diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index 153272c..bdaa418 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -10,8 +10,7 @@ # base image. The pipeline scans what a pull request builds, which catches a # change that introduces a vulnerable base. It cannot catch a base image tag # that stops receiving patches while nothing here changes, because nothing -# runs. That is how a sibling repository came to publish 38 fixable high and -# critical advisories. +# runs, so an image can carry fixable high and critical advisories for weeks. name: audit on: diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml index d0b6cac..09b4bbf 100644 --- a/.github/workflows/pipeline.yml +++ b/.github/workflows/pipeline.yml @@ -208,9 +208,9 @@ jobs: tags: httphq:scan # The image half of `check:audit`. A base image pinned to a branch that - # has stopped receiving patches keeps building, and nothing says so: one - # repository in this fleet was publishing 38 fixable high and critical - # advisories that no change in it could have fixed. + # has stopped receiving patches keeps building, and nothing says so. The + # image then ships fixable high and critical advisories that no change + # here could fix. # # `os` packages only, because the application's own dependencies are # already gated by `check:audit`, and scanning everything reports the npm diff --git a/AGENTS.md b/AGENTS.md index f638eae..05d38de 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -218,20 +218,6 @@ and a whole-graph analysis over a subset reports almost everything as unused. closes the store. A new background task that writes to the store has to stop before the store closes; see `run` in `src/application.go`. -## Shared files - -These files are kept identical, or in step, with the same files in the -repositories that deploy to the lab (lab, 8ctave, geobear, postcraft, -metric-tone and bjornkrols.com). Change them in all of them together. - -- `scripts/check-prose.mjs`, `scripts/check-lint-staged.mjs` and - `.husky/install.mjs`: identical in every one of them. -- `src/logging`: in step with `apps/hooks/logging.go` in the lab repository, - which carries the same handler, redaction list and level rules. - -`knip.ts` is deliberately not shared, though every repository has one. It is -almost entirely entry points, and no two repositories here have the same ones. - ## Code layout `src` is a `main` package split by concern, one file per subject with its tests @@ -303,12 +289,11 @@ columns, a `created_at`, and an index on every column a query filters or orders by. A `gorm:"column:..."` tag naming something else satisfies the struct and fails the test, which is the point. -The sibling repositories run the same questions as SQL against Postgres after -applying their migrations. There are no migration files here and no -information_schema to query, so these go through `sqlite_schema` and the pragmas. +There are no migration files here and no information_schema to query, so these +questions go through `sqlite_schema` and the pragmas. -Two of their checks do not apply. Nothing carries `updated_at`, because a -capture is written once and never edited, and there is no email column anywhere. +Nothing carries `updated_at`, because a capture is written once and never +edited, so the test does not ask for one. ## Captured data is ephemeral diff --git a/eslint.config.mjs b/eslint.config.mjs index b37f180..a7f92f7 100644 --- a/eslint.config.mjs +++ b/eslint.config.mjs @@ -36,9 +36,7 @@ export default tseslint.config( // first of these. // // The modified variant scores a whole switch as one decision rather than one - // per case. It changes no number here, because none of these files switch, - // and it is stated so the rule reads the same as it does in the sibling - // repositories rather than differing in a way that looks deliberate. + // per case. It changes no number here, because none of these files switch. { rules: { complexity: ["error", { max: 4, variant: "modified" }], diff --git a/scripts/check-lint-staged.mjs b/scripts/check-lint-staged.mjs index ace119a..1d5fe02 100644 --- a/scripts/check-lint-staged.mjs +++ b/scripts/check-lint-staged.mjs @@ -8,7 +8,7 @@ // cannot drift. // // Every statement fits in 80 columns, so Prettier prints this file the same at -// any print width and the copies in the sibling repositories stay identical. +// any print width. import { execFileSync } from "node:child_process"; import { readFileSync } from "node:fs"; diff --git a/scripts/check-prose.mjs b/scripts/check-prose.mjs index 42ad315..a037da3 100644 --- a/scripts/check-prose.mjs +++ b/scripts/check-prose.mjs @@ -9,9 +9,8 @@ // `path` is a file, or a directory ending in "/". `pattern` is a regular // expression; its matches on that path are ignored. // -// The same file lives in every repository that deploys to the lab. Change it -// in all of them together. Every statement fits in 80 columns, so Prettier -// prints it the same at any print width and the copies stay identical. +// Every statement fits in 80 columns, so Prettier prints it the same at any +// print width. import { execFileSync } from "node:child_process"; import { existsSync, readFileSync } from "node:fs"; diff --git a/src/database/standards_test.go b/src/database/standards_test.go index 50dd130..e5abd14 100644 --- a/src/database/standards_test.go +++ b/src/database/standards_test.go @@ -10,13 +10,11 @@ import ( ) // The database standards, asked of the schema AutoMigrate actually produces -// rather than of the struct tags that ask for it. The sibling repositories run -// the equivalent as SQL against Postgres after applying their migrations; there -// are no migration files here and no information_schema to query, so the same -// questions are asked of sqlite_schema and the pragmas instead. +// rather than of the struct tags that ask for it. There are no migration files +// here and no information_schema to query, so the questions are asked of +// sqlite_schema and the pragmas. // -// Two of their four checks do not apply. There is no email column anywhere, and -// nothing carries updated_at: a capture is written once and never edited, which +// Nothing carries updated_at: a capture is written once and never edited, which // is the whole shape of this product, so a column nothing writes would be // overhead on the only table there is.