static.go embeds the js directory, so a missing fetched asset silently produces a binary with no Alpine #166

New Issue

clawbot · 2026-08-17T23:12:31+02:00

clawbot commented

2026-08-17 23:12:31 +02:00

Found by the independent review of #164, which introduced the build-time fetch. Not a release blocker and deliberately NOT milestoned 1.0.0 — see below.

static/static.go embeds by directory:

//go:embed css js
var Static embed.FS

A directory pattern matches whatever is present, so a missing static/js/alpine.min.js is not a compile error. The reviewer ran make build on a tree where the asset had not been fetched: exit 0, binary produced, admin UI silently has no Alpine. Same for make run, make dev and a bare go build.

Why this is not a 1.0.0 blocker: every gated path fails loudly. The Dockerfile runs script/fetch-assets with sha256 verification, make check runs static/vendor_test.go which re-hashes the embedded bytes, and CI runs both. So the release artifact cannot ship without the verified asset. This is local-development ergonomics — a developer who skips the fetch gets a confusing half-working UI rather than an error.

Definition of done

static/static.go names the files it requires, e.g. //go:embed css js/app.js js/alpine.min.js, so absence is a compile error on every build path rather than only on gated ones.
make build on a tree with no static/js/alpine.min.js FAILS, and the failure names the missing file.
make check still passes with the asset present.
Check whether css should be named explicitly too, and say what you concluded. Note the same review observed that static/css/style.css is embedded but no template loads it, so the css side may want its own decision rather than a mechanical change.

Implementation requirements

Branch from next, PR based on next, single commit, title ending (closes #N).
Do not modify TODO.md (see #112).
Gate on make check plus the Docker lint path with the cache defeated. All linting runs in Docker, never on the host.

Found by the independent review of https://git.eeqj.de/sneak/webhooker/pulls/164, which introduced the build-time fetch. Not a release blocker and deliberately NOT milestoned 1.0.0 — see below. `static/static.go` embeds by directory: ```go //go:embed css js var Static embed.FS ``` A directory pattern matches whatever is present, so a missing `static/js/alpine.min.js` is not a compile error. The reviewer ran `make build` on a tree where the asset had not been fetched: exit 0, binary produced, admin UI silently has no Alpine. Same for `make run`, `make dev` and a bare `go build`. Why this is not a 1.0.0 blocker: every gated path fails loudly. The `Dockerfile` runs `script/fetch-assets` with sha256 verification, `make check` runs `static/vendor_test.go` which re-hashes the embedded bytes, and CI runs both. So the release artifact cannot ship without the verified asset. This is local-development ergonomics — a developer who skips the fetch gets a confusing half-working UI rather than an error. ## Definition of done - `static/static.go` names the files it requires, e.g. `//go:embed css js/app.js js/alpine.min.js`, so absence is a compile error on every build path rather than only on gated ones. - `make build` on a tree with no `static/js/alpine.min.js` FAILS, and the failure names the missing file. - `make check` still passes with the asset present. - Check whether `css` should be named explicitly too, and say what you concluded. Note the same review observed that `static/css/style.css` is embedded but no template loads it, so the css side may want its own decision rather than a mechanical change. ## Implementation requirements - Branch from `next`, PR based on `next`, single commit, title ending ` (closes #N)`. - Do not modify `TODO.md` (see https://git.eeqj.de/sneak/webhooker/issues/112). - Gate on `make check` plus the Docker lint path with the cache defeated. All linting runs in Docker, never on the host.

clawbot self-assigned this 2026-08-17 23:12:31 +02:00

clawbot referenced this issue

2026-08-17 23:50:35 +02:00

Milestone 1.0.0: internet-facing readiness #111

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/webhooker#166