1076edb2e8
All checks were successful
check / check (push) Successful in 2m42s
golangci-lint no longer runs on the host. script/lint builds
Dockerfile.lint, which copies the repo into the digest-pinned
golangci-lint image and lints as a build step, so a successful build is
a clean lint. The host binary shared one cache and one lock with every
other checkout on the machine, which produced findings attributed to
unrelated worktrees as well as unearned passes.
Three properties the wrapper has to get right:
- --no-cache-filter=lint forces the lint stage to re-execute. Without
it an unchanged tree replays the layer and the build exits 0 in under
a second having linted nothing. The deps stage stays cacheable.
- docker silently ignores --no-cache-filter when the stage name does
not match, so the flag alone is a convention, not a guarantee: a
rename or a typo restores the cached false green with no warning.
script/lint therefore tees the build output and fails unless
golangci-lint's own summary line ("N issues." / "N issues:") appears
in it. No summary, no lint, whatever the exit code says.
- Both lint steps use RUN --network=none. golangci-lint config verify
is documented as fetching its JSON schema over HTTPS; the pinned
image resolves it with no network, and --network=none enforces that
rather than trusting it. Verify is kept because golangci-lint run
silently ignores config keys it does not recognize.
The main Dockerfile's lint stage now invokes golangci-lint directly
instead of `make lint`, which would otherwise need a docker daemon
inside the build.
golangci-lint installation is removed from script/bootstrap. Its curl
guard and its script/fetch-assets call are untouched.
56 lines
2.2 KiB
Bash
Executable File
56 lines
2.2 KiB
Bash
Executable File
#!/bin/sh
|
|
# script/lint: run the linter. golangci-lint is never installed locally: it
|
|
# runs via docker only, one way, everywhere — script/lint builds
|
|
# Dockerfile.lint, which COPYs the repo into the pinned golangci-lint image
|
|
# and lints as a build step. This works even when the docker daemon is remote
|
|
# and bind mounts are impossible, and it removes the host linter's shared
|
|
# cache, which has attributed other checkouts' findings to this one.
|
|
#
|
|
# --no-cache-filter=lint forces the lint stage to re-execute on every run; a
|
|
# cached lint stage exits 0 in under a second having linted nothing. The deps
|
|
# stage keeps its cache, so module downloads are not repeated.
|
|
# --progress=plain keeps the linter's own output visible on success, so a
|
|
# passing run shows the issue count rather than nothing.
|
|
# --output=type=cacheonly leaves no image behind to clean up.
|
|
#
|
|
# docker silently ignores --no-cache-filter for a stage name that does not
|
|
# match, so a rename or a typo would restore the cached false green with no
|
|
# warning and a fast exit 0. The flag is therefore not trusted: the build
|
|
# output is teed to a log and a run is only a pass if golangci-lint's own
|
|
# summary line ("N issues." / "N issues:") is in it. No summary, no lint,
|
|
# whatever the exit code says.
|
|
set -eu
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
|
|
|
main() {
|
|
cd "$ROOT"
|
|
|
|
log="$(mktemp -t webhooker-lint.XXXXXXXX)"
|
|
rcfile="$(mktemp -t webhooker-lint-rc.XXXXXXXX)"
|
|
trap 'rm -f "$log" "$rcfile"' EXIT INT TERM
|
|
|
|
# The pipeline's status is tee's, and POSIX sh has no pipefail, so the
|
|
# build's status travels via a file. Output still streams live.
|
|
{
|
|
docker build \
|
|
-f Dockerfile.lint \
|
|
--no-cache-filter=lint \
|
|
--progress=plain \
|
|
--output=type=cacheonly \
|
|
. 2>&1 && echo 0 >"$rcfile" || echo $? >"$rcfile"
|
|
} | tee "$log" >&2
|
|
|
|
rc="$(cat "$rcfile")"
|
|
[ "$rc" -eq 0 ] || exit "$rc"
|
|
|
|
if ! grep -qE '[0-9]+ issues[.:]' "$log"; then
|
|
echo "script/lint: golangci-lint printed no summary line; the linter" >&2
|
|
echo " did not run. Check that the stage named in --no-cache-filter" >&2
|
|
echo " still matches a stage in Dockerfile.lint." >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
main "$@"
|