kacerrandClaude Opus 5.5
3766e94b35
- module path is now gitea.home.hrajfrisbee.cz/kacerr/gatewayapi-certificates-operator - internal/version resolves the commit from ldflags or Go build info; --version prints it and the first log line carries it - --metrics-bind-address is passed to the manager instead of being dropped - Dockerfile takes GIT_COMMIT, honours TARGETARCH, labels the image revision Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
116 lines
5.1 KiB
Markdown
116 lines
5.1 KiB
Markdown
# Execution: Bring gateway-helper-operator up to house conventions
|
|
|
|
Plan: `docs/plans/2026-10-08-2028-house-conventions.md`
|
|
|
|
- [x] Step 0 — Save and commit the plan
|
|
- [x] Step 1 — CLAUDE.md
|
|
- [x] Step 2 — `.claude/` and docs scaffolding
|
|
- [x] Step 3 — Makefile, lint, formatting
|
|
- [x] Step 4 — Module path and version identity
|
|
- [ ] Step 5 — Baseline tests
|
|
- [ ] Step 6 — CI build workflow
|
|
- [ ] Step 7 — Close out
|
|
|
|
## Step 1 — CLAUDE.md
|
|
|
|
Rewrote `CLAUDE.md` in the five-section shape. The Go, Testing, Changelog and
|
|
Branching text comes from the `go-project-bootstrap` skill references; the plan
|
|
ordering and execution-summary rules come from `egress-proxies-operator/CLAUDE.md`,
|
|
condensed from prose into bullets.
|
|
|
|
Deviations from the plan:
|
|
|
|
- The house container rules about Ubuntu dev images and separate dev/prod
|
|
Dockerfiles were left out: this repo has one production Dockerfile and no dev
|
|
image, and listing rules nobody follows only adds noise.
|
|
- The `listener-port` row was removed from the annotation table and moved to
|
|
Gotchas, so the table lists only what works.
|
|
- Added a short Reviews subsection so the reviewer agents and `docs/reviews/` have a
|
|
documented trigger.
|
|
- `README.md` also claimed that deleting a certificate removes its listeners
|
|
"instantly". Reworded and added the known limitation.
|
|
|
|
Worth noting: Commands and CI/CD describe the repo as it is at this commit; Steps 3,
|
|
4 and 6 update them. `docs/flows.md` cites `main.go` line numbers that Step 4 shifts.
|
|
|
|
## Step 2 — `.claude/` and docs scaffolding
|
|
|
|
Copied the two reviewer agents and `/ship` from `egress-proxies-operator/.claude/`.
|
|
`/release` was rewritten for the semver rule instead of copied, because the egress
|
|
text says "no tagging scheme is documented" and this repo now has one.
|
|
|
|
Deviations from the plan:
|
|
|
|
- `/ship` names "a `Co-Authored-By:` trailer for Claude" instead of the fixed
|
|
`Claude <noreply@anthropic.com>` string, matching CLAUDE.md.
|
|
- `.gitignore` already covered `/bin/` and `*.out`, so only
|
|
`.claude/settings.local.json` was added.
|
|
- `settings.json` also allows `kubectl kustomize`, which the Commands section uses.
|
|
|
|
Worth noting: `.claude/settings.json` leaves out `git commit`, `git push` and
|
|
`git tag` on purpose, but `~/.claude/settings.json` allows `git commit` and
|
|
`git push` globally, so on this machine the push confirmation rests on CLAUDE.md,
|
|
not on the permission system.
|
|
|
|
## Step 3 — Makefile, lint, formatting
|
|
|
|
Added `Makefile` (uh-cli's shape plus `run`, `docker-build` and `-race` on `test`),
|
|
`.golangci.yml` (v2 defaults) and `.dockerignore` (egress's allowlist).
|
|
|
|
`make lint` failed on first run, before reaching this repo's code:
|
|
|
|
```
|
|
$ golangci-lint run ./...
|
|
.../go/1.27.1/libexec/src/crypto/internal/randutil/randutil.go:11:2: could not import math/rand/v2
|
|
(.../math/rand/v2/rand.go:213:17: method must have no type parameters) (typecheck)
|
|
```
|
|
|
|
The installed golangci-lint 2.12.2 was built with go1.26.4 and cannot type-check the
|
|
Go 1.27 standard library. The `lint` target now runs under the go.mod toolchain,
|
|
which is also what CI uses:
|
|
|
|
```make
|
|
GO_MOD_VERSION := $(shell awk '$$1 == "go" {print $$2}' go.mod)
|
|
lint:
|
|
GOTOOLCHAIN=go$(GO_MOD_VERSION) golangci-lint run ./...
|
|
```
|
|
|
|
With that, lint reported the two expected dead variables (`gatewayGroup`,
|
|
`gatewayKind` in `patch.go`), which were removed. `make fmt` reformatted `main.go`
|
|
(import order) and the `patch.go` var block.
|
|
|
|
Worth noting: this is likely the same failure the egress changelog records as
|
|
"`make lint` is blocked by a Go 1.27 toolchain/staticcheck panic"; the same
|
|
`GOTOOLCHAIN` pin should unblock it there. Rebuilding golangci-lint with Go 1.27 is
|
|
the other fix. `.golangci.yml` carries no settings yet: uh-cli's `errcheck`
|
|
exclusions are CLI-specific and nothing here needed one.
|
|
|
|
## Step 4 — Module path and version identity
|
|
|
|
Module renamed to `gitea.home.hrajfrisbee.cz/kacerr/gatewayapi-certificates-operator`.
|
|
`internal/version` copied from egress unchanged (code and test). `main.go` gained
|
|
`--version`, a first log line with commit and Go version, the standard `--zap-*`
|
|
flags, and passes `--metrics-bind-address` to the manager.
|
|
|
|
```
|
|
$ make build && ./bin/manager --version
|
|
0eb588e8bd3a-dirty
|
|
$ make docker-build && docker run --rm gateway-cert-operator:dev --version
|
|
0eb588e8bd3a-dirty
|
|
$ docker inspect gateway-cert-operator:dev --format '{{index .Config.Labels "org.opencontainers.image.revision"}} {{.Config.User}}'
|
|
0eb588e8bd3a-dirty 65532:65532
|
|
```
|
|
|
|
Deviations from the plan:
|
|
|
|
- The Dockerfile build also got `-trimpath`, and keeps `-s -w` (egress has neither).
|
|
- The Dockerfile now does `COPY . .` and relies on the new `.dockerignore`
|
|
allowlist, instead of copying `main.go` and `internal/` by name.
|
|
- The `gozap.AddCaller()` option was kept so log lines look the same as before.
|
|
|
|
Worth noting: the manager was not started against a cluster in this step; the
|
|
flag wiring is verified by `--help` output and the build only. `GOARCH` defaults to
|
|
`amd64` when `TARGETARCH` is empty (legacy builder, as on the CI runner) and follows
|
|
the host under BuildKit, so a local build on an Apple Silicon machine is arm64.
|
|
`docs/flows.md` still cites pre-change `main.go` line numbers in §2.
|