Repository navigation
Move the Go module into src/ and build into build/<os>/ - #42
Merged
Merged
Conversation
The simtabi Go layout keeps everything the toolchain reads under src/ and everything the repository presents at the top. This commit only moves files with git mv: go.mod, go.sum, the root package, cmd/, internal/, pkg/, scripts/ and the GoReleaser and golangci configs. Nothing inside them changes here, so the move reviews as renames. The module path, the embedded docs, the tooling and the workflows are pointed at src/ in the following commits; until then the root package's //go:embed of README.md and docs/ cannot resolve.
With the module in src/, its path becomes github.com/simtabi/probaci/src: GitHub's go-import tag has no subdir field, so Go treats the rest of the path as a directory. Imports, the -X ldflags and GoReleaser follow it. Everything that runs go now names the module: the Makefile and Taskfile use go -C src, CI and CodeQL point setup-go's cache at src/go.sum and golangci-lint at src/, CodeQL builds in manual mode because autobuild does not look in src/, and Dependabot's gomod entry reads /src. A bare `go test ./...` at the root would find no packages and pass. The root package embeds README.md and docs/ for `probaci docs`, and //go:embed cannot reach above src/, while the docs must stay at the root for GitHub and the docs site. They are mirrored into src/embedded/ by `make sync-docs`, and TestEmbeddedDocsMatchTheRepository fails when the copy drifts in either direction. release.yml mirrors src/vX.Y.Z onto the release commit, since that is the only tag Go resolves a subdirectory module through, writes the CHANGELOG notes to $RUNNER_TEMP so GoReleaser does not see a dirty tree, and sets GOPRIVATE for the org's modules. It is still dispatch-only. setup-go stays on go-version "1.25" rather than go-version-file: go.mod says go 1.25.0, which setup-go installs exactly, and the govulncheck and gosec pins rely on the newest 1.25 patch.
The simtabi Go layout gives build/ one folder per OS and nothing else:
build/{macos,linux,windows}/probaci_{os}_{arch}[.exe], one
build/checksums.txt over {os}/{file} paths so `cd build && shasum -a 256
-c checksums.txt` verifies as-is, and build/archives/ only from
`make dist`. build/dist/ is gone: GoReleaser now writes its scratch dist
to .cache/goreleaser (gitignored), and the release attestation reads the
checksums from there.
The Makefile is now the one definition of every task, with build,
cross, dist and check-build added; `make build` writes
build/<host-os>/probaci and `make cross`/`make dist` go through
src/scripts/build-all.sh, never GoReleaser. The Taskfile keeps every
task name and forwards to make. The build script no longer deletes
build/targets.txt; it writes the default matrix only when the file is
missing.
TestBuildLayout fails on anything else in build/, and its negative test
plants each wrong shape (dist/, darwin/, a per-target folder, a loose
binary, GoReleaser metadata, a nested macos build) to prove it can fail.
make build, cross and dist run it, and a new CI snapshot job runs
`make cross`, verifies the checksums and uploads the binaries.
The owner decided probaci ships as a binary built from source and no longer builds a container image. Removed: the Dockerfile, the GoReleaser dockers_v2 block (ghcr.io/simtabi/probaci, linux/amd64 and arm64), release.yml's QEMU, buildx and ghcr.io login steps with the packages: write permission they needed, Dependabot's docker ecosystem, the --skip=docker flag of `make bundle`, and the docs lines offering the image. No image was ever published: the release workflow has never run, the repository has no releases, and the packages API answers 404 for simtabi/probaci, so there is nothing on ghcr.io to freeze or delete. The CI gitleaks job ran gitleaks from a container. The scan stays: it now installs gitleaks v8.30.1 with go install and runs the same command, so the repository runs no container anywhere. probaci's own feature of brokering tools through the host's container runtime is untouched.
The previous commit edited docs/installation.md and docs/release.md without refreshing src/embedded/, and TestEmbeddedDocsMatchTheRepository caught the drift. This is `make sync-docs`, nothing else.
TestReleaseRunsOnlyOnAConfirmedDispatch sat in the root package because the module used to start at the repository root. The build-layout guard now lives in src/internal/release, so the release guard joins it there and finds release.yml through the same repoRoot helper. Only the package clause and the path lookup change; the assertions are untouched.
TestReleaseRunsOnlyOnAConfirmedDispatch keeps its assertions and gains two: pull_request_target and workflow_run count as automatic triggers, and the refusal (confirm=release-go on a v[0-9]* tag, then exit 1) has to be the first step, before anything is checked out or built. TestNoContainerImage walks the repository for a Dockerfile, Containerfile, .dockerignore or compose file, and reads every workflow and src/.goreleaser.yaml for docker/ actions, docker build/run/push/login, ghcr.io and dockers/dockers_v2/docker_manifests blocks, and dependabot.yml for a docker ecosystem. It asserts it visited at least 80 files (116 today) and at least 5 workflows, so a walk rooted in the wrong place cannot pass. TestDocsOfferNoGoInstall fails when README, CONTRIBUTING or a docs page offers `go install github.com/...` while releases are on hold, with a floor of 5 docs pages. Each was proven red by planting its defect (a tag push trigger, a step before the refusal, a Dockerfile, docker run in ci.yml, a dockers_v2 block, a docker Dependabot ecosystem, a go install line) and green after reverting.
README, the installation and release guides, the architecture page, CONTRIBUTING and the pull request template now name src/ for the module, build/<os>/probaci for the host build, make cross and make dist for the OS folders and archives, .cache/goreleaser for GoReleaser's scratch output, and src/scripts/ for the install and pin scripts. The release guide explains the src/vX.Y.Z tag, and CONTRIBUTING explains `make sync-docs`. They still say what they said before about releases: binary releases are on hold, probaci is built from source, and no go install path is offered. CHANGELOG [Unreleased] records the move, the new guards and the removed container image. src/embedded/ is resynced.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings probaci onto the simtabi Go layout, in eight commits that keep moves and changes apart:
src/.go.mod, the root package,cmd/,internal/,pkg/,scripts/and the GoReleaser and golangci configs move withgit mvalone (first commit). The module path becomesgithub.com/simtabi/probaci/src; imports,-Xldflags, the Makefile, Taskfile, CI, CodeQL (nowbuild-mode: manual), golangci-lint (working-directory: src), Dependabot (gomodat/src) and GoReleaser (builds[].dir: src,go -C src mod tidy, run with--config src/.goreleaser.yaml) follow it.release.ymlmirrorssrc/vX.Y.Zbefore GoReleaser and stays dispatch-only behindconfirm=release-go.README.mdanddocs/forprobaci docs, and//go:embedcannot reach abovesrc/. The docs stay at the root and are copied intosrc/embedded/bymake sync-docs.TestEmbeddedDocsMatchTheRepositoryfails when the copy drifts in either direction.build/layout. One folder per OS (macos, neverdarwin),probaci_{os}_{arch}[.exe],build/checksums.txtover{os}/{file},build/archives/only frommake dist.make buildwritesbuild/<host-os>/probaci, andmake cross/make distusesrc/scripts/build-all.sh, never GoReleaser. GoReleaser'sdist:moved to.cache/goreleaser(gitignored), and the attestation reads its checksums from there. A new CIsnapshotjob runsmake crossand uploads the binaries.make.TestBuildLayout(and its negative test),TestNoContainerImageandTestDocsOfferNoGoInstall, each with floors, insrc/internal/release. The existing release guard moved there and now also requires the refusal to be the first step.[Unreleased]follow the new paths. They still say releases are on hold, build from source, and offer nogo install.Removed
The owner approved removing the container image. Removed in
bb8ebd1:Dockerfile(distroless wrapper around the binary). No.dockerignoreexisted.dockers_v2block (ghcr.io/simtabi/probaci,linux/amd64andlinux/arm64, tags{{ .Version }}andlatest).release.yml:docker/setup-qemu-action,docker/setup-buildx-action, thedocker/login-actionghcr.io login, thepackages: writepermission, and the header line about pushing the image.dockerecosystem.dockerfrommake bundle's--skiplist.docs/installation.md,docs/release.md).No image was ever published. The release workflow has never run, the repository has no releases, and
GET /orgs/simtabi/packages/container/probacianswers 404, so there is nothing on ghcr.io to freeze or delete.Replaced, not removed: the CI gitleaks job ran
docker run zricethezav/gitleaks:latest. It now runsgo install github.com/zricethezav/gitleaks/v8@v8.30.1and the samegitleaks dir . --no-banner --redact --exit-code 1, so the scan stays and the repository runs no container. probaci's own feature of brokering tools through the host container runtime (src/internal/docker) is untouched.Verification
Run locally on the head commit:
go -C src vet ./...: cleango -C src test ./... -count=1: 16 packages ok.-raceis also clean.gofmt -l src: emptymake buildwritesbuild/macos/probaci.probaci docs releaserenders from the embedded copy.make crossbuilds 10 targets plusprobaci_macos_universal.cd build && shasum -a 256 -c checksums.txtreports 11 OK.make distwritesbuild/archives/with 11 archives and their checksums.check-buildpasses.goreleaser check --config src/.goreleaser.yaml: 1 configuration file validated. This only checks the config. No release, build or snapshot was run.golangci-lint run ./...insrc/: 0 issuesRed proofs: each defect was planted, the guard failed, and it passed again after reverting:
TestReleaseRunsOnlyOnAConfirmedDispatchpush: tagstrigger; a checkout step before the refusalTestBuildLayoutbuild/dist/x;build/darwin/probaciTestNoContainerImageDockerfile;docker runin ci.yml; adockers_v2block in GoReleaser; a docker Dependabot ecosystemTestDocsOfferNoGoInstallgo install github.com/simtabi/probaci/src/cmd/probaci@latestline in installation.mdTestEmbeddedDocsMatchTheRepositorydocs/security.md. It also caught a real drift during this work (fixed in70789c2).Notes for review
go-version: "1.25"rather thango-version-file: src/go.mod.go.modsaysgo 1.25.0, which setup-go would install exactly, and the govulncheck and gosec pins rely on the newest 1.25 patch. Every setup-go now hascache-dependency-path: src/go.sum.go -C src run ./cmd/probaci …. probaci walks up to the git root, so it still proves the whole repository. However, itsdetectstage now reports no languages, because there is nogo.modat the root. Detecting a module in a subdirectory would be a change to probaci itself, so it is not made here.bb8ebd1alone fails the embedded-docs drift test. The next commit,70789c2, resyncs the copy.