bdeshi/khosra
0
0
Fork 0
Code Issues Pull Requests Releases Activity

harness: fail an untidy go.mod

Browse Source 
go get marks a module indirect until something imports it, and the allowlist
check only inspects direct requires — so an unapproved dependency could sit in
go.mod unnoticed. Demonstrated: adding github.com/google/uuid passed the
allowlist check and was caught only by this gate.
This commit is contained in:
bdeshi
2026-08-01 02:23:34 +06:00
parent 605359a495
commit c87fed697b
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
HARNESS.md
+3 -1
View File
@@ -82,7 +82,9 @@ load-bearing mechanism here, and the one with least machine enforcement, which i
fails any `.go` change that does not touch `state.md`. That does not prove the counters are *right*;
it makes forgetting them impossible, which is the real failure mode.
**The dependency allowlist** names modules that are permitted, not required. `#` starts a comment anywhere on a line, including after an entry — the gate strips those, so an entry may carry the reason it exists. Being listed is permission;
**The dependency allowlist** names modules that are permitted, not required. The gate also fails an
untidy `go.mod`, because `go get` marks a module indirect until something imports it — and an indirect
entry is not checked against the allowlist, so an unapproved dependency could sit there unnoticed. `#` starts a comment anywhere on a line, including after an entry — the gate strips those, so an entry may carry the reason it exists. Being listed is permission;
`DEPS_MAX` counts what `go.mod` actually pulls in. `scripts/allowed-deps.txt` is the list.
**Budgets in `scripts/budgets.env`.** Two hard LOC ceilings, core and extensions, plus a dependency