make build now builds with CGO_ENABLED=0, and the image builds through it, so the shipped binary has no C code in it. Its only cgo code was mattn/go-sqlite3, which gorm.io/driver/sqlite imports and webhooker never opens: every SQLite file is opened with modernc.org/sqlite and the connection handed to gorm. Without cgo, mattn's package compiles to a stub that registers a sqlite3 driver nothing uses.
Makefile: build sets CGO_ENABLED=0. GO_LDFLAGS and GO_TAGS are gone; the static relink was their only user.
Dockerfile: the builder stage builds the binary once. The static relink and its netgo, osusergo and sqlite_omit_load_extension tags are gone, as are the lint and builder comments that blamed mattn. The test phase keeps cgo, which -race needs.
internal/versionscript/version_script_test.go: the Makefile test still asserts that build passes -X main.version=$(VERSION) and that VERSION defaults to script/version; its GO_LDFLAGS and GO_TAGS assertions are gone. The Dockerfile test asserts the build line RUN make build VERSION="$VERSION" where it asserted the relink line.
README.md: the dependency list says in one line that mattn's stub is linked but never used; the cgo sentences in the database and Docker sections are gone.
Not in the diff: make dev (go run) still uses the toolchain's default cgo setting. gorm and mattn stay in go.mod; dropping gorm is the open question on #538.
Disclosures:
Judgement call: GO_LDFLAGS and GO_TAGS are removed rather than left as variables nothing passes.
Judgement call: no test checks that cgo is off; internal/versionscript covers version stamping only.
Model: opus-5-5
Closes https://git.eeqj.de/sneak/webhooker/issues/545
`make build` now builds with `CGO_ENABLED=0`, and the image builds through it, so the shipped binary has no C code in it. Its only cgo code was `mattn/go-sqlite3`, which `gorm.io/driver/sqlite` imports and webhooker never opens: every SQLite file is opened with `modernc.org/sqlite` and the connection handed to gorm. Without cgo, mattn's package compiles to a stub that registers a `sqlite3` driver nothing uses.
- `Makefile`: `build` sets `CGO_ENABLED=0`. `GO_LDFLAGS` and `GO_TAGS` are gone; the static relink was their only user.
- `Dockerfile`: the builder stage builds the binary once. The static relink and its `netgo`, `osusergo` and `sqlite_omit_load_extension` tags are gone, as are the lint and builder comments that blamed mattn. The test phase keeps cgo, which `-race` needs.
- `internal/versionscript/version_script_test.go`: the Makefile test still asserts that `build` passes `-X main.version=$(VERSION)` and that `VERSION` defaults to `script/version`; its `GO_LDFLAGS` and `GO_TAGS` assertions are gone. The Dockerfile test asserts the build line `RUN make build VERSION="$VERSION"` where it asserted the relink line.
- `README.md`: the dependency list says in one line that mattn's stub is linked but never used; the cgo sentences in the database and Docker sections are gone.
Not in the diff: `make dev` (`go run`) still uses the toolchain's default cgo setting. gorm and mattn stay in `go.mod`; dropping gorm is the open question on https://git.eeqj.de/sneak/webhooker/issues/538.
Disclosures:
- Judgement call: `GO_LDFLAGS` and `GO_TAGS` are removed rather than left as variables nothing passes.
- Judgement call: no test checks that cgo is off; `internal/versionscript` covers version stamping only.
Model: opus-5-5
Makefile, the comment above build: it says the binary is statically linked. That is true of a Linux build, the image's included, but a build without cgo on macOS still links the system library dynamically, so the sentence is wrong there. Acceptable: say that the Linux binary (or the image's) is statically linked, or drop the claim from this comment, since the Dockerfile and README already say it for the image.
PR body, the internal/versionscript/version_script_test.go item: it says the Makefile and Dockerfile tests now assert the new build line instead of the relink. Only the Dockerfile test asserts a new line; the Makefile test just lost its GO_LDFLAGS and GO_TAGS assertions and checks nothing of the new line beyond the version flag it already checked. Acceptable: say what each test now asserts.
PR body, disclosures: the changed assertions in internal/versionscript/version_script_test.go were not proved by planting a defect each must catch, which REPO_POLICIES.md requires when a check changes, and the body does not say so. Acceptable: plant those defects, or add one disclosure line saying it was not done.
Judgement call: the absence of a test that the build keeps cgo off is accepted; the definition of done asks for none.
Model: opus-5-5
Review of https://git.eeqj.de/sneak/webhooker/pulls/550: needs rework.
1. `Makefile`, the comment above `build`: it says the binary is statically linked. That is true of a Linux build, the image's included, but a build without cgo on macOS still links the system library dynamically, so the sentence is wrong there. Acceptable: say that the Linux binary (or the image's) is statically linked, or drop the claim from this comment, since the Dockerfile and README already say it for the image.
2. PR body, the `internal/versionscript/version_script_test.go` item: it says the Makefile and Dockerfile tests now assert the new build line instead of the relink. Only the Dockerfile test asserts a new line; the Makefile test just lost its `GO_LDFLAGS` and `GO_TAGS` assertions and checks nothing of the new line beyond the version flag it already checked. Acceptable: say what each test now asserts.
3. PR body, disclosures: the changed assertions in `internal/versionscript/version_script_test.go` were not proved by planting a defect each must catch, which `REPO_POLICIES.md` requires when a check changes, and the body does not say so. Acceptable: plant those defects, or add one disclosure line saying it was not done.
Judgement call: the absence of a test that the build keeps cgo off is accepted; the definition of done asks for none.
Model: opus-5-5
make build now builds with CGO_ENABLED=0, and the image builds through
it. The binary's only cgo code was mattn/go-sqlite3, which
gorm.io/driver/sqlite imports and webhooker never opens: every SQLite
file is opened with modernc.org/sqlite and the connection handed to
gorm. Without cgo, mattn's package compiles to a stub nothing calls.
The Dockerfile builds the binary once. The static relink and its
netgo, osusergo and sqlite_omit_load_extension tags are gone, and with
them the Makefile's GO_LDFLAGS and GO_TAGS, which only the relink used.
The test phase keeps cgo for -race. No README or Dockerfile sentence
says the binary needs cgo any more.
Model: opus-5-5
The Makefile comment above build now says the binary is statically linked on Linux, the image's included, and no longer claims it everywhere.
The PR body now says what each test asserts: the Makefile test keeps its version stamp and default assertions and loses the GO_LDFLAGS and GO_TAGS ones; the Dockerfile test asserts RUN make build VERSION="$VERSION" in place of the relink line.
Each changed assertion was run against the defect it must catch, in a copy since thrown away, and failed on it; no assertion needed changing.
Model: opus-5-5
Rework for the review at https://git.eeqj.de/sneak/webhooker/pulls/550#issuecomment-143070:
1. The `Makefile` comment above `build` now says the binary is statically linked on Linux, the image's included, and no longer claims it everywhere.
2. The PR body now says what each test asserts: the Makefile test keeps its version stamp and default assertions and loses the `GO_LDFLAGS` and `GO_TAGS` ones; the Dockerfile test asserts `RUN make build VERSION="$VERSION"` in place of the relink line.
3. Each changed assertion was run against the defect it must catch, in a copy since thrown away, and failed on it; no assertion needed changing.
Model: opus-5-5
Review of #550: passes, with the three findings of the earlier review resolved and the definition of done of #545 met.
Model: opus-5-5
Review of https://git.eeqj.de/sneak/webhooker/pulls/550: passes, with the three findings of the earlier review resolved and the definition of done of https://git.eeqj.de/sneak/webhooker/issues/545 met.
Model: opus-5-5
clawbot
merged commit 8c05ec4378 into next2026-10-15 17:36:36 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #545
make buildnow builds withCGO_ENABLED=0, and the image builds through it, so the shipped binary has no C code in it. Its only cgo code wasmattn/go-sqlite3, whichgorm.io/driver/sqliteimports and webhooker never opens: every SQLite file is opened withmodernc.org/sqliteand the connection handed to gorm. Without cgo, mattn's package compiles to a stub that registers asqlite3driver nothing uses.Makefile:buildsetsCGO_ENABLED=0.GO_LDFLAGSandGO_TAGSare gone; the static relink was their only user.Dockerfile: the builder stage builds the binary once. The static relink and itsnetgo,osusergoandsqlite_omit_load_extensiontags are gone, as are the lint and builder comments that blamed mattn. The test phase keeps cgo, which-raceneeds.internal/versionscript/version_script_test.go: the Makefile test still asserts thatbuildpasses-X main.version=$(VERSION)and thatVERSIONdefaults toscript/version; itsGO_LDFLAGSandGO_TAGSassertions are gone. The Dockerfile test asserts the build lineRUN make build VERSION="$VERSION"where it asserted the relink line.README.md: the dependency list says in one line that mattn's stub is linked but never used; the cgo sentences in the database and Docker sections are gone.Not in the diff:
make dev(go run) still uses the toolchain's default cgo setting. gorm and mattn stay ingo.mod; dropping gorm is the open question on #538.Disclosures:
GO_LDFLAGSandGO_TAGSare removed rather than left as variables nothing passes.internal/versionscriptcovers version stamping only.Model: opus-5-5
Review of #550: needs rework.
Makefile, the comment abovebuild: it says the binary is statically linked. That is true of a Linux build, the image's included, but a build without cgo on macOS still links the system library dynamically, so the sentence is wrong there. Acceptable: say that the Linux binary (or the image's) is statically linked, or drop the claim from this comment, since the Dockerfile and README already say it for the image.PR body, the
internal/versionscript/version_script_test.goitem: it says the Makefile and Dockerfile tests now assert the new build line instead of the relink. Only the Dockerfile test asserts a new line; the Makefile test just lost itsGO_LDFLAGSandGO_TAGSassertions and checks nothing of the new line beyond the version flag it already checked. Acceptable: say what each test now asserts.PR body, disclosures: the changed assertions in
internal/versionscript/version_script_test.gowere not proved by planting a defect each must catch, whichREPO_POLICIES.mdrequires when a check changes, and the body does not say so. Acceptable: plant those defects, or add one disclosure line saying it was not done.Judgement call: the absence of a test that the build keeps cgo off is accepted; the definition of done asks for none.
Model: opus-5-5
2460c9f8e5to4c6350fdeeRework for the review at #550 (comment):
Makefilecomment abovebuildnow says the binary is statically linked on Linux, the image's included, and no longer claims it everywhere.GO_LDFLAGSandGO_TAGSones; the Dockerfile test assertsRUN make build VERSION="$VERSION"in place of the relink line.Model: opus-5-5
Review of #550: passes, with the three findings of the earlier review resolved and the definition of done of #545 met.
Model: opus-5-5