script/ holds the entrypoints and the Makefile targets shim to them.
Linting and testing are phases of the Dockerfile, built alone by
script/lint and script/test with a fresh CACHEBUST value and cache
mounts for Go's build cache and golangci-lint's; the build stage
depends on both, and the runtime stage ships the binary and the source
without .git. Formatting stays on the host in script/fmt and
script/fmt-check (gofmt and the prettier pinned in yarn.lock).
script/cibuild bootstraps, runs script/check and builds the tagged
image, and the Gitea workflow calls it. script/precommit refuses a
commit whose go.mod or go.sum is not tidy.
cgo stays off, so the test phase runs on the alpine Go image without
-race; that is the one departure from the canonical Go Dockerfile.
Re-vendored from the prompts repository's next branch: REPO_POLICIES.md
(2026-11-04), .golangci.yml (byte-identical, so the local
exhaustruct_v5 addition is gone now that canonical carries it),
.gitea/workflows/check.yml, .editorconfig, .gitignore and .dockerignore,
the last two followed by this repository's own entries. AGENTS.md holds
the repository-specific guidance for agents. The README gains the
Entrypoints section and describes the new gates.
The canonical config is already in the v2 layout and now enables
depguard with the test-support rule and a gomodguard_v2 block list;
this copy is byte-identical to it plus exhaustruct_v5 in the disable
list, which is what the pending upstream change adds. REPO_POLICIES.md
is refreshed from 2026-07-06 to 2026-09-08.
golangci-lint ignores keys it does not know and silently runs with
defaults, which is how the v1-era settings went unapplied. make lint now
runs golangci-lint config verify before golangci-lint run, in both the
Docker and the in-image paths.
Convert .golangci.yml to the v2 layout: linters-settings and
issues.exclude-use-default were rejected by the v2 schema, so the lll,
funlen, cyclop, and dupl settings were never applied. Disable
exhaustruct_v5 (the newer major version of the already-disabled
exhaustruct) and the deprecated gomodguard. Pin the golangci-lint image
at v2.15.0 in the Makefile and Dockerfile.
The private key is now the BIP85 HEX application output for 32 bytes at
m/83696968'/128169'/32'/{index}' from the BIP32 master key of the BIP39
seed, via sneak.berlin/go/secret/pkg/bip85, so any BIP85 tool reproduces
it and one mnemonic backs many keypairs through Params.Index. Tests
check the mnemonic-to-master step and the HEX application against the
BIP85 specification vectors and pin the resulting keypair.
Remove KeyFromHex, Seal, and Open with their errors and constants. The
library only derives crypto_box keypairs from BIP39 mnemonics; callers
use golang.org/x/crypto/nacl/box directly for everything else.
sutil holds only the utilities wanted on every machine; it is not a
command-line front end for the packages in pkg/. cbk and bip39wordlist
remain libraries with no CLI surface. The README states the boundary.
Bring back the in-progress viper and go-homedir configuration loading
from the original root command as a persistent pre-run on the root
command, with a --config flag and a config line in sutil info. Restore
the exported main.Version with a nolint directive instead of renaming
it. Export CGO_ENABLED=0 from the Makefile, drop -race from make test,
and remove the C toolchain from the Docker builder stage.
Move to Go 1.26, embed the wordlist from english.txt, add
ValidateWordlist, NormalizeWordlist, and GenerateMnemonic with tests,
and remove the old root-level CLI that used the previous module path.
sneak