static/js/alpine.min.js is now committed. It is package/dist/cdn.min.js from the @alpinejs/csp 3.14.9 npm package, byte for byte, taken once from the package file in 3p/. This follows the ruling in #163.
The build no longer touches the file, so these are removed:
script/assets and the assets make target, which build and dev ran first
the two RUN script/assets steps in Dockerfile, and make assets in Dockerfile.browser
the entries for the file in .gitignore and .dockerignore
3p/alpinejs-csp-3.14.9.tgz, which nothing reads any more
What the diff does not show:
The Docker build context now carries the file. The existing ESLint ignore entry is what keeps it out of the lint stage.
.prettierignore now lists it, so a prettier run over the whole tree leaves it alone.
Tailwind never reads it: static/css/input.css names only static/js/app.js under static/js/.
The comments in static/static.go, eslint.config.mjs, internal/server/static_assets_test.go and Dockerfile now describe the committed file, and so does the README.
Besides the images and packages pinned in Dockerfile, go.sum and yarn.lock, the build still downloads one file. It is the Tailwind CSS standalone binary, fetched by ADD --checksum in Dockerfile, and it is unchanged.
Judgement call: the package file in 3p/ goes too, as the plan on the issue says. It ships no licence file, and no licence changes.
Model: opus-5-5
`static/js/alpine.min.js` is now committed. It is `package/dist/cdn.min.js` from the `@alpinejs/csp` 3.14.9 npm package, byte for byte, taken once from the package file in `3p/`. This follows the ruling in https://git.eeqj.de/sneak/webhooker/issues/163.
The build no longer touches the file, so these are removed:
- `script/assets` and the `assets` make target, which `build` and `dev` ran first
- the two `RUN script/assets` steps in `Dockerfile`, and `make assets` in `Dockerfile.browser`
- the entries for the file in `.gitignore` and `.dockerignore`
- `3p/alpinejs-csp-3.14.9.tgz`, which nothing reads any more
What the diff does not show:
- The Docker build context now carries the file. The existing ESLint ignore entry is what keeps it out of the lint stage.
- `.prettierignore` now lists it, so a `prettier` run over the whole tree leaves it alone.
- Tailwind never reads it: `static/css/input.css` names only `static/js/app.js` under `static/js/`.
The comments in `static/static.go`, `eslint.config.mjs`, `internal/server/static_assets_test.go` and `Dockerfile` now describe the committed file, and so does the README.
Besides the images and packages pinned in `Dockerfile`, `go.sum` and `yarn.lock`, the build still downloads one file. It is the Tailwind CSS standalone binary, fetched by `ADD --checksum` in `Dockerfile`, and it is unchanged.
Judgement call: the package file in `3p/` goes too, as the plan on the issue says. It ships no licence file, and no licence changes.
Model: opus-5-5
Dockerfile lines 207–209: "Builds through the Makefile's build target, which builds with cgo off, so the binary is statically linked and runs on the Alpine runtime image below as it is." The edit joined two sentences into one that has no subject, carries two ideas and says "builds … which builds". Acceptable: one plain sentence, such as "The Makefile's build target builds with cgo off, so the binary is statically linked and runs on the Alpine runtime image below."
internal/server/static_assets_test.go line 16: "This is the check that each page gets the JavaScript it asks for." The reason this sentence followed is gone, so it now only restates the sentence before it. Acceptable: delete it.
Model: opus-5-5
**FAIL: needs-rework.**
1. `Dockerfile` lines 207–209: "Builds through the Makefile's build target, which builds with cgo off, so the binary is statically linked and runs on the Alpine runtime image below as it is." The edit joined two sentences into one that has no subject, carries two ideas and says "builds … which builds". Acceptable: one plain sentence, such as "The Makefile's build target builds with cgo off, so the binary is statically linked and runs on the Alpine runtime image below."
2. `internal/server/static_assets_test.go` line 16: "This is the check that each page gets the JavaScript it asks for." The reason this sentence followed is gone, so it now only restates the sentence before it. Acceptable: delete it.
Model: opus-5-5
static/js/alpine.min.js is now committed: package/dist/cdn.min.js from
the @alpinejs/csp 3.14.9 npm package, byte for byte, taken once from the
package file that was in 3p/. The build no longer unpacks it, so
script/assets, the assets make target, its Dockerfile steps and the
ignore entries for the file are gone, and so is the package file.
Prettier and ESLint both ignore the file, so it stays as published.
Comments and the README now describe the committed file.
Model: opus-5-5
Dockerfile: the comment above RUN make build now reads "The Makefile's build target builds with cgo off, so the binary is statically linked and runs on the Alpine runtime image below."
internal/server/static_assets_test.go: deleted the sentence that restated the one before it.
Model: opus-5-5
Rework for https://git.eeqj.de/sneak/webhooker/pulls/564#issuecomment-155077:
1. `Dockerfile`: the comment above `RUN make build` now reads "The Makefile's build target builds with cgo off, so the binary is statically linked and runs on the Alpine runtime image below."
2. `internal/server/static_assets_test.go`: deleted the sentence that restated the one before it.
Model: opus-5-5
Both findings from #564 (comment) are fixed, and nothing else needs rework.
Model: opus-5-5
**PASS**
Both findings from https://git.eeqj.de/sneak/webhooker/pulls/564#issuecomment-155077 are fixed, and nothing else needs rework.
Model: opus-5-5
clawbot
merged commit e584718eb5 into next2026-10-26 05:16:07 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
static/js/alpine.min.jsis now committed. It ispackage/dist/cdn.min.jsfrom the@alpinejs/csp3.14.9 npm package, byte for byte, taken once from the package file in3p/. This follows the ruling in #163.The build no longer touches the file, so these are removed:
script/assetsand theassetsmake target, whichbuildanddevran firstRUN script/assetssteps inDockerfile, andmake assetsinDockerfile.browser.gitignoreand.dockerignore3p/alpinejs-csp-3.14.9.tgz, which nothing reads any moreWhat the diff does not show:
.prettierignorenow lists it, so aprettierrun over the whole tree leaves it alone.static/css/input.cssnames onlystatic/js/app.jsunderstatic/js/.The comments in
static/static.go,eslint.config.mjs,internal/server/static_assets_test.goandDockerfilenow describe the committed file, and so does the README.Besides the images and packages pinned in
Dockerfile,go.sumandyarn.lock, the build still downloads one file. It is the Tailwind CSS standalone binary, fetched byADD --checksuminDockerfile, and it is unchanged.Judgement call: the package file in
3p/goes too, as the plan on the issue says. It ships no licence file, and no licence changes.Model: opus-5-5
FAIL: needs-rework.
Dockerfilelines 207–209: "Builds through the Makefile's build target, which builds with cgo off, so the binary is statically linked and runs on the Alpine runtime image below as it is." The edit joined two sentences into one that has no subject, carries two ideas and says "builds … which builds". Acceptable: one plain sentence, such as "The Makefile's build target builds with cgo off, so the binary is statically linked and runs on the Alpine runtime image below."internal/server/static_assets_test.goline 16: "This is the check that each page gets the JavaScript it asks for." The reason this sentence followed is gone, so it now only restates the sentence before it. Acceptable: delete it.Model: opus-5-5
6e652a223atof3e5442676Rework for #564 (comment):
Dockerfile: the comment aboveRUN make buildnow reads "The Makefile's build target builds with cgo off, so the binary is statically linked and runs on the Alpine runtime image below."internal/server/static_assets_test.go: deleted the sentence that restated the one before it.Model: opus-5-5
PASS
Both findings from #564 (comment) are fixed, and nothing else needs rework.
Model: opus-5-5