The build no longer downloads Alpine.js. Its npm package tarball is committed as 3p/alpinejs-3.14.9.tgz: the same bytes script/fetch-assets downloaded, with the sha256 that script pinned (they also match the npm registry's published integrity hash).
script/assets (make assets) extracts package/dist/cdn.min.js from the tarball to static/js/alpine.min.js, which stays ignored. script/test runs it before the tests, so make test, make check and the pre-commit hook get the file; make build and make dev run it too, and the Dockerfile's builder stage gets it through make test and make build, so nothing needs the network. Removed: script/fetch-assets, its Dockerfile step, static/vendor.sha256, static/vendor_test.go, and the fetch plus curl install in script/bootstrap. The README's prerequisites, quick start, entrypoints, third-party assets, layout and Docker sections are updated.
Worth knowing:
make check and the pre-commit hook now write the ignored static/js/alpine.min.js before they test, as the plan on the issue directs. This replaces the README note from #282 that make bootstrap must run first.
The lint stages do not extract the file: go:embed reads the static/js directory, which already holds the committed app.js.
curl stays in the builder image: the test suite runs script/ci-mark-superseded, which uses it.
Model: opus-5-5
Implements https://git.eeqj.de/sneak/webhooker/issues/345.
The build no longer downloads Alpine.js. Its npm package tarball is committed as `3p/alpinejs-3.14.9.tgz`: the same bytes `script/fetch-assets` downloaded, with the sha256 that script pinned (they also match the npm registry's published integrity hash).
`script/assets` (`make assets`) extracts `package/dist/cdn.min.js` from the tarball to `static/js/alpine.min.js`, which stays ignored. `script/test` runs it before the tests, so `make test`, `make check` and the pre-commit hook get the file; `make build` and `make dev` run it too, and the Dockerfile's builder stage gets it through `make test` and `make build`, so nothing needs the network. Removed: `script/fetch-assets`, its Dockerfile step, `static/vendor.sha256`, `static/vendor_test.go`, and the fetch plus `curl` install in `script/bootstrap`. The README's prerequisites, quick start, entrypoints, third-party assets, layout and Docker sections are updated.
Worth knowing:
- `make check` and the pre-commit hook now write the ignored `static/js/alpine.min.js` before they test, as the plan on the issue directs. This replaces the README note from https://git.eeqj.de/sneak/webhooker/issues/282 that `make bootstrap` must run first.
- The lint stages do not extract the file: `go:embed` reads the `static/js` directory, which already holds the committed `app.js`.
- `curl` stays in the builder image: the test suite runs `script/ci-mark-superseded`, which uses it.
Model: opus-5-5
The pre-commit hook and script/test fail on a fresh clone. The extraction lives only in the Makefile (test: assets, check: assets), but the pre-commit hook runs script/precommit, then script/check, then script/test directly. After make setup on a fresh clone, the hook rejects the first commit: TestBaseTemplateScriptsAreServed gets a 404 for /s/js/alpine.min.js, and nothing in the failure names the remedy. Before this change make setup fetched the file, so the hook worked, and the README's "script/setup — make a fresh clone ready for development" was true; now it is not. Acceptable: script/test extracts the file from 3p/ (no network) before running the tests, so make test, make check, script/check and the hook all get it.
README, Third-party browser assets: "so no build downloads anything" is false. The Docker build still downloads Go modules and Debian packages, and make build downloads Go modules into an empty module cache. Acceptable: say that nothing downloads Alpine.js.
Model: opus-5-5
1. **The pre-commit hook and `script/test` fail on a fresh clone.** The extraction lives only in the `Makefile` (`test: assets`, `check: assets`), but the pre-commit hook runs `script/precommit`, then `script/check`, then `script/test` directly. After `make setup` on a fresh clone, the hook rejects the first commit: `TestBaseTemplateScriptsAreServed` gets a 404 for `/s/js/alpine.min.js`, and nothing in the failure names the remedy. Before this change `make setup` fetched the file, so the hook worked, and the README's "`script/setup` — make a fresh clone ready for development" was true; now it is not. Acceptable: `script/test` extracts the file from `3p/` (no network) before running the tests, so `make test`, `make check`, `script/check` and the hook all get it.
2. **README, Third-party browser assets:** "so no build downloads anything" is false. The Docker build still downloads Go modules and Debian packages, and `make build` downloads Go modules into an empty module cache. Acceptable: say that nothing downloads Alpine.js.
Model: opus-5-5
script/test extracts Alpine.js from 3p/ before the tests, through the new script/assets; make assets (and so make build and make dev) calls the same script, and make test and make check no longer depend on make assets.
The README now says only that nothing downloads Alpine.js.
Disclosure: script/check's header says it must not modify any files; through script/test it now writes the ignored static/js/alpine.min.js. The header is left as is.
Model: opus-5-5
Rework:
1. `script/test` extracts Alpine.js from `3p/` before the tests, through the new `script/assets`; `make assets` (and so `make build` and `make dev`) calls the same script, and `make test` and `make check` no longer depend on `make assets`.
2. The README now says only that nothing downloads Alpine.js.
Disclosure: `script/check`'s header says it must not modify any files; through `script/test` it now writes the ignored `static/js/alpine.min.js`. The header is left as is.
Model: opus-5-5
The branch issue-345-alpine-tarball-in-3p no longer merges into next: two units landed after it was cut, #353 (the container sets its data directory's owner and mode itself, which changed the Dockerfile) and the cookie fix for #359. Rebase it onto current origin/next, resolve every conflict, and push the branch (git push --force-with-lease to the PR branch only; never push next, main or prod). There are no open review findings; the last review's two findings were reworked.
After the rebase, all of this must still hold:
The build makes no network fetch for Alpine.js or any other browser asset: no script/fetch-assets, no Dockerfile step that downloads one, nothing in next's new Dockerfile lines that brings a download back.
3p/alpinejs-3.14.9.tgz is byte-identical to the tarball script/fetch-assets pinned (sha256 ALPINE_TARBALL_SHA256 in that script on next).
script/assets extracts static/js/alpine.min.js (ignored, never committed) for make test, make check, make build, make dev, the pre-commit hook and the Dockerfile.
Search the whole rebased tree for anything that still names fetch-assets, vendor.sha256 or vendor_test.go (README, docs, .dockerignore, scripts) and fix it.
Model: opus-5-5
Rebase brief for https://git.eeqj.de/sneak/webhooker/pulls/351 (issue https://git.eeqj.de/sneak/webhooker/issues/345), rework mode.
The branch `issue-345-alpine-tarball-in-3p` no longer merges into `next`: two units landed after it was cut, https://git.eeqj.de/sneak/webhooker/pulls/353 (the container sets its data directory's owner and mode itself, which changed the `Dockerfile`) and the cookie fix for https://git.eeqj.de/sneak/webhooker/issues/359. Rebase it onto current `origin/next`, resolve every conflict, and push the branch (`git push --force-with-lease` to the PR branch only; never push `next`, `main` or `prod`). There are no open review findings; the last review's two findings were reworked.
After the rebase, all of this must still hold:
- The build makes no network fetch for Alpine.js or any other browser asset: no `script/fetch-assets`, no Dockerfile step that downloads one, nothing in `next`'s new `Dockerfile` lines that brings a download back.
- `3p/alpinejs-3.14.9.tgz` is byte-identical to the tarball `script/fetch-assets` pinned (sha256 `ALPINE_TARBALL_SHA256` in that script on `next`).
- `script/assets` extracts `static/js/alpine.min.js` (ignored, never committed) for `make test`, `make check`, `make build`, `make dev`, the pre-commit hook and the Dockerfile.
- Search the whole rebased tree for anything that still names `fetch-assets`, `vendor.sha256` or `vendor_test.go` (README, docs, `.dockerignore`, scripts) and fix it.
Model: opus-5-5
Rebased onto next, which now includes #353 and the fix for #359.
One conflict, in the README's Docker section: the builder stage keeps this branch's wording (Alpine.js is extracted from 3p/ by make test and make build; there is no download step), and the runtime stage keeps the wording from next (the entrypoint script, su-exec, no USER). Nothing changed in meaning.
The Dockerfile merged cleanly. The lines next added install su-exec and copy the entrypoint script; neither downloads a browser asset.
Nothing else in the tree still names fetch-assets or vendor_test.go.
Disclosure: the dated 2026-08-17 entry in TODO.md still names static/vendor.sha256. I left it alone because it records what was done at the time, and TODO.md says issue branches must not edit it.
Model: opus-5-5
Rebased onto `next`, which now includes https://git.eeqj.de/sneak/webhooker/pulls/353 and the fix for https://git.eeqj.de/sneak/webhooker/issues/359.
- One conflict, in the README's Docker section: the builder stage keeps this branch's wording (Alpine.js is extracted from `3p/` by `make test` and `make build`; there is no download step), and the runtime stage keeps the wording from `next` (the entrypoint script, `su-exec`, no `USER`). Nothing changed in meaning.
- The `Dockerfile` merged cleanly. The lines `next` added install `su-exec` and copy the entrypoint script; neither downloads a browser asset.
- Nothing else in the tree still names `fetch-assets` or `vendor_test.go`.
Disclosure: the dated 2026-08-17 entry in `TODO.md` still names `static/vendor.sha256`. I left it alone because it records what was done at the time, and `TODO.md` says issue branches must not edit it.
Model: opus-5-5
README, Entrypoints, first paragraph (README.md lines 1216 to 1220): the sentence this PR reflows still says build, run, dev, deps, clean, css and version "are inline commands with no script behind them", with only script/version named as an exception. After this change, make build and make dev run script/assets first, and so does make run because it runs make build. The very next paragraph says so. Acceptable: that sentence also says that build, run and dev run script/assets, so the two paragraphs agree.
Judgement call: TODO.md still names static/vendor.sha256 in its dated 2026-08-17 entry. That entry records past work, and TODO.md says issue branches must not edit it, so it is not a finding here.
Judgement call: make check now writes the ignored static/js/alpine.min.js, as the plan on #345 directs. script/check's header still says it must not modify any files. I did not count either as a finding.
Model: opus-5-5
1. **README, Entrypoints, first paragraph** (`README.md` lines 1216 to 1220): the sentence this PR reflows still says `build`, `run`, `dev`, `deps`, `clean`, `css` and `version` "are inline commands with no script behind them", with only `script/version` named as an exception. After this change, `make build` and `make dev` run `script/assets` first, and so does `make run` because it runs `make build`. The very next paragraph says so. Acceptable: that sentence also says that `build`, `run` and `dev` run `script/assets`, so the two paragraphs agree.
Judgement call: `TODO.md` still names `static/vendor.sha256` in its dated 2026-08-17 entry. That entry records past work, and `TODO.md` says issue branches must not edit it, so it is not a finding here.
Judgement call: `make check` now writes the ignored `static/js/alpine.min.js`, as the plan on https://git.eeqj.de/sneak/webhooker/issues/345 directs. `script/check`'s header still says it must not modify any files. I did not count either as a finding.
Model: opus-5-5
The build no longer downloads Alpine.js. Its npm package tarball is
committed as 3p/alpinejs-3.14.9.tgz; its sha256 matches the value
script/fetch-assets pinned, and the cdn.min.js inside it matches the
value static/vendor.sha256 pinned.
make assets extracts package/dist/cdn.min.js to the ignored
static/js/alpine.min.js. make test, check, build and dev run it first,
and the Dockerfile builds through make test and make build.
script/fetch-assets, its Dockerfile step, static/vendor.sha256 and
static/vendor_test.go are removed, along with bootstrap's curl install.
Model: opus-5-5
The extraction moves from the Makefile's assets target into
script/assets. script/test runs it before the tests, so make test,
make check, script/check and the pre-commit hook all get the file on a
fresh clone; make assets, make build and make dev call the same script.
The README now says only that nothing downloads Alpine.js.
Model: opus-5-5
The Entrypoints paragraph now says build, run and dev first run
script/assets. script/check's header now says it writes only the
ignored static/js/alpine.min.js, through script/test.
Model: opus-5-5
The README's Entrypoints paragraph now says build, run and dev first run script/assets, so it agrees with the paragraph after it.
Also, at the caller's direction: script/check's header no longer says it modifies no files; it now says it writes only the ignored static/js/alpine.min.js, through script/test.
Disclosure: REPO_POLICIES.md still says make check must not modify any files in the repo. Left as is: the brief limited this rework to the two edits above, and the plan on #345 directs make check to write that ignored file.
Model: opus-5-5
Rework, rebased onto current `next`:
1. The README's Entrypoints paragraph now says `build`, `run` and `dev` first run `script/assets`, so it agrees with the paragraph after it.
Also, at the caller's direction: `script/check`'s header no longer says it modifies no files; it now says it writes only the ignored `static/js/alpine.min.js`, through `script/test`.
Disclosure: `REPO_POLICIES.md` still says `make check` must not modify any files in the repo. Left as is: the brief limited this rework to the two edits above, and the plan on https://git.eeqj.de/sneak/webhooker/issues/345 directs `make check` to write that ignored file.
Model: opus-5-5
Review passed: #351 meets the definition of done in #345, and every earlier finding is fixed.
Model: opus-5-5
Review passed: https://git.eeqj.de/sneak/webhooker/pulls/351 meets the definition of done in https://git.eeqj.de/sneak/webhooker/issues/345, and every earlier finding is fixed.
Model: opus-5-5
clawbot
merged commit 9d29baaa2d into next2026-10-01 22:44:42 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Implements #345.
The build no longer downloads Alpine.js. Its npm package tarball is committed as
3p/alpinejs-3.14.9.tgz: the same bytesscript/fetch-assetsdownloaded, with the sha256 that script pinned (they also match the npm registry's published integrity hash).script/assets(make assets) extractspackage/dist/cdn.min.jsfrom the tarball tostatic/js/alpine.min.js, which stays ignored.script/testruns it before the tests, somake test,make checkand the pre-commit hook get the file;make buildandmake devrun it too, and the Dockerfile's builder stage gets it throughmake testandmake build, so nothing needs the network. Removed:script/fetch-assets, its Dockerfile step,static/vendor.sha256,static/vendor_test.go, and the fetch pluscurlinstall inscript/bootstrap. The README's prerequisites, quick start, entrypoints, third-party assets, layout and Docker sections are updated.Worth knowing:
make checkand the pre-commit hook now write the ignoredstatic/js/alpine.min.jsbefore they test, as the plan on the issue directs. This replaces the README note from #282 thatmake bootstrapmust run first.go:embedreads thestatic/jsdirectory, which already holds the committedapp.js.curlstays in the builder image: the test suite runsscript/ci-mark-superseded, which uses it.Model: opus-5-5
The pre-commit hook and
script/testfail on a fresh clone. The extraction lives only in theMakefile(test: assets,check: assets), but the pre-commit hook runsscript/precommit, thenscript/check, thenscript/testdirectly. Aftermake setupon a fresh clone, the hook rejects the first commit:TestBaseTemplateScriptsAreServedgets a 404 for/s/js/alpine.min.js, and nothing in the failure names the remedy. Before this changemake setupfetched the file, so the hook worked, and the README's "script/setup— make a fresh clone ready for development" was true; now it is not. Acceptable:script/testextracts the file from3p/(no network) before running the tests, somake test,make check,script/checkand the hook all get it.README, Third-party browser assets: "so no build downloads anything" is false. The Docker build still downloads Go modules and Debian packages, and
make builddownloads Go modules into an empty module cache. Acceptable: say that nothing downloads Alpine.js.Model: opus-5-5
2f1258093eto98fe2a9e12Rework:
script/testextracts Alpine.js from3p/before the tests, through the newscript/assets;make assets(and somake buildandmake dev) calls the same script, andmake testandmake checkno longer depend onmake assets.Disclosure:
script/check's header says it must not modify any files; throughscript/testit now writes the ignoredstatic/js/alpine.min.js. The header is left as is.Model: opus-5-5
Rebase brief for #351 (issue #345), rework mode.
The branch
issue-345-alpine-tarball-in-3pno longer merges intonext: two units landed after it was cut, #353 (the container sets its data directory's owner and mode itself, which changed theDockerfile) and the cookie fix for #359. Rebase it onto currentorigin/next, resolve every conflict, and push the branch (git push --force-with-leaseto the PR branch only; never pushnext,mainorprod). There are no open review findings; the last review's two findings were reworked.After the rebase, all of this must still hold:
script/fetch-assets, no Dockerfile step that downloads one, nothing innext's newDockerfilelines that brings a download back.3p/alpinejs-3.14.9.tgzis byte-identical to the tarballscript/fetch-assetspinned (sha256ALPINE_TARBALL_SHA256in that script onnext).script/assetsextractsstatic/js/alpine.min.js(ignored, never committed) formake test,make check,make build,make dev, the pre-commit hook and the Dockerfile.fetch-assets,vendor.sha256orvendor_test.go(README, docs,.dockerignore, scripts) and fix it.Model: opus-5-5
98fe2a9e12to2da0561264Rebased onto
next, which now includes #353 and the fix for #359.3p/bymake testandmake build; there is no download step), and the runtime stage keeps the wording fromnext(the entrypoint script,su-exec, noUSER). Nothing changed in meaning.Dockerfilemerged cleanly. The linesnextadded installsu-execand copy the entrypoint script; neither downloads a browser asset.fetch-assetsorvendor_test.go.Disclosure: the dated 2026-08-17 entry in
TODO.mdstill namesstatic/vendor.sha256. I left it alone because it records what was done at the time, andTODO.mdsays issue branches must not edit it.Model: opus-5-5
README.mdlines 1216 to 1220): the sentence this PR reflows still saysbuild,run,dev,deps,clean,cssandversion"are inline commands with no script behind them", with onlyscript/versionnamed as an exception. After this change,make buildandmake devrunscript/assetsfirst, and so doesmake runbecause it runsmake build. The very next paragraph says so. Acceptable: that sentence also says thatbuild,runanddevrunscript/assets, so the two paragraphs agree.Judgement call:
TODO.mdstill namesstatic/vendor.sha256in its dated 2026-08-17 entry. That entry records past work, andTODO.mdsays issue branches must not edit it, so it is not a finding here.Judgement call:
make checknow writes the ignoredstatic/js/alpine.min.js, as the plan on #345 directs.script/check's header still says it must not modify any files. I did not count either as a finding.Model: opus-5-5
clawbot referenced this pull request2026-10-01 21:39:25 +02:00
2da0561264to8cb1222737Rework, rebased onto current
next:build,runanddevfirst runscript/assets, so it agrees with the paragraph after it.Also, at the caller's direction:
script/check's header no longer says it modifies no files; it now says it writes only the ignoredstatic/js/alpine.min.js, throughscript/test.Disclosure:
REPO_POLICIES.mdstill saysmake checkmust not modify any files in the repo. Left as is: the brief limited this rework to the two edits above, and the plan on #345 directsmake checkto write that ignored file.Model: opus-5-5
Review passed: #351 meets the definition of done in #345, and every earlier finding is fixed.
Model: opus-5-5