` (literally that filename) simply outputs the project's + name. Scripts that need the name call `script/projectname` — e.g. + `script/docker` assembles its image tag from it — so those scripts stay + byte-identical across all repos. Repo-type-specific pre-commit extras (e.g. + `go mod tidy` verification in Go repos) belong in `script/precommit`, not in + the hook itself. Model scripts are at `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/`. The README must document the provided scripts in an **Entrypoints** section (see the README requirements below). @@ -89,87 +100,198 @@ style conventions are in separate documents: contributor should be able to understand the entire development workflow by reading the Makefile. -- Every repo should have a `Dockerfile`. All Dockerfiles must run `make check` - as a build step so the build fails if the branch is not green. For non-server - repos, the Dockerfile should bring up a development environment and run - `make check`. For server repos, `make check` should run as an early build - stage before the final image is assembled. Dockerfiles install development - prerequisites by running `script/bootstrap` rather than duplicating installs - inline; COPY `script/` and the dependency manifests (`package.json` + - `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap - layer stays cached until dependencies change. +- Every repo should have a `Dockerfile`, and it carries the repo's gates: a + `lint` phase and a `test` phase, with the final stage depending on both so the + image cannot be built unless they pass. For non-server repos the final stage + brings up a development environment; for server repos it is the runtime image. + The gate phases and the build stage start from their pinned base images and + install what those images lack either inline, as the canonical Go `Dockerfile` + below does for `git`, or by running `script/bootstrap`, as the `prompts` + repo's own `Dockerfile` does for its yarn packages. The development + environment stage installs development prerequisites by running + `script/bootstrap` rather than duplicating its installs inline. A stage that + runs `script/bootstrap` COPYs `script/` and the dependency manifests + (`package.json` + `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it. -- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go - repos use a multistage build where linting runs in an independent stage based - on the `golangci/golangci-lint` image (pinned by hash). This stage runs - `make fmt-check` and `make lint` before the full build begins. The build stage - then declares an explicit dependency on the lint stage via - `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete - linting before proceeding to compilation and tests. This ensures lint failures - surface in seconds rather than minutes, without blocking on dependency - download or compilation in the build stage. +- **Linting and testing run in Docker, as phases of the `Dockerfile`.** There is + no separate lint file. `script/lint` and `script/test` each build one phase + and nothing else: - The standard pattern for a Go repo Dockerfile is: + ```sh + docker build --no-cache --target lint -t "$(script/projectname)-lint" . + docker build --no-cache --target test -t "$(script/projectname)-test" . + ``` + + **A stage that is not the last one in the file is built only when the final + stage's chain depends on it, or when `--target` names it.** That is why the + two gates are always invoked by name here, and why the final stage carries a + `COPY --from=` of a harmless file from each of them: without that edge a + plain `docker build .` builds the last stage alone and exits 0 having linted + and tested nothing. + + **Every `docker build` in `script/` is tagged**, here and in + `script/cibuild` and `script/docker`. An untagged build leaves a dangling + image behind on every invocation, on every developer host and every CI + runner; a tagged one replaces the previous image. + + Inside a phase the tool is invoked directly — `golangci-lint`, `go test`, + `eslint`, `prettier` — never through `make lint` or `script/test`, which are + themselves a `docker build` and would recurse into a daemon that does not + exist in a build step. Formatting is the exception and stays on the host: + `script/fmt` writes the working tree, and `script/fmt-check` is its + read-only twin. + + **No lint verdict may come from a host invocation of the linter.** On a + shared host golangci-lint reads a result cache keyed on file content rather + than location, so a second checkout of the same content is served the first + one's findings, and a host-global lock in `$TMPDIR` makes concurrent runs + exit non-zero with `parallel golangci-lint is running` — a status a caller + cannot tell from real findings. Both have produced wrong verdicts in this + org, in both directions. A container has its own cache, its own `TMPDIR` and + a digest-pinned binary, so neither is reachable. + +- **Any build that runs checks is built with `--no-cache`.** Docker invalidates + a `COPY` layer only when the copied content changes, so on an unchanged tree + the check `RUN` is served from cache, nothing executes, and the build still + exits 0. Every `docker build` in `script/` therefore passes `--no-cache`: + `script/lint`, `script/test`, `script/cibuild` and `script/docker` are the + four, and there is no fifth — `script/check` runs the two gate phases and + `script/fmt-check`, and builds no image of its own. A bare `docker build .` is + not evidence that anything ran: a sub-second build reporting success is a + cache hit, not a result. Never invalidate by pruning — `docker builder prune` + and friends destroy a build cache shared with every other build on the host. + When a check is added or changed, prove it works by planting a defect it must + catch and watching the run fail on it, then revert the defect. A green run + alone shows neither that the check ran nor that it covers what it should. + +- **The gate phases are separate stages, and the build stage depends on both.** + The lint phase is based on the `golangci/golangci-lint` image (pinned by + hash), so lint failures surface in seconds rather than after a full compile, + and the test phase is based on the Debian Go image. The canonical Go repo + `Dockerfile`: ```dockerfile - # Lint stage — fast feedback on formatting and lint issues + # Lint phase # golangci/golangci-lint:v2.x.x, YYYY-MM-DD FROM golangci/golangci-lint@sha256:... AS lint WORKDIR /src COPY go.mod go.sum ./ RUN go mod download COPY . . - RUN make fmt-check - RUN make lint + RUN golangci-lint run --config .golangci.yml ./... - # Build stage - # golang:1.x-alpine, YYYY-MM-DD - FROM golang@sha256:... AS builder + # Test phase. -race needs cgo and so a C compiler, which the Debian Go + # image ships and the alpine one does not. + # golang:1.x, YYYY-MM-DD + FROM golang@sha256:... AS test WORKDIR /src - - # Force BuildKit to run the lint stage before proceeding - COPY --from=lint /src/go.sum /dev/null - COPY go.mod go.sum ./ RUN go mod download COPY . . - RUN make test + RUN go test -timeout 90s -race -cover ./... || \ + { echo "--- Rerunning with -v for details ---"; \ + go test -timeout 90s -race -v ./...; exit 1; } - ARG VERSION=dev - RUN CGO_ENABLED=0 go build -trimpath \ - -ldflags="-s -w -X main.Version=${VERSION}" \ - -o /app ./cmd/app/ + # Build stage. Nothing is wanted from either phase above; the copies + # are what make BuildKit build them first, so this stage cannot run + # unless lint and test passed. + # golang:1.x-alpine, YYYY-MM-DD + FROM golang@sha256:... AS builder + COPY --from=lint /src/go.sum /dev/null + COPY --from=test /src/go.sum /dev/null + RUN apk add --no-cache git + # A tar-stream context keeps the sender's file owners, which git refuses. + RUN git config --system --add safe.directory /src + WORKDIR /src + COPY go.mod go.sum ./ + RUN go mod download + COPY . . - # Runtime stage + # The VERSION build arg when one is given, otherwise + # `git describe --tags --always` on the .git in the build context. With + # .git present, a version that is still empty, dev or unknown fails the + # build: git is missing or could not read the checkout. + ARG VERSION + RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \ + if [ -e .git ]; then \ + case "$VERSION" in ""|dev|unknown) \ + echo "version is '$VERSION' although .git is present" >&2; \ + exit 1 ;; \ + esac; \ + fi; \ + CGO_ENABLED=0 go build -trimpath \ + -ldflags="-s -w -X main.Version=${VERSION}" \ + -o /app ./cmd/app/ + + # Runtime stage, and the last one FROM alpine@sha256:... COPY --from=builder /app /usr/local/bin/app ENTRYPOINT ["app"] ``` Key points: - - The lint stage uses the `golangci/golangci-lint` image directly (it - includes both Go and the linter), so there is no need to install the - linter separately. - - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates - a stage dependency. BuildKit runs stages in parallel by default; without - this line, the build stage would not wait for lint to finish and a lint - failure might not fail the overall build. + - The lint phase uses the `golangci/golangci-lint` image directly (it has + both Go and the linter), so nothing needs installing. + - `COPY --from= /src/go.sum /dev/null` is a no-op copy whose only + purpose is the ordering edge. BuildKit runs stages in parallel by default, + and a stage nothing depends on is not built at all, so without these two + lines a red gate would not fail the build. + - Keep the runtime stage last, and if you add a stage after it, give it the + same two copies. A plain `docker build .` builds the last stage's chain + and nothing else. - If the project uses `//go:embed` directives that reference build artifacts - (e.g. a web frontend compiled in a separate stage), the lint stage must + (e.g. a web frontend compiled in a separate stage), the lint phase must create placeholder files so the embed directives resolve. Example: `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`. - The lint stage should not depend on the actual build output — it exists to - fail fast. - - If the project requires CGO or system libraries for linting (e.g. - `vips-dev`), install them in the lint stage with `apk add`. - - The build stage runs `make test` after compilation setup. Tests run in the - build stage, not the lint stage, because they may require compiled - artifacts or heavier dependencies. + - If the project requires CGO or system libraries for linting, install them + in the lint phase. The `golangci/golangci-lint` image is Debian-based and + has no `apk`, so install with `apt-get` under the Debian package name + (`libvips-dev`, where alpine says `vips-dev`), and delete the package + lists in the same `RUN`, so the layer does not keep them: + + ```dockerfile + RUN apt-get update \ + && apt-get install -y --no-install-recommends libvips-dev \ + && rm -rf /var/lib/apt/lists/* + ``` + + - `.dockerignore` lets `.git` into the build context. It keeps out every git + `config` at any depth (`**/.git/config`, `**/.git/modules/**/config`): the + repository's own, each submodule's under `.git/modules/`, and that of a + submodule keeping its own `.git` directory. `git describe` does not need + them, and each can hold a credential: a password in a remote URL, or the + token the CI checkout step stores there. A submodule whose name has a + `config` segment (`config`, `deploy/config`, `config/lib`) loses its whole + git directory to `**/.git/modules/**/config`, and Go's version stamping + then fails the build: give it a name without that segment + (`git submodule add --name`). The stage that compiles has `git` (the + Debian Go image has it; an alpine one needs `apk add --no-cache git`) and + takes the version from the `VERSION` build argument when one is given, + otherwise from `git describe --tags --always`. That gives the tag on a + tagged commit; on a later commit, the tag, the number of commits since it + and the short commit (`v1.2.3-4-gabc1234`); and the short commit when no + tag is reachable. The stage that compiles also marks its working directory + safe for git (`git config --system --add safe.directory /src`): a context + sent as a tar stream keeps the sender's file owners, and git refuses a + checkout owned by another user, so the version would come out empty. + `ARG VERSION` has no default, and the build fails if the context carries + `.git` and the version still comes out empty, `dev` or `unknown`. A plain + `docker build .` with no build arguments must succeed; a Dockerfile that + refuses an empty build argument drops that refusal and keeps the argument. - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that - runs `script/cibuild` (which runs `docker build .`) on push. Since the - Dockerfile already runs `make check`, a successful build implies all checks - pass. + runs `script/cibuild` on push, and checks out the repo as its only other step. + That script bootstraps, runs the gate phases, and then builds the image, so a + successful run means every check passed; a bare `docker build .` does not + carry the same guarantee, because its gate phases may come from the cache. The + image build is uncached and so runs the gate phases a second time. That is the + price of the rule above, and it is worth paying: the image that ships is built + from a run of its own gates rather than from a cache entry. A separate + workflow limited to `main` by a `branches` list under `on: push` cannot be + checked by review: to try a change to it, add the feature branch to that list + and push, then remove the branch from the list again before merging. Keep any + job in it that publishes behind `if: github.ref_name == 'main'`, so the run + from the feature branch publishes nothing. - Use platform-standard formatters: `black` for Python, `prettier` for JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with @@ -193,15 +315,17 @@ style conventions are in separate documents: suite that exceeds it fails. Under 20 seconds is the target. A suite between 20 and 60 seconds is still green, but the overage must be filed as an improvement bug against that repo. Add a 90-second timeout to the test - invocation in the Makefile (`go test -timeout 90s`). The backstop deliberately - sits above the hard cap so that it catches a genuinely hung test rather than a - merely slow one. + invocation (`go test -timeout 90s`). The backstop deliberately sits above the + hard cap so that it catches a genuinely hung test rather than a merely slow + one. -- **`make test` should use the conditional verbose rerun pattern.** Run tests - without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to - show full output. This keeps CI logs and `docker build` output clean on - success (just package/suite summaries) while providing full diagnostic detail - on failure (every test case, every assertion). The general shell pattern: +- **The test command should use the conditional verbose rerun pattern.** Run + tests without `-v` (verbose) first. If tests fail, automatically rerun with + `-v` to show full output. This keeps CI logs and `docker build` output clean + on success (just package/suite summaries) while providing full diagnostic + detail on failure (every test case, every assertion). The command lives in the + `test` phase of the `Dockerfile`, since `script/test` builds that phase; the + Makefile form below is the same pattern for any repo-local invocation: ```makefile test: @@ -214,11 +338,26 @@ style conventions are in separate documents: ```makefile test: - @go test -timeout 90s -race -cover ./... || \ + @go test -count=1 -timeout 90s -race -cover ./... || \ { echo "--- Rerunning with -v for details ---"; \ - go test -timeout 90s -race -v ./...; exit 1; } + go test -count=1 -timeout 90s -race -v ./...; exit 1; } ``` + `-count=1` is required on both invocations: it defeats Go's test _result_ + cache, so neither run can report a stored pass in place of running the + tests. It leaves the build cache alone, so it costs the runtime of the suite + and no recompilation. + + That cache is Go's own, separate from Docker's layer cache. Go stores a + passing result in its cache directory (`GOCACHE`), and when the same tests + run again on unchanged code it prints that result, marked `(cached)`, + without running them. That matters on a developer's machine, where this + target runs and the directory lasts from one run to the next. The `test` + phase of the `Dockerfile` needs no `-count=1`: its base image holds no + result for this repo's tests and nothing before its `go test` step runs a + test, so there is nothing to replay. `--no-cache` (above) is what makes that + step run on an unchanged tree. + Python example: ```makefile @@ -244,10 +383,84 @@ style conventions are in separate documents: must be in `.gitignore`. No exceptions. - `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`), - editor files (`.swp`, `*~`), language build artifacts, and `node_modules/`. - Fetch the standard `.gitignore` from - `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up - a new repo. + editor files (`.swp`, `*~`), in-repo agent scratch directories (`.claude/`), + language build artifacts, and `node_modules/`. Fetch the standard `.gitignore` + from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when + setting up a new repo. These patterns are written to `.gitignore`'s own + semantics, in which an unanchored pattern already matches at every depth; they + are not a `.dockerignore` and must not be transplanted into one unmodified. + +- **`.dockerignore` does not use `.gitignore` semantics, and copying patterns + across unmodified leaves secrets in the build context.** Docker matches with + `moby/patternmatcher`: `filepath.Match` semantics plus a `**` extension, so + `*` does not cross `/` and a pattern without a leading `**/` is anchored at + the build-context root. A `.dockerignore` listing `.env`, `*.pem` and `*.key` + therefore excludes only the copies at the repository root, while `config/.env` + and `certs/server.key` still reach the context and can land in an image layer + — which is more dangerous than a short file with no secret patterns at all, + because it reads as solved and stops anyone looking. Give every + depth-independent pattern the `**/` prefix and leave only genuinely + root-anchored entries unprefixed: `.claude`, and the repo's own host-built + binary, written `/myapp` and never `**/myapp`, which would also match + `cmd/myapp/` and delete the package directory from the context. Matching is + case-sensitive, and an ALL-CAPS twin per pattern still misses `Server.Key`, so + secret names use character ranges — `**/*.[kK][eE][yY]`, `**/*.[pP][eE][mM]`, + and likewise for `.envrc` and the extensionless SSH keys. Where such a pattern + also catches something the build needs, re-include it with a negation + (`!docs/example.env`); deleting the pattern reopens the exposure for every + other file it covers. Fetch the standard `.dockerignore` from + `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore` and extend + it with the repo's own artifacts. + +- **In-repo agent scratch belongs in both files, written to each file's own + semantics.** `.claude/` holds one worktree per in-flight agent — an entire + additional checkout of the repo — so under `COPY . .` the build context + inflates by a multiple of the repo and another session's unreviewed work can + be copied into an image layer. In `.gitignore` the entry is `.claude/`, + unanchored. In `.dockerignore` it is `.claude`, anchored and with **no** `**/` + prefix, because the prefixed form would also delete any nested directory of + that name from the build. Anchoring carries a known gap that the canonical + `.dockerignore` states in its own comment, since consuming repos receive the + file and not the tracker: the directory is created in the agent's working + directory, so a repo running agents in subdirectories still ships + `services/api/.claude/` and must add its own anchored entry there. + +- **A plain `docker build .` of a clone stamps the version that + `git describe --tags --always` gives**, derived from the `.git` in the build + context as the canonical `Dockerfile` above shows. Without its failure check, + a missing `git` or an unreadable checkout would leave `-X main.Version=` empty + and the build would still exit 0. `script/docker` and `script/cibuild` pass + the version they compute on the host; it takes precedence. They do this + byte-identically across repos: + + ```sh + # Own line: a failing command substitution inside an argument does not + # trip `set -e`, so the inline form degrades to an empty constant. + version="$(git describe --tags --always --dirty 2>/dev/null || true)" + [ -n "$version" ] || version="unknown" + docker build --no-cache \ + --build-arg VERSION="$version" \ + -t "$(script/projectname)" . + ``` + + `--always` makes an untagged repo yield an abbreviated commit hash rather + than failing, and the `[ -n "$version" ]` line is the single place the + fallback is applied — a live check that fires on a build from an export with + no `.git` and on a repository with no commits yet. Do not fold it into the + substitution as `|| echo unknown`, which makes the guard unreachable. The + Dockerfile's side is `ARG VERSION` in the stage that compiles, declared + there because `ARG` is stage-scoped; passing `VERSION` to a repo whose + Dockerfile declares no such `ARG` is ignored and costs nothing, which is why + the scripts stay byte-identical. One consequence for CI: the standard + checkout action clones shallow and fetches no tags, so a repo that embeds a + tag-derived version must set `fetch-depth: 0` on its checkout step. + +- **Verify `.dockerignore` by enumerating the image, not by reading the + patterns.** Plant files at the root _and_ at least two directories deep, build + a probe image that does `COPY . .`, and list what actually landed + (`docker run --rm --entrypoint find IMAGE /app`). The `transferring context` + size is not a substitute: a nested secret is a few bytes, and BuildKit + transfers only the delta from the previous build. - **No build artifacts in version control.** Code-derived data (compiled bundles, minified output, generated assets) must never be committed to the @@ -263,12 +476,56 @@ style conventions are in separate documents: - Make all changes on a feature branch. You can do whatever you want on a feature branch. -- `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only - manually by the user. Fetch from - `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`. The - canonical golangci-lint version is v2.12.2 (released 2026-05-06), installed - commit-pinned via - `go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5`. +- `.golangci.yml` is standardized. The vendored copy in a consuming repo must + _NEVER_ be modified by an agent: fetch it from + `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and keep it + byte-identical, so that no repo can quietly loosen its own linting. Linter + configuration changes are made to the canonical copy in the `prompts` repo and + reach consuming repos by re-vendoring; an agent may open a PR against + canonical, which only the user merges. One list is exempt from byte-identity, + because it cannot be written once for every repo: the `deny` list of the + `test-support` depguard rule, where a repo names its own test-support packages + by full import path. A repo adds entries there and changes nothing else, and a + re-vendor carries its entries forward. The canonical golangci-lint version is + v2.14.0 (released 2026-09-24), pinned as the digest of the lint phase's base + image + (`golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f`, + which reports `2.14.0 built with go1.27.0 from 114493f9`). A module's `go` + directive must not name a newer Go minor version than the one golangci-lint + was built with, or golangci-lint refuses to lint it: this release lints + `go 1.27.1` but not `go 1.28`. That digest is the only pin, since no repo + installs golangci-lint on the host. A repo sets the lint phase digest to the + one named here and re-vendors `.golangci.yml` in the same commit, whichever of + the two prompted the change: the canonical copy can name linters that an older + golangci-lint rejects, and a newer golangci-lint can add linters that + `default: all` switches on until the canonical copy disables them. + +- **`script/bootstrap` installs a pinned tool by comparing versions, never by + testing presence.** An `if ! command -v ; then install; fi` guard tests + `PATH` only, so on an already-provisioned machine the pin is inert and a + version bump is a silent no-op — while the Dockerfile, installing into a clean + image, gets the pinned version, so a local `make check` and `make docker` can + disagree about what the tool even is. The canonical form: + - compares the installed version against the pin over the **whole** version + token; a parser that stops at the first `-` reports `2.12.2` for a host + running `2.12.2-rc1` and skips the install; + - treats absent, non-zero, empty or unrecognised `--version` output as a + mismatch, so the failure direction is a redundant install and never a + skipped one; + - after installing, re-resolves the binary the way callers do — `hash -r`, + then through `PATH`, not through the directory the installer wrote to — + and fails naming the resolved path, since an install that a shadowing + binary hides succeeds while changing nothing any caller sees; + - is actually called, and prints the version on both success paths: a + function defined and never invoked has the same exit status and the same + empty output as one that worked. + + Keep it POSIX sh: no arrays, no `[[`, no `grep -P`. + + A Go tool a repo needs on the host is installed with `go install` pinned to + a commit hash (`go install @`). It is never tracked as + a `go.mod` tool dependency or through a `tools.go` file, either of which + pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`. - When pinning images or packages by hash, add a comment above the reference with the version and date (YYYY-MM-DD). @@ -382,12 +639,14 @@ style conventions are in separate documents: settings. - Avoid putting files in the repo root unless necessary. Root should contain - only project-level config files (`README.md`, `Makefile`, `Dockerfile`, - `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`, and - language-specific config). Everything else goes in a subdirectory. Canonical - subdirectory names: + only project-level config files (`README.md`, `AGENTS.md`, `Makefile`, + `Dockerfile`, `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`, + and language-specific config). Everything else goes in a subdirectory. + Canonical subdirectory names: - `bin/` — executable scripts and tools - - `cmd/` — Go command entrypoints + - `cmd/` — Go command entrypoints; thin only: one `main.go` per binary whose + body is a single call into `internal/` or `pkg/`, no project logic in + `cmd/` - `configs/` — configuration templates and examples - `deploy/` — deployment manifests (k8s, compose, terraform) - `docs/` — documentation and markdown (README.md stays in root) @@ -414,3 +673,7 @@ style conventions are in separate documents: - Go: `go.mod`, `go.sum`, `.golangci.yml` - JS: `package.json`, `yarn.lock`, `.prettierrc`, `.prettierignore` - Python: `pyproject.toml` + +- Guidance for coding agents lives in one `AGENTS.md` at the repository root. It + is never committed under a file or directory named after one agent tool, such + as `CLAUDE.md` or `.claude/`, and never split into separate memory files. diff --git a/go.mod b/go.mod index ab6e2ef..8542d5b 100644 --- a/go.mod +++ b/go.mod @@ -22,7 +22,6 @@ require ( github.com/stretchr/testify v1.11.1 go.uber.org/fx v1.24.0 golang.org/x/crypto v0.38.0 - gopkg.in/yaml.v3 v3.0.1 gorm.io/driver/sqlite v1.5.4 gorm.io/gorm v1.25.5 modernc.org/sqlite v1.28.0 @@ -59,6 +58,7 @@ require ( golang.org/x/text v0.25.0 // indirect golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect google.golang.org/protobuf v1.31.0 // indirect + gopkg.in/yaml.v3 v3.0.1 // indirect lukechampine.com/uint128 v1.2.0 // indirect modernc.org/cc/v3 v3.40.0 // indirect modernc.org/ccgo/v3 v3.16.13 // indirect diff --git a/internal/ciscript/ci_mark_superseded_test.go b/internal/ciscript/ci_mark_superseded_test.go deleted file mode 100644 index 860092f..0000000 --- a/internal/ciscript/ci_mark_superseded_test.go +++ /dev/null @@ -1,387 +0,0 @@ -package ciscript_test - -import ( - "maps" - "os" - "os/exec" - "path/filepath" - "slices" - "strings" - "testing" - - "github.com/stretchr/testify/require" - "gopkg.in/yaml.v3" -) - -const ( - // supersededDesc is the description script/ci-mark-superseded - // writes, and the one an earlier revision of it wrote alongside a - // `skipped` state. - supersededDesc = "Superseded by a newer commit; never tested" - - // liveContext is the commit-status context Gitea uses for this - // repository's runs, as seen in its API. The script derives it from - // the workflow and job names rather than hardcoding it; the - // derivation is checked against this value below. - liveContext = "check / check (push)" - - scriptPath = "../../script/ci-mark-superseded" - workflow = "../../.gitea/workflows/check.yml" - - // failure is the only state that neither folds into a combined - // `success` (as `skipped` does) nor blocks the commit forever (as - // `pending` does). - failure = "failure" -) - -// repo is a throwaway git history: parent is the commit a run would be -// cancelled on, head the commit that superseded it. -type repo struct { - dir string - head string - parent string -} - -// scriptEnv is the run identity the Gitea runner exports and the script -// builds its context string from. -type scriptEnv struct { - workflow string - job string - event string -} - -func defaultEnv() scriptEnv { - return scriptEnv{workflow: "check", job: "check", event: "push"} -} - -func cancelled() commitStatus { - return commitStatus{ - Context: liveContext, - Status: failure, - Description: "Has been cancelled", - } -} - -func running() commitStatus { - return commitStatus{ - Context: liveContext, - Status: "pending", - Description: "Has started running", - } -} - -func TestMarkSuperseded(t *testing.T) { - t.Parallel() - - cases := map[string]struct { - parent commitStatus - wantMark bool - }{ - "a cancelled run is marked": { - parent: cancelled(), - wantMark: true, - }, - "a laundered skipped status is marked": { - parent: commitStatus{ - Context: liveContext, - Status: "skipped", - Description: supersededDesc, - }, - wantMark: true, - }, - "a genuine failure is left alone": { - parent: commitStatus{ - Context: liveContext, - Status: failure, - Description: "Failing after 3m1s", - }, - wantMark: false, - }, - "a passing run is left alone": { - parent: commitStatus{ - Context: liveContext, - Status: "success", - Description: "Successful in 2m52s", - }, - wantMark: false, - }, - "another context is left alone": { - parent: commitStatus{ - Context: "other / other (push)", - Status: failure, - Description: "Has been cancelled", - }, - wantMark: false, - }, - } - - for name, tc := range cases { - t.Run(name, func(t *testing.T) { - t.Parallel() - requireTools(t) - - history := newRepo(t) - fake, api := newFakeGitea(t) - fake.setStatus(history.head, running()) - fake.setStatus(history.parent, tc.parent) - - out, err := runScript(t, history, api, defaultEnv()) - require.NoError(t, err, out) - - posted := fake.postedFor(history.parent) - if !tc.wantMark { - require.Empty(t, posted) - - return - } - - require.Equal(t, []postedStatus{{ - Context: liveContext, - // Not `skipped`: Gitea's combined status folds - // that into `success`, which is what made a - // never-tested commit read green. - State: failure, - Description: supersededDesc, - }}, posted) - }) - } -} - -// A second run must not rewrite what the first one wrote, or every -// later push would post a duplicate status. -func TestMarkSupersededIsIdempotent(t *testing.T) { - t.Parallel() - requireTools(t) - - history := newRepo(t) - fake, api := newFakeGitea(t) - fake.setStatus(history.head, running()) - fake.setStatus(history.parent, cancelled()) - - for range 2 { - out, err := runScript(t, history, api, defaultEnv()) - require.NoError(t, err, out) - } - - require.Len(t, fake.postedFor(history.parent), 1) -} - -// Renaming the workflow or the job changes the context string Gitea -// uses. The script must say so instead of quietly matching nothing. -func TestMarkSupersededRejectsAnUnknownContext(t *testing.T) { - t.Parallel() - requireTools(t) - - history := newRepo(t) - fake, api := newFakeGitea(t) - fake.setStatus(history.head, running()) - fake.setStatus(history.parent, cancelled()) - - env := defaultEnv() - env.job = "renamed" - - out, err := runScript(t, history, api, env) - require.Error(t, err) - require.Contains(t, out, "renamed") - require.Contains(t, out, liveContext) - require.Empty(t, fake.postedFor(history.parent)) -} - -// ANCESTOR_LIMIT is a documented knob. A value that is set but unusable -// must abort: handing it to git and discarding the exit status left the -// walk empty and the step green, marking nothing. -func TestMarkSupersededRejectsAnUnparseableAncestorLimit(t *testing.T) { - t.Parallel() - requireTools(t) - - history := newRepo(t) - fake, api := newFakeGitea(t) - fake.setStatus(history.head, running()) - fake.setStatus(history.parent, cancelled()) - - out, err := runScript( - t, history, api, defaultEnv(), "ANCESTOR_LIMIT=twenty", - ) - require.Error(t, err) - require.Contains(t, out, "ANCESTOR_LIMIT") - require.Contains(t, out, "twenty") - require.Empty(t, fake.postedFor(history.parent)) -} - -// A status read that fails is not the same as a commit with nothing to -// do. Losing curl's exit status through a pipe made the two identical -// and left a laundered commit laundered with no signal. -func TestMarkSupersededFailsOnAnUnreadableAncestorStatus(t *testing.T) { - t.Parallel() - requireTools(t) - - history := newRepo(t) - fake, api := newFakeGitea(t) - fake.setStatus(history.head, running()) - fake.setStatus(history.parent, cancelled()) - fake.failStatusRead(history.parent) - - out, err := runScript(t, history, api, defaultEnv()) - require.Error(t, err) - require.Contains(t, out, history.parent) - require.Contains(t, out, "cannot read commit statuses") - require.Empty(t, fake.postedFor(history.parent)) -} - -// A shallow clone cannot resolve the parent, so it is indistinguishable -// from a root commit to rev-parse and the walk would exit 0 having -// marked nothing. It must abort instead: dropping `fetch-depth: 0` from -// the checkout step is one edit, and a silent no-op there restores the -// false-green bug this script exists to prevent. -func TestMarkSupersededRejectsAShallowRepository(t *testing.T) { - t.Parallel() - requireTools(t) - - history := shallowClone(t, newRepo(t)) - fake, api := newFakeGitea(t) - fake.setStatus(history.head, running()) - fake.setStatus(history.parent, cancelled()) - - out, err := runScript(t, history, api, defaultEnv()) - require.Error(t, err) - require.Contains(t, out, "shallow repository") - require.Empty(t, fake.postedFor(history.parent)) - require.Empty(t, fake.postedFor(history.head)) -} - -// shallowClone returns the same history as a depth-1 clone. The `file://` -// URL is required: git ignores --depth for a plain local path. -func shallowClone(t *testing.T, history repo) repo { - t.Helper() - - dir := t.TempDir() - - //nolint:gosec // fixed argv, arguments are test-local paths - cmd := exec.CommandContext(t.Context(), "git", "clone", "-q", - "--depth=1", "file://"+history.dir, dir) - - out, err := cmd.CombinedOutput() - require.NoError(t, err, string(out)) - - return repo{dir: dir, head: history.head, parent: history.parent} -} - -// The derived context must equal the one Gitea actually uses, which is -// built from the same workflow and job names. -func TestDerivedContextMatchesGitea(t *testing.T) { - t.Parallel() - requireTools(t) - - name, job := workflowIdentity(t) - - history := newRepo(t) - fake, api := newFakeGitea(t) - fake.setStatus(history.head, running()) - fake.setStatus(history.parent, cancelled()) - - out, err := runScript(t, history, api, scriptEnv{ - workflow: name, - job: job, - event: "push", - }) - require.NoError(t, err, out) - - posted := fake.postedFor(history.parent) - require.Len(t, posted, 1) - require.Equal(t, liveContext, posted[0].Context) -} - -// workflowIdentity reads the workflow name and its single job id out of -// the checked-in workflow file. -func workflowIdentity(t *testing.T) (string, string) { - t.Helper() - - raw, err := os.ReadFile(workflow) - require.NoError(t, err) - - var parsed struct { - Name string `yaml:"name"` - Jobs map[string]any `yaml:"jobs"` - } - - require.NoError(t, yaml.Unmarshal(raw, &parsed)) - - jobs := slices.Collect(maps.Keys(parsed.Jobs)) - require.Len(t, jobs, 1) - - return parsed.Name, jobs[0] -} - -func runScript( - t *testing.T, history repo, api string, env scriptEnv, - extra ...string, -) (string, error) { - t.Helper() - - script, err := filepath.Abs(scriptPath) - require.NoError(t, err) - - //nolint:gosec // fixed argv, repo-local script under test - cmd := exec.CommandContext(t.Context(), "sh", script) - cmd.Dir = history.dir - cmd.Env = append(os.Environ(), - "GITHUB_API_URL="+api, - "GITHUB_REPOSITORY=sneak/webhooker", - "GITHUB_SHA="+history.head, - "GITHUB_WORKFLOW="+env.workflow, - "GITHUB_JOB="+env.job, - "GITHUB_EVENT_NAME="+env.event, - "GITEA_TOKEN=test-token", - ) - cmd.Env = append(cmd.Env, extra...) - - out, err := cmd.CombinedOutput() - - return string(out), err -} - -func newRepo(t *testing.T) repo { - t.Helper() - - dir := t.TempDir() - - git := func(args ...string) string { - //nolint:gosec // fixed argv, arguments are test constants - cmd := exec.CommandContext(t.Context(), "git", args...) - cmd.Dir = dir - - out, err := cmd.CombinedOutput() - require.NoError(t, err, string(out)) - - return strings.TrimSpace(string(out)) - } - - commit := func(message string) string { - git( - "-c", "user.email=ci@example.invalid", - "-c", "user.name=ci", - "-c", "commit.gpgsign=false", - "commit", "-q", "--allow-empty", "-m", message, - ) - - return git("rev-parse", "HEAD") - } - - git("init", "-q", "-b", "main") - - parent := commit("parent") - head := commit("head") - - return repo{dir: dir, head: head, parent: parent} -} - -func requireTools(t *testing.T) { - t.Helper() - - for _, tool := range []string{"sh", "git", "curl", "jq"} { - _, err := exec.LookPath(tool) - if err != nil { - t.Skipf("%s is not installed: %v", tool, err) - } - } -} diff --git a/internal/ciscript/doc.go b/internal/ciscript/doc.go deleted file mode 100644 index 3867bfd..0000000 --- a/internal/ciscript/doc.go +++ /dev/null @@ -1,10 +0,0 @@ -// Package ciscript holds the tests for the repository's CI shell -// scripts in script/. It carries no runtime code: the scripts run on -// the CI runner, not inside the binary, but their behaviour still has -// to be verified by the test suite. -// -// The scripts under test are outside the Go build graph, so `go test`'s -// result cache serves a stale PASS when only a script changed: run the -// container build, or GOFLAGS=-count=1, to trust a result here after -// editing script/. -package ciscript diff --git a/internal/ciscript/fakegitea_test.go b/internal/ciscript/fakegitea_test.go deleted file mode 100644 index a3a38e1..0000000 --- a/internal/ciscript/fakegitea_test.go +++ /dev/null @@ -1,162 +0,0 @@ -package ciscript_test - -import ( - "encoding/json" - "net/http" - "net/http/httptest" - "sync" - "testing" -) - -// commitStatus is the part of an entry in Gitea's combined-status -// response that script/ci-mark-superseded reads. -type commitStatus struct { - Context string `json:"context"` - Status string `json:"status"` - Description string `json:"description"` -} - -// postedStatus is the part of a create-status request body the script -// writes. -type postedStatus struct { - Context string `json:"context"` - State string `json:"state"` - Description string `json:"description"` -} - -// fakeGitea serves the two endpoints the script talks to. Like Gitea, -// the newest status for a context replaces the previous one, so a -// second run of the script sees what the first one wrote. -type fakeGitea struct { - mu sync.Mutex - statuses map[string][]commitStatus - posted map[string][]postedStatus - // failRead is a commit whose combined-status read answers HTTP - // 500, standing in for a status API that is down. - failRead string -} - -// newFakeGitea returns the fake and the base URL to hand the script as -// GITHUB_API_URL. -func newFakeGitea(t *testing.T) (*fakeGitea, string) { - t.Helper() - - fake := &fakeGitea{ - mu: sync.Mutex{}, - statuses: map[string][]commitStatus{}, - posted: map[string][]postedStatus{}, - failRead: "", - } - - srv := httptest.NewServer(fake.routes()) - t.Cleanup(srv.Close) - - return fake, srv.URL -} - -func (f *fakeGitea) routes() http.Handler { - mux := http.NewServeMux() - - mux.HandleFunc( - "GET /repos/{owner}/{repo}/commits/{sha}/status", - f.handleCombined, - ) - mux.HandleFunc( - "POST /repos/{owner}/{repo}/statuses/{sha}", - f.handleCreate, - ) - - return mux -} - -func (f *fakeGitea) handleCombined( - w http.ResponseWriter, r *http.Request, -) { - f.mu.Lock() - defer f.mu.Unlock() - - sha := r.PathValue("sha") - if f.failRead != "" && f.failRead == sha { - http.Error(w, "boom", http.StatusInternalServerError) - - return - } - - body := struct { - Statuses []commitStatus `json:"statuses"` - }{Statuses: f.statuses[sha]} - - payload, err := json.Marshal(body) - if err != nil { - http.Error(w, err.Error(), http.StatusInternalServerError) - - return - } - - w.Header().Set("Content-Type", "application/json") - - _, _ = w.Write(payload) -} - -func (f *fakeGitea) handleCreate(w http.ResponseWriter, r *http.Request) { - var got postedStatus - - err := json.NewDecoder(r.Body).Decode(&got) - if err != nil { - http.Error(w, err.Error(), http.StatusBadRequest) - - return - } - - sha := r.PathValue("sha") - - f.mu.Lock() - defer f.mu.Unlock() - - f.posted[sha] = append(f.posted[sha], got) - f.replaceLocked(sha, commitStatus{ - Context: got.Context, - Status: got.State, - Description: got.Description, - }) - - w.WriteHeader(http.StatusCreated) -} - -// failStatusRead makes the combined-status read for one commit answer -// HTTP 500. -func (f *fakeGitea) failStatusRead(sha string) { - f.mu.Lock() - defer f.mu.Unlock() - - f.failRead = sha -} - -// setStatus gives a commit its latest status for a context. -func (f *fakeGitea) setStatus(sha string, status commitStatus) { - f.mu.Lock() - defer f.mu.Unlock() - - f.replaceLocked(sha, status) -} - -// postedFor returns the statuses the script created for a commit. -func (f *fakeGitea) postedFor(sha string) []postedStatus { - f.mu.Lock() - defer f.mu.Unlock() - - return append([]postedStatus(nil), f.posted[sha]...) -} - -// replaceLocked requires f.mu. -func (f *fakeGitea) replaceLocked(sha string, status commitStatus) { - for i, existing := range f.statuses[sha] { - if existing.Context == status.Context { - f.statuses[sha][i] = status - - return - } - } - - f.statuses[sha] = append(f.statuses[sha], status) -} diff --git a/internal/middleware/loginguard_test.go b/internal/middleware/loginguard_test.go index fb2ac0c..faca060 100644 --- a/internal/middleware/loginguard_test.go +++ b/internal/middleware/loginguard_test.go @@ -236,9 +236,9 @@ func TestLoginGuard_SemaphoreBoundsConcurrentVerifications( // rendezvousDeadlock is the deadlock guard described below. // It is orders of magnitude longer than any scheduling delay, - // so it never decides the result, and well inside script/test's - // 30s timeout, so a wedge fails on the assertion instead of - // blowing the package timeout. + // so it never decides the result, and well inside the 90s + // package timeout of the Dockerfile's test phase, so a wedge + // fails on the assertion instead of blowing that timeout. rendezvousDeadlock = 5 * time.Second ) diff --git a/script/assets b/script/assets index 54e4185..55099d7 100755 --- a/script/assets +++ b/script/assets @@ -2,8 +2,8 @@ # script/assets: extract Alpine.js from its npm package tarball, committed # in 3p/, to static/js/alpine.min.js, where go:embed reads it. The package # is @alpinejs/csp, Alpine's build for pages whose Content-Security-Policy -# forbids eval. The extracted file is not committed. script/test, make -# build and make dev run this first. +# forbids eval. The extracted file is not committed. make build, make dev +# and the Dockerfile's lint, test and build stages run this first. set -eu ROOT="$(cd "$(dirname "$0")/.." && pwd -P)" diff --git a/script/bootstrap b/script/bootstrap index bdd28d9..b7db190 100755 --- a/script/bootstrap +++ b/script/bootstrap @@ -60,10 +60,10 @@ main() { if missing go; then pkg_install go golang go go; fi # Not installed here: docker is platform-specific and out of scope for a - # package-manager bootstrap, but script/lint, script/fmt and script/css - # need it. + # package-manager bootstrap, but script/test, script/lint, script/fmt and + # script/css need it. if missing docker; then - echo "bootstrap: docker not found; script/lint, script/fmt and script/css require it" >&2 + echo "bootstrap: docker not found; script/test, script/lint, script/fmt and script/css require it" >&2 fi go mod download diff --git a/script/check b/script/check index 6ce8351..118f59c 100755 --- a/script/check +++ b/script/check @@ -1,7 +1,7 @@ #!/bin/sh # script/check: run all checks (test, lint, fmt-check, css-check). Our own -# extension to scripts-to-rule-them-all. -# Writes only the ignored static/js/alpine.min.js, through script/test. +# extension to scripts-to-rule-them-all. test, lint and css-check are +# Docker builds; fmt-check runs gofmt on the host. Writes nothing. # Generic, apart from css-check. set -eu diff --git a/script/ci-mark-superseded b/script/ci-mark-superseded deleted file mode 100755 index 4ed52cf..0000000 --- a/script/ci-mark-superseded +++ /dev/null @@ -1,152 +0,0 @@ -#!/bin/sh -# script/ci-mark-superseded: record an honest status on commits whose CI -# run Gitea cancelled because a newer commit landed on the same branch. -# Gitea writes `failure` / "Has been cancelled" for such a run, which -# reads as a test result on a commit nothing ever tested. Cancellation is -# unconditional server-side for push events, so the superseding run -# rewrites those statuses to `failure` with a description that says the -# commit was never tested. `skipped` cannot be used: Gitea's combined -# status folds `skipped` into `success`, so a never-tested commit would -# report green. Genuine failures and successes are never touched. -# -# Called by the Gitea Actions workflow, which supplies GITHUB_API_URL, -# GITHUB_REPOSITORY, GITHUB_SHA, GITHUB_WORKFLOW, GITHUB_JOB, -# GITHUB_EVENT_NAME and GITEA_TOKEN. ANCESTOR_LIMIT (default 20) caps how -# far back the walk looks; a value that is set but not a positive integer -# aborts rather than silently disabling the walk. -set -eu - -SUPERSEDED_DESC='Superseded by a newer commit; never tested' - -# Gitea builds the commit-status context as -# " / ()", so derive it rather than -# hardcoding the result. -# -# The derivation is deliberately not byte-exact with Gitea's own rule and -# must not be "fixed" into a silent fallback. Gitea uses the job's `name:` -# (falling back to the job id) and the workflow's `name:` (falling back to -# the workflow filename), while the runner exports GITHUB_JOB as the job -# *id* and GITHUB_WORKFLOW as the parsed workflow `name:`. So giving the -# job a display `name:`, or dropping the workflow's `name:`, makes the -# derived context stop matching --- and require_own_context below then -# turns every push red with a message. That loud failure is the point -# (https://git.eeqj.de/sneak/webhooker/issues/147 item 2); guessing at a -# fallback would restore the silent no-op it replaced. -context() { - printf '%s / %s (%s)' \ - "$GITHUB_WORKFLOW" "$GITHUB_JOB" "$GITHUB_EVENT_NAME" -} - -# ANCESTOR_LIMIT is a documented knob, so a value that is set but -# unusable must fail loudly instead of defaulting -# (https://git.eeqj.de/sneak/webhooker/issues/80). Passing it straight to -# git would print `fatal: not an integer` into a discarded exit status -# and mark nothing. -ancestor_limit() { - # `-` and not `:-`: an explicitly empty value is set-but-unusable - # config, so it aborts like any other bad value rather than silently - # running at the default. - _limit="${ANCESTOR_LIMIT-20}" - case "$_limit" in - '' | *[!0-9]* | 0*) - echo "ANCESTOR_LIMIT must be a positive integer," \ - "got '${_limit}'" >&2 - - return 1 - ;; - esac - printf '%s' "$_limit" -} - -# The status Gitea created for this very job proves which context string -# it uses. If the derived one is missing, the workflow or the job was -# renamed and the match below would silently stop firing, restoring the -# false-red bug with no signal. Fail loudly instead. -require_own_context() { - if ! _body="$(curl -sf --retry 3 --retry-delay 2 --max-time 30 \ - "${1}/commits/${GITHUB_SHA}/status")"; then - echo "cannot read commit statuses for ${GITHUB_SHA}" >&2 - return 1 - fi - _found="$(printf '%s' "$_body" | jq -r '(.statuses // [])[].context')" - if printf '%s\n' "$_found" | grep -qxF "$2"; then - return 0 - fi - echo "no commit status with context '${2}' on ${GITHUB_SHA}:" >&2 - echo "workflow or job renamed? contexts present:" >&2 - printf '%s\n' "$_found" >&2 - return 1 -} - -# Latest status for our context on a commit, as "state|description". -# The read is retried and bounded, and a read that still fails aborts the -# step: a laundered commit that cannot be read is not the same as one -# with nothing to do, and piping curl into jq would discard the -# difference. -status_of() { - if ! _sbody="$(curl -sf --retry 3 --retry-delay 2 --max-time 30 \ - "${1}/commits/${2}/status")"; then - echo "cannot read commit statuses for ${2}" >&2 - - return 1 - fi - printf '%s' "$_sbody" | jq -r --arg c "$3" \ - '[(.statuses // [])[] | select(.context == $c)][0] // empty - | "\(.status)|\(.description)"' -} - -mark_superseded() { - curl -sf -X POST "${1}/statuses/${2}" \ - -H "Authorization: token ${GITEA_TOKEN}" \ - -H 'Content-Type: application/json' \ - -d "$(jq -nc --arg c "$3" --arg d "$SUPERSEDED_DESC" \ - '{context: $c, state: "failure", description: $d}')" \ - >/dev/null -} - -main() { - _api="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}" - _ctx="$(context)" - - _limit="$(ancestor_limit)" - - require_own_context "$_api" "$_ctx" - - # A shallow clone cannot resolve the parent, so it looks exactly like - # a root commit to rev-parse below and would exit 0 having walked - # nothing (or, at depth > 1, only the ancestors that happen to be - # present). The workflow checks out with `fetch-depth: 0`; verify - # that here rather than depend on it silently. - if [ "$(git rev-parse --is-shallow-repository)" = 'true' ]; then - echo "shallow repository: the ancestor walk needs full history" >&2 - - return 1 - fi - - # A root commit legitimately has no ancestors and is not an error. - # A SHA this repository does not have lands here too, since its - # parent is equally unresolvable, but require_own_context above has - # already aborted on the 404 for it. The walk itself carries no - # `|| true`, so a rev-list failure aborts. - if ! git rev-parse -q --verify "${GITHUB_SHA}^" >/dev/null; then - echo "no ancestor of ${GITHUB_SHA} to check" - - return 0 - fi - - _walk="$(git rev-list --max-count="$_limit" "${GITHUB_SHA}^")" - - for _sha in $_walk; do - _latest="$(status_of "$_api" "$_sha" "$_ctx")" - # A run that was cancelled, or one an earlier revision of this - # script laundered into `skipped`. Anything else stands. - case "$_latest" in - 'failure|Has been cancelled' | "skipped|${SUPERSEDED_DESC}") ;; - *) continue ;; - esac - mark_superseded "$_api" "$_sha" "$_ctx" - echo "marked superseded: ${_sha}" - done -} - -main "$@" diff --git a/script/cibuild b/script/cibuild index ae14eec..d8d3200 100755 --- a/script/cibuild +++ b/script/cibuild @@ -1,15 +1,28 @@ #!/bin/sh -# script/cibuild: run the CI build. The Dockerfile runs the checks (the -# gofmt check, golangci-lint, the stylesheet check, ESLint, the Markdown -# check, make test), so a successful build implies a green repo. Generic: -# needs no adaptation. The Gitea workflow runs this on push. +# script/cibuild: run the CI build. It bootstraps first: a CI runner +# checks out and runs this and nothing else, and script/fmt-check runs +# the formatter on the host, which a pristine checkout cannot do. +# --no-cache for the same reason as script/docker: the gate phases the +# final stage depends on are RUN steps, and a cached one is a check that +# did not run. set -eu -ROOT="$(cd "$(dirname "$0")/.." && pwd -P)" +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)" +ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)" main() { cd "$ROOT" - docker build . + "$SCRIPT_DIR/bootstrap" + "$SCRIPT_DIR/check" + # Own line: a failing command substitution inside an argument does + # not trip `set -e`, so the inline form degrades silently to an + # empty constant. The VERSION build argument takes precedence over + # the version a build stage derives from the .git in the context. + version="$(git describe --tags --always --dirty 2>/dev/null || true)" + [ -n "$version" ] || version="unknown" + docker build --no-cache \ + --build-arg VERSION="$version" \ + -t "$("$SCRIPT_DIR/projectname")" . } main "$@" diff --git a/script/css b/script/css index 48117df..eee38cd 100755 --- a/script/css +++ b/script/css @@ -2,14 +2,16 @@ # script/css: regenerate static/css/tailwind.css (writes). tailwindcss is # never installed locally: it runs in docker, at the version and sha256 # pinned in the Dockerfile's stylesheet stages, which also say what the -# stylesheet is generated from. +# stylesheet is generated from. --no-cache, as on every docker build in +# script/, so the stylesheet is generated rather than taken from the cache. set -eu ROOT="$(cd "$(dirname "$0")/.." && pwd -P)" main() { cd "$ROOT" - docker build --target css-output --output type=local,dest=static/css . + docker build --no-cache \ + --target css-output --output type=local,dest=static/css . } main "$@" diff --git a/script/css-check b/script/css-check index 3b80f63..15469f5 100755 --- a/script/css-check +++ b/script/css-check @@ -1,14 +1,15 @@ #!/bin/sh # script/css-check: fail when static/css/tailwind.css differs from what # script/css would generate (read-only). The comparison is the Dockerfile's -# css-check stage, which the image build runs too. +# css-check stage, which the image build runs too. --no-cache because a +# cached check is a check that did not run. set -eu ROOT="$(cd "$(dirname "$0")/.." && pwd -P)" main() { cd "$ROOT" - docker build --target css-check --output type=cacheonly . + docker build --no-cache --target css-check --output type=cacheonly . } main "$@" diff --git a/script/docker b/script/docker index ba8a836..07b626c 100755 --- a/script/docker +++ b/script/docker @@ -1,10 +1,8 @@ #!/bin/sh # script/docker: build the Docker image tagged with the project name. -# The tag comes from script/projectname. -# -# The version script/version resolves here goes in as the VERSION build -# arg, which takes precedence over what the build would derive from the -# .git in its context. +# Identical in all repos; the tag comes from script/projectname. +# --no-cache because the gate phases the final stage depends on are RUN +# steps, and a cached one is a check that did not run. set -eu SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)" @@ -12,8 +10,14 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)" main() { cd "$ROOT" - docker build \ - --build-arg VERSION="$("$SCRIPT_DIR/version")" \ + # Own line: a failing command substitution inside an argument does + # not trip `set -e`, so the inline form degrades silently to an + # empty constant. The VERSION build argument takes precedence over + # the version a build stage derives from the .git in the context. + version="$(git describe --tags --always --dirty 2>/dev/null || true)" + [ -n "$version" ] || version="unknown" + docker build --no-cache \ + --build-arg VERSION="$version" \ -t "$("$SCRIPT_DIR/projectname")" . } diff --git a/script/fmt b/script/fmt index 450cce6..488082f 100755 --- a/script/fmt +++ b/script/fmt @@ -1,7 +1,8 @@ #!/bin/sh # script/fmt: format all files (writes): the Go code with gofmt and # goimports, the Markdown with prettier. prettier is never installed -# locally: it runs in docker, in the Dockerfile's Markdown stages. +# locally: it runs in docker, in the Dockerfile's Markdown stages, built +# with --no-cache like every docker build in script/. set -eu ROOT="$(cd "$(dirname "$0")/.." && pwd -P)" @@ -12,7 +13,8 @@ main() { if command -v goimports >/dev/null 2>&1; then goimports -w . fi - docker build --target markdown-output --output type=local,dest=. . + docker build --no-cache \ + --target markdown-output --output type=local,dest=. . } main "$@" diff --git a/script/fmt-check b/script/fmt-check index 1a0fa50..5cc6684 100755 --- a/script/fmt-check +++ b/script/fmt-check @@ -1,6 +1,7 @@ #!/bin/sh # script/fmt-check: check formatting (read-only). Same scope as -# script/fmt, but fails instead of writing. +# script/fmt, but fails instead of writing. --no-cache because a cached +# check is a check that did not run. set -eu ROOT="$(cd "$(dirname "$0")/.." && pwd -P)" @@ -12,7 +13,7 @@ main() { gofmt -s -l . exit 1 fi - docker build --target markdown-check --output type=cacheonly . + docker build --no-cache --target markdown-check --output type=cacheonly . } main "$@" diff --git a/script/lint b/script/lint index f5d46f8..2d8b075 100755 --- a/script/lint +++ b/script/lint @@ -1,71 +1,23 @@ #!/bin/sh -# script/lint: run the linters, golangci-lint over the Go code and then -# ESLint over static/js/. Neither is ever installed locally. +# script/lint: run the linter. Linting is a phase of the Dockerfile and +# this builds that phase alone; the linter is never installed or run on +# a developer host, where a shared result cache and a host-global lock +# make its answer untrustworthy. # -# golangci-lint runs via docker only, one way, everywhere — script/lint builds -# Dockerfile.lint, which COPYs the repo into the pinned golangci-lint image -# and lints as a build step. This works even when the docker daemon is remote -# and bind mounts are impossible, and it removes the host linter's shared -# cache, which has attributed other checkouts' findings to this one. -# -# --no-cache-filter=lint forces the lint stage to re-execute on every run; a -# cached lint stage exits 0 in under a second having linted nothing. The deps -# stage keeps its cache, so module downloads are not repeated. -# --progress=plain keeps the linter's own output visible on success, so a -# passing run shows the issue count rather than nothing. -# --output=type=cacheonly leaves no image behind to clean up. -# -# docker silently ignores --no-cache-filter for a stage name that does not -# match, so a rename or a typo would restore the cached false green with no -# warning and a fast exit 0. The flag is therefore not trusted: the build -# output is teed to a log and a run is only a pass if golangci-lint's own -# summary line ("N issues." / "N issues:") is in it. No summary, no lint, -# whatever the exit code says. +# The phase is not the last stage in the file, so it is built only when +# --target names it. --no-cache because a cached lint layer is a lint +# that did not run. The tag makes each build replace the previous image +# instead of leaving a dangling one behind. set -eu -ROOT="$(cd "$(dirname "$0")/.." && pwd -P)" +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)" +ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)" main() { cd "$ROOT" - - log="$(mktemp -t webhooker-lint.XXXXXXXX)" - rcfile="$(mktemp -t webhooker-lint-rc.XXXXXXXX)" - trap 'rm -f "$log" "$rcfile"' EXIT INT TERM - - # The pipeline's status is tee's, and POSIX sh has no pipefail, so the - # build's status travels via a file. Output still streams live. - { - docker build \ - -f Dockerfile.lint \ - --no-cache-filter=lint \ - --progress=plain \ - --output=type=cacheonly \ - . 2>&1 && echo 0 >"$rcfile" || echo $? >"$rcfile" - } | tee "$log" >&2 - - rc="$(cat "$rcfile")" - [ "$rc" -eq 0 ] || exit "$rc" - - if ! grep -qE '[0-9]+ issues[.:]' "$log"; then - echo "script/lint: golangci-lint printed no summary line; the linter" >&2 - echo " did not run. Check that the stage named in --no-cache-filter" >&2 - echo " still matches a stage in Dockerfile.lint." >&2 - exit 1 - fi - - # ESLint runs in the Dockerfile's js-lint stage, which the image build - # runs too. It prints nothing on a pass, so there is no summary to look - # for. Instead the stage is named once, for both flags: --target fails - # on a name that matches no stage, so a rename cannot leave - # --no-cache-filter silently ignored. The js-deps stage, which installs - # ESLint, keeps its cache, so ESLint is not downloaded again. - js_stage=js-lint - docker build \ - --target "$js_stage" \ - --no-cache-filter="$js_stage" \ - --progress=plain \ - --output=type=cacheonly \ - . + docker build --no-cache \ + --target lint \ + -t "$("$SCRIPT_DIR/projectname")-lint" . } main "$@" diff --git a/script/test b/script/test index 9ba4a8c..cd239f2 100755 --- a/script/test +++ b/script/test @@ -1,84 +1,19 @@ #!/bin/sh -# script/test: run the test suite. -# -# -timeout is applied by `go test` per package, not to the run as a whole, so -# it only has to clear the slowest single package. When this budget was set -# that was internal/handlers, measured in a cache-defeated builder stage on the -# 48-core shared build host (2026-08-18); load- and host-dependent, not -# invariants: -# -# 16.9s host load 5-20, GOMAXPROCS 48 -# 45.9s / 47.3s / 49.0s three runs at deliberate host load 31-73 -# 30.6s / 39.7s host load 5-20, GOMAXPROCS 6 / 4 -# 67.3s / 97.5s host load 5-20, GOMAXPROCS 2 / 1 -# 67.3s GOMAXPROCS 4 at deliberate host load 52-68 -# -# The old 30s budget was breached by every loaded run and by every GOMAXPROCS -# at or below 6; at GOMAXPROCS 4 it failed outright ("panic: test timed out -# after 30s"), reproduced on 33e4fa4 with no other change. -# -# 90s matches the org-wide backstop in REPO_POLICIES.md and is sized here -# against the figures above: the worst case under native parallelism is 49.0s, -# and the compound GOMAXPROCS-4-under-load case at 67.3s sits at 75% of it. -# The one figure above 90s is GOMAXPROCS 1, a synthetic core floor rather than -# a condition CI runs under. If a CPU-limited runner ever puts a real run near -# 67s, that is the datum to revisit the org figure with. -# -# Those figures predate tests hashing the admin password at 1 MB instead of -# 64 MB (https://git.eeqj.de/sneak/webhooker/pulls/404). After that change, in -# a cache-defeated build at host load 44-109 (2026-10-02), internal/handlers -# took 8.5s and the slowest package was internal/database at 15.8s. Once its -# retention tests seeded 50 rows per insert instead of 500 -# (https://git.eeqj.de/sneak/webhooker/issues/198), internal/database took -# 7.3s and the slowest package was internal/handlers at 8.1s to 10.0s, at host -# load 25-48 (2026-10-02). -# -# -p 4 -parallel 8 keep the run under 2 GB of memory: at most four test -# binaries build or run at once, each with at most eight parallel tests. Under -# -race every test binary and every link costs a few hundred MB, so the -# defaults (one per core) add up to several GB on a many-core host. -# -# The first run has no -v: go test then prints one result line per package, -# with its coverage, and for a package that fails, everything its tests wrote, -# application log lines included. Verbose output from the whole suite passes -# the 2 MiB at which the Docker build cuts off each step's log, so on a failure -# only the tests that failed run again, with -v. The script exits 1 after that -# rerun whatever its result: the first run already showed the suite is broken. +# script/test: run the test suite. Testing is a phase of the Dockerfile +# and this builds that phase alone, on the same terms as script/lint: +# --target because a phase that is not the last stage is built only when +# named, --no-cache because a cached test layer is a test that did not +# run, and a tag so each build replaces the previous image. set -eu -ROOT="$(cd "$(dirname "$0")/.." && pwd -P)" +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)" +ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)" main() { cd "$ROOT" - "$ROOT/script/assets" - - log="$(mktemp -t webhooker-test.XXXXXXXX)" - rcfile="$(mktemp -t webhooker-test-rc.XXXXXXXX)" - trap 'rm -f "$log" "$rcfile"' EXIT INT TERM - - # The pipeline's status is tee's, and POSIX sh has no pipefail, so go - # test's status travels via a file. Output still streams live. - { - go test -race -cover -p 4 -parallel 8 -timeout 90s ./... 2>&1 \ - && echo 0 >"$rcfile" || echo $? >"$rcfile" - } | tee "$log" - if [ "$(cat "$rcfile")" -eq 0 ]; then - return - fi - - # go test reports a failed test as a line starting "--- FAIL: TestName" - # (a failed subtest's line is indented, and reruns with its parent), and - # a failed package as "FAILpackage/path...". A failure that - # names no test, such as a build error or a timeout, is already shown in - # full above, so there is nothing to rerun. - tests="$(awk '/^--- FAIL: / { print $3 }' "$log" | paste -s -d '|' -)" - packages="$(awk '/^FAIL\t/ { print $2 }' "$log")" - if [ -n "$tests" ]; then - echo "--- Rerunning the failed tests with -v for details ---" - go test -race -v -p 4 -parallel 8 -timeout 90s \ - -run "^($tests)\$" $packages || true - fi - exit 1 + docker build --no-cache \ + --target test \ + -t "$("$SCRIPT_DIR/projectname")-test" . } main "$@" diff --git a/script/test-browser b/script/test-browser index 08bb621..cde17f4 100755 --- a/script/test-browser +++ b/script/test-browser @@ -3,8 +3,7 @@ # Docker: Dockerfile.browser builds the test and runs it in a digest-pinned # headless browser image, so the host needs no browser. # -# --no-cache-filter=browser runs the test again even when nothing changed; -# it must name the stage in Dockerfile.browser that runs it. +# --no-cache because a cached test layer is a test that did not run. # --output=type=cacheonly leaves no image behind to clean up. set -eu @@ -14,7 +13,7 @@ main() { cd "$ROOT" docker build \ -f Dockerfile.browser \ - --no-cache-filter=browser \ + --no-cache \ --progress=plain \ --output=type=cacheonly \ . diff --git a/script/version b/script/version index 9fbce61..1fe8092 100755 --- a/script/version +++ b/script/version @@ -1,9 +1,11 @@ #!/bin/sh # script/version: output the version string the binary is stamped with. # Our own extension to scripts-to-rule-them-all. The Makefile's build -# target and script/docker both take the value from here, so a `make -# build` binary and a `make docker` image built from the same checkout -# report the same thing. +# and version targets take the value from here, and the Dockerfile's +# build stage calls them. script/docker and script/cibuild run the same +# `git describe` on the host and pass the result in as $VERSION, so a +# `make build` binary and a `make docker` image built from the same +# checkout report the same thing. # # Order of precedence: #