Commit the Alpine.js tarball in 3p/ and extract it at build time (closes #345)

The build no longer downloads Alpine.js. Its npm package tarball is
committed as 3p/alpinejs-3.14.9.tgz; its sha256 matches the value
script/fetch-assets pinned, and the cdn.min.js inside it matches the
value static/vendor.sha256 pinned.

make assets extracts package/dist/cdn.min.js to the ignored
static/js/alpine.min.js. make test, check, build and dev run it first,
and the Dockerfile builds through make test and make build.
script/fetch-assets, its Dockerfile step, static/vendor.sha256 and
static/vendor_test.go are removed, along with bootstrap's curl install.

Model: opus-5-5

Dockerfile

@@ -51,7 +51,7 @@ RUN go mod download
 # the lint stage above.
 COPY . .
 
-# Run tests and build. Both first run script/assets, which extracts Alpine.js
+# Run tests and build. Both first run `make assets`, which extracts Alpine.js
 # from its tarball in 3p/.
 RUN make test
 

Makefile

@@ -27,10 +27,13 @@ bootstrap:
 setup:
 	@script/setup
 
+# Alpine.js is committed as its npm package tarball in 3p/. This extracts
+# the browser build from it to where go:embed reads it; the extracted file
+# is not committed.
 assets:
-	@script/assets
+	tar -xzOf 3p/alpinejs-3.14.9.tgz package/dist/cdn.min.js >static/js/alpine.min.js
 
-test:
+test: assets
 	@script/test
 
 lint:
@@ -42,7 +45,7 @@ fmt:
 fmt-check:
 	@script/fmt-check
 
-check:
+check: assets
 	@script/check
 
 build: assets

README.md

@@ -1247,16 +1247,16 @@ What that means for an operator:
 This repository adheres to the
 [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
 standard: normalized scripts in `script/` are the entrypoints for the
-development workflow. Ten of the Makefile's seventeen targets are thin
+development workflow. Nine of the Makefile's seventeen targets are thin
-shims that call them; `build`, `run`, `dev`, `deps`, `clean`, `css` and
+shims that call them; `assets`, `build`, `run`, `dev`, `deps`, `clean`,
-`version` are inline commands with no script behind them, though `build`
+`css` and `version` are inline commands with no script behind them,
-and `version` both take their value from `script/version`.
+though `build` and `version` both take their value from
+`script/version`.
 
-`script/test`, `make build` and `make dev` each run `script/assets`
+`make test`, `make check`, `make build` and `make dev` each run
-first, which writes the ignored `static/js/alpine.min.js` (see
+`make assets` first, which writes the ignored `static/js/alpine.min.js`
-[Third-party browser assets](#third-party-browser-assets)), so
+(see [Third-party browser assets](#third-party-browser-assets)), so
-`make test`, `make check` and the pre-commit hook work on a fresh clone
+`make check` works on a fresh clone without a separate setup step.
-without a separate step.
 
 We provide:
 
@@ -1264,8 +1264,6 @@ We provide:
 - `script/setup` — make a fresh clone ready for development
   (bootstrap, then install-precommit)
 - `script/projectname` — output the project name ("webhooker")
-- `script/assets` — extract Alpine.js from its tarball in `3p/` (see
-  [Third-party browser assets](#third-party-browser-assets))
 - `script/test` — run the test suite
 - `script/lint` — run golangci-lint in Docker (see Linting below)
 - `script/fmt` — format all code (writes)
@@ -1294,18 +1292,19 @@ publishes it. It is a dependency, not this repo's build output, so
 The directory is `3p/` rather than `vendor/` because Go treats a root
 `vendor/` directory as its module vendor directory.
 
-`script/assets` (`make assets`) extracts the browser build,
+`make assets` extracts the browser build, `package/dist/cdn.min.js`, from the
-`package/dist/cdn.min.js`, from the tarball to `static/js/alpine.min.js`,
+tarball to `static/js/alpine.min.js`, where `go:embed` picks it up.
-where `go:embed` picks it up. `script/test`, `make build` and `make dev` run
+`make test`, `make check`, `make build` and `make dev` run it first, and the
-it first, and the Dockerfile builds through `make test` and `make build`, so
+Dockerfile builds through them, so no build downloads anything. The extracted
-nothing downloads Alpine.js. The extracted file is not committed, and
+file is not committed, and `.dockerignore` keeps any host copy out of the
-`.dockerignore` keeps any host copy out of the build context.
+build context.
 
 To move to a new version: download
 `https://registry.npmjs.org/alpinejs/-/alpinejs-<version>.tgz`, check it
 against the `dist.integrity` hash listed at
 `https://registry.npmjs.org/alpinejs/<version>`, replace the tarball in `3p/`
-with it, update its file name in `script/assets`, and run `make check`.
+with it, update its file name in the Makefile's `assets` target, and run
+`make check`.
 
 ## Rationale
 
@@ -2884,7 +2883,7 @@ webhooker/
 ├── script/                    # Scripts to Rule Them All entrypoints
 ├── Dockerfile                 # Three stages: lint, test+build, Alpine runtime
 ├── Dockerfile.lint            # Lint-only image built by script/lint
-├── Makefile                   # 10 of 17 targets shim script/; 7 are inline
+├── Makefile                   # 9 of 17 targets shim script/; 8 are inline
 ├── go.mod / go.sum
 └── .golangci.yml              # Linter configuration
 ```
@@ -3277,5 +3276,3 @@ MIT
 ## Author
 
 [@sneak](https://sneak.berlin)
-
-

script/assets

@@ -1,16 +0,0 @@
-#!/bin/sh
-# script/assets: extract Alpine.js from its npm package tarball, committed
-# in 3p/, to static/js/alpine.min.js, where go:embed reads it. The
-# extracted file is not committed. script/test, make build and make dev run
-# this first.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    tar -xzOf 3p/alpinejs-3.14.9.tgz package/dist/cdn.min.js \
-        >static/js/alpine.min.js
-}
-
-main "$@"

script/test

@@ -28,7 +28,6 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    "$ROOT/script/assets"
     go test -v -race -timeout 90s ./...
 }