Pre-commit gate is red on main: pre-existing specverb lint + execverb comment debt, and missing golangci-lint/trufflehog in the container #165

New issue

Closed

opened 2026-06-25 05:10:24 +00:00 by coilysiren · 2 comments

coilysiren commented

2026-06-25 05:10:24 +00:00

Owner

Surfaced while landing #164 (the specgen rename): the pre-commit gate is currently red on main for reasons unrelated to any one feature, so landing work means selectively SKIP-ing hooks. Worth a dedicated cleanup pass.

Pre-existing lint findings on `main`

golangci-lint run (the pinned v2.12.2) reports 6 issues, all in the specverb run-time engine:

http/specverb/action.go:778, http/specverb/describe.go:197, http/specverb/describe.go:344 - gocritic ifElseChain (rewrite to switch)
http/specverb/action.go:102 - gocyclo: resolveAction complexity 13 (> 12)
http/specverb/action_collect.go:154 - unparam: buildCollectRequest result body always nil
http/specverb/action_collect.go:192 - unparam: resolveCollectArgValue result 2 (error) always nil

Pre-existing code-comments finding

cli/execverb/guardfile.go:145 - a 3-line contiguous comment block (cap is 2). Move the explanation to a doc or trim.

Tooling gap in the ward container

golangci-lint and trufflehog are not on PATH in the feature container, so those two language: system hooks fail with "executable not found" regardless of the code. Either the container image should ship them, or pre-commit should tolerate their absence locally and lean on CI for the authoritative run. Note there is currently no CI lint workflow (.forgejo/workflows/ has only release.yml).

Net effect: a clean local commit today requires SKIP=golangci-lint,trufflehog,code-comments. None of these block correctness, but they erode the gate's signal.

Surfaced while landing #164 (the `specgen` rename): the pre-commit gate is currently red on `main` for reasons unrelated to any one feature, so landing work means selectively `SKIP`-ing hooks. Worth a dedicated cleanup pass. ## Pre-existing lint findings on `main` `golangci-lint run` (the pinned v2.12.2) reports 6 issues, all in the `specverb` run-time engine: - `http/specverb/action.go:778`, `http/specverb/describe.go:197`, `http/specverb/describe.go:344` - gocritic `ifElseChain` (rewrite to `switch`) - `http/specverb/action.go:102` - gocyclo: `resolveAction` complexity 13 (> 12) - `http/specverb/action_collect.go:154` - unparam: `buildCollectRequest` result body always nil - `http/specverb/action_collect.go:192` - unparam: `resolveCollectArgValue` result 2 (error) always nil ## Pre-existing code-comments finding - `cli/execverb/guardfile.go:145` - a 3-line contiguous comment block (cap is 2). Move the explanation to a doc or trim. ## Tooling gap in the ward container `golangci-lint` and `trufflehog` are not on PATH in the feature container, so those two `language: system` hooks fail with "executable not found" regardless of the code. Either the container image should ship them, or pre-commit should tolerate their absence locally and lean on CI for the authoritative run. Note there is currently no CI lint workflow (`.forgejo/workflows/` has only `release.yml`). Net effect: a clean local commit today requires `SKIP=golangci-lint,trufflehog,code-comments`. None of these block correctness, but they erode the gate's signal.

coilysiren referenced this issue

2026-06-25 05:10:39 +00:00

Rename the generator naming soup (specverb-gen / specdrv / specgen) for a clear build-vs-run split #164

coilyco-ops commented

2026-06-25 05:14:03 +00:00

Member

🔒 Reserved by ward agent --driver claude — container ward-cli-guard-issue-165-claude-1e592d32 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-06-25T05:14:01Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `ward-cli-guard-issue-165-claude-1e592d32` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-06-25T05:14:01Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Claude (she/her), via `ward agent`

coilysiren referenced this issue from a commit

2026-06-25 05:25:16 +00:00

fix(ci): clear specverb lint debt and add canonical Forgejo CI gate

coilysiren closed this issue

2026-06-25 05:25:16 +00:00

coilysiren commented

2026-06-25 05:26:13 +00:00

Author

Owner

Done: the six golangci-lint findings and the comment debt are cleared, and the whole pre-commit suite runs green locally now (with the tools on PATH). Landed on main as 2cf2917.

How it felt: the lint fixes themselves were mechanical and pleasant. The ifElseChain -> switch rewrites and the resolveAction extraction were obvious, and the two unparam fixes were the satisfying kind, deleting return values that were genuinely always nil rather than papering over them.

What fought back: the tooling gap was real. golangci-lint's official install script failed checksum verification on this arm64 container, so I fell back to go install. The sneakier one: the code-comments hook passed on my pre-commit run --all-files dry run but then failed at commit time, because an untracked file is invisible to --all-files. An inline YAML comment under env: slipped through until it was staged. Lesson re-learned.

A couple of notes for whoever reads this next:

The guardfile.go comment debt was already clean on main (the hook passes), so the line-145 reference had just drifted since filing. Nothing to do there.
cli/sandbox tests fail in this nested container (seccomp/ptrace/jailing unavailable). That is environment, not regression, and is orthogonal to this issue.

Confidence: high on the lint/comment debt. Medium on the new .forgejo/workflows/ci.yml. I verified every install step and the gate commands locally, but the Forgejo docker runner is amd64 and I could not actually execute the workflow from here, so its first real run on this push is the proof. The arm64 checksum snag should not bite there.

Follow-up worth filing: the underlying container tooling gap (golangci-lint and trufflehog absent from PATH) is really a provisioning fix in the ward/infra layer, not cli-guard. This CI workflow makes the gate reliable server-side, but it does not put those binaries in a contributor's local feature container.

Done: the six golangci-lint findings and the comment debt are cleared, and the whole pre-commit suite runs green locally now (with the tools on PATH). Landed on `main` as 2cf2917. How it felt: the lint fixes themselves were mechanical and pleasant. The ifElseChain -> switch rewrites and the resolveAction extraction were obvious, and the two unparam fixes were the satisfying kind, deleting return values that were genuinely always nil rather than papering over them. What fought back: the tooling gap was real. golangci-lint's official install script failed checksum verification on this arm64 container, so I fell back to `go install`. The sneakier one: the code-comments hook passed on my `pre-commit run --all-files` dry run but then failed at commit time, because an untracked file is invisible to `--all-files`. An inline YAML comment under `env:` slipped through until it was staged. Lesson re-learned. A couple of notes for whoever reads this next: - The guardfile.go comment debt was already clean on `main` (the hook passes), so the line-145 reference had just drifted since filing. Nothing to do there. - `cli/sandbox` tests fail in this nested container (seccomp/ptrace/jailing unavailable). That is environment, not regression, and is orthogonal to this issue. Confidence: high on the lint/comment debt. Medium on the new `.forgejo/workflows/ci.yml`. I verified every install step and the gate commands locally, but the Forgejo docker runner is amd64 and I could not actually execute the workflow from here, so its first real run on this push is the proof. The arm64 checksum snag should not bite there. Follow-up worth filing: the underlying container tooling gap (golangci-lint and trufflehog absent from PATH) is really a provisioning fix in the ward/infra layer, not cli-guard. This CI workflow makes the gate reliable server-side, but it does not put those binaries in a contributor's local feature container.

coilysiren referenced this issue

2026-06-25 21:39:41 +00:00

CI red on main is environmental, not #169: sandbox seccomp tests + golangci-lint install both fail on the runner #170