4 Commits

Include renames

Author	SHA1	Message	Date
Rodin	01cde16d47	fix: validate all deps and improve robustness ... Addresses GPT review feedback: 1. MAJOR - Test deps now validated: All direct module deps (from go.mod) are checked against the allowlist, whether used in prod or tests. 2. MINOR - Prefix match: Uses grep -E with word boundary (^pkg(/|$|$)) to avoid false positives on similarly-prefixed modules. 3. MINOR - Bash version check: Script now fails early with helpful message if Bash < 4 (macOS default). Added shebang: #!/usr/bin/env bash 4. NIT - Removed redundant grep -v '_test' (go list -deps already excludes test-only deps without -test flag).	2026-05-10 14:02:06 -07:00
Rodin	aeb0c8cb79	fix: enforce Scope column and improve portability ... Addresses review feedback: 1. MAJOR - Scope enforcement: Script now parses the Scope column and ensures 'test only' packages don't appear in non-test code. Uses 'go list -deps' to check production imports. 2. MINOR - Portability: Replaced 'grep -P' (GNU-only) with awk-based parsing that works on macOS/BSD. 3. MINOR - Robustness: Table parsing uses awk to split on '|' and extract columns properly, handling whitespace variations. 4. MINOR - Glob safety: Prefix matching now uses parameter expansion instead of glob patterns to prevent metacharacter issues.	2026-05-10 13:57:49 -07:00
Rodin	70267b68f4	fix: address review feedback on dependency allowlist ... Fixes: - Single source of truth: script now parses allowlist from CONVENTIONS.md - Fail closed: script exits non-zero if 'go list' fails - Direct deps only: uses '-f' flag to exclude transitive deps - Added 'precommit' to .PHONY in Makefile - Removed unused ALLOWED_PATTERN variable - Added Scope column to distinguish test-only vs production deps - Clarified that transitive deps of approved packages are allowed - Added note that enforcement script parses the table	2026-05-10 13:53:55 -07:00
Rodin	4b96231b32	docs: strict dependency allowlist with CI enforcement ... STRICT ALLOWLIST policy: Only packages explicitly listed in CONVENTIONS.md may be imported. No exceptions. ## Changes - Updates CONVENTIONS.md with strict allowlist language - Adds scripts/check-deps.sh to enforce the allowlist - Adds 'make check-deps' and 'make precommit' targets - CI will fail if any unapproved dependency is detected ## Approved packages - gopkg.in/yaml.v3 — YAML parsing - github.com/google/go-cmp — test comparisons ## Process for new dependencies 1. Open a PR that ONLY updates CONVENTIONS.md 2. Requires explicit approval from Aaron 3. After merge, a separate PR may use the package	2026-05-10 13:45:12 -07:00