4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	992b3c68f5	Run all linting in Docker via Dockerfile.lint (closes #109) ... golangci-lint no longer runs on the host. script/lint builds Dockerfile.lint, which copies the repo into the digest-pinned linter image, so the container holds only this repo and the cross-worktree cache contamination of #106 becomes structurally impossible rather than filtered after the fact. Five workers hit that contamination in one evening, in both directions. Three properties are load-bearing. --no-cache-filter=lint forces the lint stage to re-execute while deps keeps its cache, because a cached build lints nothing in 0.27s and exits 0. script/lint does not trust that flag, since Docker silently ignores an unmatched stage name: it asserts golangci-lint's own summary line appears, so no summary means no lint whatever the exit code says. And both lint steps run --network=none, which enforces rather than assumes that config verify does not fetch its schema — verify is kept, because golangci-lint run silently ignores unrecognized config keys and it is the only thing that catches a typo that disables a setting. Independently reviewed four times. Three passed the behaviour; the remaining rounds were a README merge against #151, whose premise was that the file contains no false statements. Six statements this change falsified were found and corrected across those rounds — the last reviewer re-derived every countable claim against the tree rather than reading for plausibility, and found no seventh. Supersedes #106.	2026-08-18 01:07:16 +02:00
clawbot	c378690977	Fetch and verify Alpine at build time instead of committing it (closes #145) ... static/js/alpine.min.js was a committed minified bundle, which REPO_POLICIES forbids, referenced by no content hash at all. A minified blob is unreviewable, which is the shape a supply-chain compromise takes. script/fetch-assets now downloads Alpine 3.14.9 from the npm registry and verifies sha256 on both the tarball and the extracted file, and static/vendor_test.go re-hashes the bytes go:embed actually placed in the binary. The shipped bytes are byte-identical to the blob that was committed, so the served asset does not change. Independently reviewed. Five negative controls reproduced by the reviewer: flipped expected hash, repointed URL, post-fetch tampering, asset absent, and manifest inconsistencies — each fails closed with static/js/ left clean. Registry hashes confirmed against the pins, and the runtime image was built, run and curled to confirm the asset is still served and the login page still loads it. Known gap, filed separately: static/static.go embeds the js directory rather than named files, so a missing fetched asset is not a compile error on ungated local build paths. Every gated path fails loudly, so the release artifact is unaffected.	2026-08-17 23:12:17 +02:00
clawbotandsneak	734606b7af	Update golangci-lint to v2.12.2 with canonical config (#86) ... Bumps golangci-lint from v2.11.3 to v2.12.2 and adopts the canonical lint config. ## Version pins - `Dockerfile`: `golangci/golangci-lint:v2.12.2` Debian image, pinned by digest, dated `2026-08-07` - `script/bootstrap`: `GOLANGCI_LINT_VERSION=2.12.2` with updated sha256 pins for the `linux-amd64` and `linux-arm64` release archives ## Config `.golangci.yml` replaced with the canonical config. The previous file kept `lll`/`funlen`/`cyclop`/`dupl` settings under the top-level `linters-settings` key, which the v2 schema ignores; the canonical config nests them under `linters.settings`, so those thresholds now actually apply. The unsupported `issues.exclude-use-default` key was dropped. ## Lint fixes (32 findings) - `lll` (7): wrapped or shortened over-length lines (struct tag comments moved above fields, test logger construction split, `session.NewForTest` signature wrapped, shortened a `#nosec` comment) - `goconst` (17): replaced repeated `"POST"`/`"PUT"` literals with `http.MethodPost`/`http.MethodPut`, added shared test constants for `webhooker-test`/`test`/`application/json`, and added `tmplKeyError`/`tmplKeyWebhook` constants for template data keys in `internal/handlers` - `dupl` (8): merged `buildHTTPTargetConfig` and `buildSlackTargetConfig` into a parameterized `buildURLTargetConfig`; removed the duplicate `iWebhookDB` test helper in favor of `testWebhookDB`; extracted shared helpers in middleware and session tests No `//nolint` directives were added and behavior is unchanged. `make check` (fmt-check, tests, lint) passes. Note: golangci-lint v2.12 deprecates the `gomodguard` linter in favor of `gomodguard_v2`; the canonical config change for that is left for a future coordinated update. Co-authored-by: sneak <sneak@sneak.berlin> Reviewed-on: #86 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-08-07 23:18:49 +02:00
sneak	2cc8723997	scripts-to-rule-them-all (#59) ... Reviewed-on: #59 Co-authored-by: sneak <sneak@sneak.berlin> Co-committed-by: sneak <sneak@sneak.berlin>	2026-07-07 02:14:09 +02:00