Gate gofmt and go vet on the Go test tooling - #166
Open
stevebeattie wants to merge 1 commit into
Open
Conversation
Neither was checked anywhere. CI ran `go test` only, which applies no formatting check and enables just a subset of vet, so an unformatted file reached main unnoticed — the stanza comment added in chainguard-dev#162, fixed in passing in chainguard-dev#163. A gate that would have caught it costs one step. `make lint-go` checks gofmt and runs vet in full over tests/oscap-offline, and the offline workflow runs it. Verified against both failure modes with deliberately broken files: unformatted code fails naming the file, and a formatted file with a vet problem (a Printf verb mismatch, which is in the subset `go test` already covers, chosen so the two layers are visibly distinct) fails too. Clean on main as it stands. gofmt -l is checked by its output rather than its exit status, and that is worth stating in the recipe because it is the trap that hides this class of problem: `gofmt -l` exits 0 whether or not it lists anything, so the natural `gofmt -l . && ...` succeeds on unformatted input. Getting this wrong is what made the original violation invisible, and it also cost me a wrong conclusion while diagnosing it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
stevebeattie
enabled auto-merge
August 26, 2026 04:52
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Neither
gofmtnorgo vetwas checked anywhere. CI runsgo testonly, whichapplies no formatting check and enables just a subset of vet — so an unformatted
file reached
mainunnoticed (the stanza comment added in #162, fixed in passingin #163). A gate that would have caught it costs one step.
There is no
.pre-commit-config.yamlin the repo and no golangci config either,so this is CI-only. Pre-commit could be added on top later; CI is the
authoritative gate and doesn't depend on per-clone setup.
Change
make lint-gochecksgofmtand runsgo vetin full acrosstests/oscap-offline, and the offline workflow runs it. Documented in theREADME's testing section alongside the other gates.
One detail worth keeping
gofmt -lis checked by its output, not its exit status:gofmt -lexits 0 whether or not it lists anything, so the naturalgofmt -l . && ...succeeds on unformatted input. That is precisely the trapthat made the original violation invisible — and it also cost me a wrong
conclusion while diagnosing it, before I re-checked. Hence the comment in the
recipe.
Verification
Exercised against both failure modes with deliberately broken files, then
removed:
Printfverb mismatch)mainas it stands)gofmt: clean,go vet: cleanactionlintissue count unchanged frommain;zizmorno findings.Noted separately, not changed here
make validate_mirrorsandmake test-offlineboth rungo testwithout-v,so their CI logs show
okbut not what was covered — #164's run, for instance,passes the mirror test without the log showing that it compared 8 files. Adding
-v(or an explicit count assertion) would make that signal auditable. Happy todo it, but it is a different concern from linting.
🤖 Generated with Claude Code