Commit the Alpine.js tarball in 3p/ and extract it at build time (closes #345)

The build no longer downloads Alpine.js. Its npm package tarball is
committed as 3p/alpinejs-3.14.9.tgz; its sha256 matches the value
script/fetch-assets pinned, and the cdn.min.js inside it matches the
value static/vendor.sha256 pinned.

make assets extracts package/dist/cdn.min.js to the ignored
static/js/alpine.min.js. make test, check, build and dev run it first,
and the Dockerfile builds through make test and make build.
script/fetch-assets, its Dockerfile step, static/vendor.sha256 and
static/vendor_test.go are removed, along with bootstrap's curl install.

Model: opus-5-5

.dockerignore

@@ -3,10 +3,8 @@
 # stage of the Dockerfile.
 .git/
 bin/
-# Third-party browser assets are fetched and hash-verified inside the build by
+# Extracted from 3p/ by `make assets` inside the build; a host copy is not
-# script/fetch-assets. Excluding any host copy keeps a developer's working tree
+# needed. The tarball in 3p/ must stay in the context.
-# from supplying the bytes that get shipped. The script and its
-# static/vendor.sha256 manifest stay in the context.
 static/js/alpine.min.js
 *.md
 LICENSE

.gitignore

@@ -46,7 +46,6 @@ temp/
 # CI cache barrier, written into the build context by the check workflow
 .ci-fingerprint
 
-# Third-party browser assets, fetched and hash-verified by
+# Alpine.js, extracted by `make assets` from its tarball in 3p/, which is
-# script/fetch-assets against static/vendor.sha256. Not committed:
+# what is committed.
-# REPO_POLICIES.md forbids minified bundles in version control.
 /static/js/alpine.min.js

Dockerfile

@@ -51,15 +51,8 @@ RUN go mod download
 # the lint stage above.
 COPY . .
 
-# Fetch the third-party browser assets the UI serves. They are not committed
+# Run tests and build. Both first run `make assets`, which extracts Alpine.js
-# (REPO_POLICIES.md forbids minified bundles in version control) and
+# from its tarball in 3p/.
-# .dockerignore keeps any host copy out of the build context, so this step is
-# the only way they enter the image. Each download is checked against a
-# hardcoded sha256 and the build fails on mismatch; make test re-checks the
-# hashes against the bytes go:embed actually put in the binary.
-RUN script/fetch-assets
-
-# Run tests and build
 RUN make test
 
 # Version stamped into the binary. .dockerignore excludes .git/, so
@@ -67,8 +60,8 @@ RUN make test
 # host and passes it in. The default is what a bare `docker build .`
 # with no --build-arg gets, and it names no tag the tree may not be at.
 #
-# Declared here, below the test and asset steps, so a changed version
+# Declared here, below the test step, so a changed version does not
-# does not invalidate their cached layers.
+# invalidate its cached layer.
 ARG VERSION=unknown
 
 RUN make build VERSION="$VERSION"

Makefile

@@ -27,10 +27,13 @@ bootstrap:
 setup:
 	@script/setup
 
+# Alpine.js is committed as its npm package tarball in 3p/. This extracts
+# the browser build from it to where go:embed reads it; the extracted file
+# is not committed.
 assets:
-	@script/fetch-assets
+	tar -xzOf 3p/alpinejs-3.14.9.tgz package/dist/cdn.min.js >static/js/alpine.min.js
 
-test:
+test: assets
 	@script/test
 
 lint:
@@ -42,16 +45,16 @@ fmt:
 fmt-check:
 	@script/fmt-check
 
-check:
+check: assets
 	@script/check
 
-build:
+build: assets
 	go build -ldflags '$(strip -X main.version=$(VERSION) $(GO_LDFLAGS))' -o bin/webhooker ./cmd/webhooker
 
 run: build
 	./bin/webhooker
 
-dev:
+dev: assets
 	go run ./cmd/webhooker
 
 deps:

README.md

@@ -21,9 +21,6 @@ before deploying one.
 - Go 1.26.1+ (the version in `go.mod`)
 - Docker (for linting, for the test stage of the CI gate, and for
   containerized deployment)
-- `curl`, used by `script/fetch-assets` to download the third-party
-  browser assets, which are not committed (`make bootstrap` installs
-  it if missing)
 
 golangci-lint is not a prerequisite and must not be installed on the
 host: `script/bootstrap` does not install it, and `make lint` runs the
@@ -36,9 +33,7 @@ digest-pinned linter image via `Dockerfile.lint`.
 git clone https://git.eeqj.de/sneak/webhooker.git
 cd webhooker
 
-# Install Go dependencies and the third-party browser assets.
+# Install the Go toolchain if missing, and the Go dependencies
-# `make deps` alone is not enough: it only runs go mod download/tidy,
-# and the checks below need the fetched assets.
 make bootstrap
 
 # Run all checks (test, lint, format check)
@@ -58,7 +53,7 @@ make docker
 ```bash
 make bootstrap  # Install all dependencies (idempotent)
 make setup      # Bootstrap + install git pre-commit hook
-make assets     # Fetch + verify third-party browser assets
+make assets     # Extract Alpine.js from 3p/ (test, check, build, dev run it)
 make fmt        # Format code (gofmt + goimports)
 make fmt-check  # Fail if gofmt would change anything (writes nothing)
 make lint       # Run golangci-lint in Docker (Dockerfile.lint)
@@ -1252,16 +1247,16 @@ What that means for an operator:
 This repository adheres to the
 [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
 standard: normalized scripts in `script/` are the entrypoints for the
-development workflow. Ten of the Makefile's seventeen targets are thin
+development workflow. Nine of the Makefile's seventeen targets are thin
-shims that call them; `build`, `run`, `dev`, `deps`, `clean`, `css` and
+shims that call them; `assets`, `build`, `run`, `dev`, `deps`, `clean`,
-`version` are inline commands with no script behind them, though
+`css` and `version` are inline commands with no script behind them,
-`build` and `version` both take their value from `script/version`.
+though `build` and `version` both take their value from
+`script/version`.
 
-`make check` needs the third-party browser assets in `static/`, which
+`make test`, `make check`, `make build` and `make dev` each run
-are not committed, so run `make bootstrap` (or just `make assets`) once
+`make assets` first, which writes the ignored `static/js/alpine.min.js`
-after cloning. Without them the tests fail with a message naming that
+(see [Third-party browser assets](#third-party-browser-assets)), so
-remedy. `make check` does not fetch them itself because it must not
+`make check` works on a fresh clone without a separate setup step.
-change any files in the repo.
 
 We provide:
 
@@ -1269,8 +1264,6 @@ We provide:
 - `script/setup` — make a fresh clone ready for development
   (bootstrap, then install-precommit)
 - `script/projectname` — output the project name ("webhooker")
-- `script/fetch-assets` — download the third-party browser assets into
-  `static/`, verifying each against its pinned sha256
 - `script/test` — run the test suite
 - `script/lint` — run golangci-lint in Docker (see Linting below)
 - `script/fmt` — format all code (writes)
@@ -1292,24 +1285,26 @@ We provide:
 
 ## Third-party browser assets
 
-The web UI serves one third-party script, Alpine.js. It is **not** committed:
+The web UI serves one third-party script, Alpine.js. Its npm package tarball
-a minified bundle in the tree is unreviewable, and `REPO_POLICIES.md` bars
+is committed as `3p/alpinejs-3.14.9.tgz`, byte for byte as the npm registry
-both committed build artifacts and unpinned external references.
+publishes it. It is a dependency, not this repo's build output, so
+`REPO_POLICIES.md`'s rule against committed build artifacts does not apply.
+The directory is `3p/` rather than `vendor/` because Go treats a root
+`vendor/` directory as its module vendor directory.
 
-Instead `script/fetch-assets` downloads it from a pinned URL, checks the
+`make assets` extracts the browser build, `package/dist/cdn.min.js`, from the
-download against a hardcoded sha256, and installs it under `static/`. The
+tarball to `static/js/alpine.min.js`, where `go:embed` picks it up.
-sha256 of every installed asset is recorded in `static/vendor.sha256`, and
+`make test`, `make check`, `make build` and `make dev` run it first, and the
-`static/vendor_test.go` re-hashes the bytes `go:embed` put in the binary
+Dockerfile builds through them, so no build downloads anything. The extracted
-against that manifest — so the pin is enforced on what actually ships, not
+file is not committed, and `.dockerignore` keeps any host copy out of the
-merely written down. Any mismatch fails the build.
+build context.
 
-`make bootstrap` runs the fetch for local development, and the Dockerfile
+To move to a new version: download
-runs it in the build stage; `.gitignore` and `.dockerignore` keep the
+`https://registry.npmjs.org/alpinejs/-/alpinejs-<version>.tgz`, check it
-artifact out of both the repo and the build context.
+against the `dist.integrity` hash listed at
-
+`https://registry.npmjs.org/alpinejs/<version>`, replace the tarball in `3p/`
-To move to a new version: update the version, URL, and tarball sha256 in
+with it, update its file name in the Makefile's `assets` target, and run
-`script/fetch-assets` and the asset sha256 in `static/vendor.sha256`, then
+`make check`.
-run `make assets && make check`.
 
 ## Rationale
 
@@ -2788,6 +2783,8 @@ imports. The entry point is `cmd/webhooker/main.go`.
 
 ```
 webhooker/
+├── 3p/
+│   └── alpinejs-3.14.9.tgz    # Alpine.js npm package, extracted by make assets
 ├── cmd/webhooker/
 │   └── main.go               # Entry point: subcommand dispatch; no args locks DATA_DIR and wires fx
 ├── internal/
@@ -2881,13 +2878,12 @@ webhooker/
 │   ├── css/tailwind.css       # Generated stylesheet the pages load
 │   ├── css/style.css          # Older hand-written stylesheet, no longer loaded
 │   ├── js/app.js              # Progressive-enhancement copy-to-clipboard
-│   ├── js/alpine.min.js       # Alpine.js, fetched by script/fetch-assets, not committed
+│   └── js/alpine.min.js       # Alpine.js, extracted from 3p/ by make assets, not committed
-│   └── vendor.sha256          # Pinned hashes the fetched assets are verified against
 ├── templates/                 # Go HTML templates (base, login, sources, etc.)
 ├── script/                    # Scripts to Rule Them All entrypoints
 ├── Dockerfile                 # Three stages: lint, test+build, Alpine runtime
 ├── Dockerfile.lint            # Lint-only image built by script/lint
-├── Makefile                   # 10 of 17 targets shim script/; 7 are inline
+├── Makefile                   # 9 of 17 targets shim script/; 8 are inline
 ├── go.mod / go.sum
 └── .golangci.yml              # Linter configuration
 ```
@@ -3190,14 +3186,14 @@ version is fixed independently of the compiler's:
    `make fmt-check`, then `golangci-lint config verify` and
    `golangci-lint run`, both with `--network=none`.
 2. **Builder stage** (`golang:1.26.1-bookworm`) — depends on the lint
-   stage passing (it copies a file from it), runs `script/fetch-assets`
+   stage passing (it copies a file from it), runs `make test` and
-   to download and verify the third-party browser assets, then runs
+   `make build` (both extract Alpine.js from `3p/` first), and finally
-   `make test` and `make build`, and finally rebuilds the binary with
+   rebuilds the binary with `CGO_ENABLED=1` and static linking so it
-   `CGO_ENABLED=1` and static linking so it runs on musl. Both builds
+   runs on musl. Both builds go through `make build`, the relink adding
-   go through `make build`, the relink adding its `-extldflags` via
+   its `-extldflags` via `GO_LDFLAGS`, so neither can drop the `-X` that
-   `GO_LDFLAGS`, so neither can drop the `-X` that stamps the version.
+   stamps the version. The version arrives as the `VERSION` build arg,
-   The version arrives as the `VERSION` build arg, since the context
+   since the context has no `.git` (see
-   has no `.git` (see [Version stamping](#version-stamping)).
+   [Version stamping](#version-stamping)).
 3. **Runtime stage** (`alpine:3.21`) — copies the static binary,
    creates the `/var/lib/webhooker` directory for all SQLite databases,
    runs as the non-root `webhooker` user (UID 1000), exposes port 8080,

internal/server/static_assets_test.go

@@ -13,9 +13,9 @@ import (
 
 // TestBaseTemplateScriptsAreServed walks every /s/ script the base
 // template loads on each page and fetches it through the real router.
-// Alpine.js is fetched at build time rather than committed, so nothing
+// Alpine.js is extracted from its tarball in 3p/ at build time, so the
-// in the repo guarantees it is present: this is the check that the page
+// file is not in the tree: this is the check that the page still gets
-// still gets the JavaScript it asks for.
+// the JavaScript it asks for.
 func TestBaseTemplateScriptsAreServed(t *testing.T) {
 	t.Parallel()
 

script/bootstrap

@@ -4,9 +4,7 @@
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes NOTHING is present (not git,
 # make, or go). golangci-lint is deliberately not installed: linting runs
-# only in docker, via script/lint and Dockerfile.lint. Finishes by running
+# only in docker, via script/lint and Dockerfile.lint.
-# script/fetch-assets, which installs the hash-pinned third-party browser
-# assets the repo does not commit.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -69,11 +67,6 @@ main() {
 
     go mod download
 
-    # Third-party browser assets are not committed; fetch and verify them
-    # so a fresh clone can build and test.
-    if missing curl; then pkg_install curl curl curl curl; fi
-    "$ROOT/script/fetch-assets"
-
     echo "bootstrap complete"
 }
 

script/fetch-assets

@@ -1,104 +0,0 @@
-#!/bin/sh
-# script/fetch-assets: download the third-party browser assets the web UI
-# ships and install them under static/. Minified bundles are not committed
-# (REPO_POLICIES.md: no build artifacts in version control), so the build
-# fetches them here. Every download is verified against a hardcoded sha256
-# before it is installed, and any mismatch aborts. Idempotent: an asset
-# already present with its pinned hash is left alone.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# The sha256 of each installed asset lives in static/vendor.sha256, in
-# sha256sum(1) format, with paths relative to static/. That file is the
-# single source of truth: this script verifies against it, and
-# static/vendor_test.go asserts the bytes embedded into the binary match
-# it, so the hash cannot rot into a value nothing checks.
-MANIFEST="static/vendor.sha256"
-
-# Alpine.js 3.14.9, 2026-08-17. Fetched from registry.npmjs.org, the
-# publisher of record; the jsDelivr and unpkg copies are mirrors of this
-# same tarball. dist/cdn.min.js is the browser build Alpine publishes for
-# a <script> tag.
-ALPINE_VERSION="3.14.9"
-ALPINE_URL="https://registry.npmjs.org/alpinejs/-/alpinejs-${ALPINE_VERSION}.tgz"
-# sha256 of alpinejs-3.14.9.tgz
-ALPINE_TARBALL_SHA256="97dad7c0c81e659cfc8e7700055da9770f8186187cb9a8a76efb57e00d5ce52a"
-ALPINE_MEMBER="package/dist/cdn.min.js"
-ALPINE_DEST="js/alpine.min.js"
-
-sha256_of() {
-    if command -v sha256sum >/dev/null 2>&1; then
-        sha256sum "$1" | cut -d' ' -f1
-    else
-        shasum -a 256 "$1" | cut -d' ' -f1
-    fi
-}
-
-# expected_sha256 <path-relative-to-static>
-expected_sha256() {
-    awk -v want="$1" '$2 == want { print $1; found = 1 }
-        END { if (!found) exit 1 }' "$ROOT/$MANIFEST"
-}
-
-# verify <file> <expected-sha256> <what>
-verify() {
-    actual="$(sha256_of "$1")"
-    if [ "$actual" != "$2" ]; then
-        echo "fetch-assets: sha256 mismatch for $3" >&2
-        echo "  expected: $2" >&2
-        echo "  actual:   $actual" >&2
-        exit 1
-    fi
-}
-
-# up_to_date <path-relative-to-static> <expected-sha256>
-up_to_date() {
-    [ -f "$ROOT/static/$1" ] || return 1
-    [ "$(sha256_of "$ROOT/static/$1")" = "$2" ]
-}
-
-fetch_alpine() {
-    want="$(expected_sha256 "$ALPINE_DEST")"
-
-    if up_to_date "$ALPINE_DEST" "$want"; then
-        echo "fetch-assets: static/$ALPINE_DEST already at $want"
-        return 0
-    fi
-
-    echo "fetch-assets: fetching Alpine.js $ALPINE_VERSION from $ALPINE_URL"
-    tmp="$(mktemp -d)"
-    trap 'rm -rf "$tmp"' EXIT INT TERM
-    curl -fsSL -o "$tmp/alpine.tgz" "$ALPINE_URL"
-    verify "$tmp/alpine.tgz" "$ALPINE_TARBALL_SHA256" "alpinejs-${ALPINE_VERSION}.tgz"
-    tar -xzOf "$tmp/alpine.tgz" "$ALPINE_MEMBER" >"$tmp/alpine.min.js"
-    verify "$tmp/alpine.min.js" "$want" "$ALPINE_MEMBER from alpinejs-${ALPINE_VERSION}.tgz"
-
-    mkdir -p "$(dirname "$ROOT/static/$ALPINE_DEST")"
-    cp "$tmp/alpine.min.js" "$ROOT/static/$ALPINE_DEST"
-    rm -rf "$tmp"
-    trap - EXIT INT TERM
-    echo "fetch-assets: installed static/$ALPINE_DEST ($want)"
-}
-
-# Re-check every manifest entry against what is now on disk, so an entry
-# no script installs fails loudly instead of passing silently.
-verify_manifest() {
-    while read -r want path; do
-        case "$want" in '' | '#'*) continue ;; esac
-        if [ ! -f "$ROOT/static/$path" ]; then
-            echo "fetch-assets: $MANIFEST lists static/$path, which is missing" >&2
-            exit 1
-        fi
-        verify "$ROOT/static/$path" "$want" "static/$path"
-    done <"$ROOT/$MANIFEST"
-}
-
-main() {
-    cd "$ROOT"
-    fetch_alpine
-    verify_manifest
-    echo "fetch-assets: all assets in $MANIFEST verified"
-}
-
-main "$@"

static/vendor.sha256

@@ -1 +0,0 @@
-3ed1eed252488921df65e363d6715deb04d7f92aaedb9e52199fdf73cb1e0ad3  js/alpine.min.js

static/vendor_test.go

@@ -1,92 +0,0 @@
-package static_test
-
-import (
-	"bufio"
-	"crypto/sha256"
-	"encoding/hex"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"sneak.berlin/go/webhooker/static"
-)
-
-const manifestPath = "vendor.sha256"
-
-// fetchHint is appended to every failure here: the assets the manifest
-// covers are fetched by the build, not committed, so a fresh clone that
-// has not run script/fetch-assets fails this test and should be told why.
-const fetchHint = "run `script/fetch-assets` (or `make assets`) to install " +
-	"the pinned third-party assets"
-
-// TestVendoredAssetsMatchManifest asserts that every asset listed in
-// static/vendor.sha256 is embedded in the binary with exactly the pinned
-// bytes. script/fetch-assets verifies the same hashes at download time;
-// this test verifies them again on what actually ships, so a build that
-// skipped, cached, or subverted the fetch cannot produce a binary serving
-// unpinned third-party JavaScript.
-func TestVendoredAssetsMatchManifest(t *testing.T) {
-	t.Parallel()
-
-	entries := readManifest(t)
-	require.NotEmpty(t, entries, "%s lists no assets", manifestPath)
-
-	for path, want := range entries {
-		t.Run(path, func(t *testing.T) {
-			t.Parallel()
-
-			data, err := static.Static.ReadFile(path)
-			require.NoErrorf(
-				t, err,
-				"%s is listed in %s but is not embedded; %s",
-				path, manifestPath, fetchHint,
-			)
-
-			sum := sha256.Sum256(data)
-			got := hex.EncodeToString(sum[:])
-			require.Equalf(
-				t, want, got,
-				"embedded %s does not match its pinned sha256 in %s; %s",
-				path, manifestPath, fetchHint,
-			)
-		})
-	}
-}
-
-// readManifest parses static/vendor.sha256, which is in sha256sum(1)
-// format with paths relative to static/.
-func readManifest(t *testing.T) map[string]string {
-	t.Helper()
-
-	f, err := os.Open(manifestPath)
-	require.NoError(t, err, "opening %s", manifestPath)
-
-	defer func() { require.NoError(t, f.Close()) }()
-
-	entries := make(map[string]string)
-	scanner := bufio.NewScanner(f)
-
-	for scanner.Scan() {
-		line := strings.TrimSpace(scanner.Text())
-		if line == "" || strings.HasPrefix(line, "#") {
-			continue
-		}
-
-		fields := strings.Fields(line)
-		require.Lenf(
-			t, fields, 2,
-			"%s: malformed entry %q, want \"<sha256>  <path>\"",
-			manifestPath, line,
-		)
-
-		sum, path := fields[0], fields[1]
-		require.Lenf(t, sum, 64, "%s: %q is not a sha256", manifestPath, sum)
-		entries[path] = sum
-	}
-
-	require.NoError(t, scanner.Err(), "reading %s", manifestPath)
-
-	return entries
-}