From e14171fa02aae3004e31db74935a6e6e388a58a6 Mon Sep 17 00:00:00 2001 From: Claude Opus 5 Date: Thu, 30 Jul 2026 01:36:34 +0600 Subject: [PATCH] harness: fail an untidy go.mod MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit go get marks a module indirect until something imports it, and the allowlist check only inspects direct requires — so an unapproved dependency could sit in go.mod unnoticed. Demonstrated: adding github.com/google/uuid passed the allowlist check and was caught only by this gate. --- HARNESS.md | 4 +++- scripts/verify.sh | 8 ++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/HARNESS.md b/HARNESS.md index dcd6c02..ce48c2c 100644 --- a/HARNESS.md +++ b/HARNESS.md @@ -82,7 +82,9 @@ load-bearing mechanism here, and the one with least machine enforcement, which i fails any `.go` change that does not touch `state.md`. That does not prove the counters are *right*; it makes forgetting them impossible, which is the real failure mode. -**The dependency allowlist** names modules that are permitted, not required. `#` starts a comment anywhere on a line, including after an entry — the gate strips those, so an entry may carry the reason it exists. Being listed is permission; +**The dependency allowlist** names modules that are permitted, not required. The gate also fails an +untidy `go.mod`, because `go get` marks a module indirect until something imports it — and an indirect +entry is not checked against the allowlist, so an unapproved dependency could sit there unnoticed. `#` starts a comment anywhere on a line, including after an entry — the gate strips those, so an entry may carry the reason it exists. Being listed is permission; `DEPS_MAX` counts what `go.mod` actually pulls in. `scripts/allowed-deps.txt` is the list. **Budgets in `scripts/budgets.env`.** Two hard LOC ceilings, core and extensions, plus a dependency diff --git a/scripts/verify.sh b/scripts/verify.sh index 0ff885c..b8a56dc 100755 --- a/scripts/verify.sh +++ b/scripts/verify.sh @@ -236,6 +236,14 @@ if [ -f scripts/allowed-deps.txt ]; then fi fi +# An untidy go.mod misreports what is direct, so the allowlist check above would silently skip a +# dependency added by `go get` before anything imported it. +if go mod tidy -diff >/tmp/tidy.log 2>&1; then + pass "go.mod is tidy" +else + bad "go.mod is untidy — run go mod tidy; until then a direct dependency can hide as indirect" +fi + if [ "$total" -gt "$DEPS_MAX" ]; then bad "module count $total exceeds DEPS_MAX=$DEPS_MAX" else