Rodin
70267b68f4
PR Ready Gate / clear-labels (pull_request) Successful in 2s
CI / test (pull_request) Successful in 14s
CI / review (anthropic--claude-4.6-sonnet, sonnet, SONNET_REVIEW_TOKEN) (pull_request) Successful in 32s
CI / review (gpt-5, gpt, GPT_REVIEW_TOKEN) (pull_request) Successful in 1m27s
CI / review (gpt-5, security, SECURITY_REVIEW.md, SECURITY_REVIEW_TOKEN) (pull_request) Successful in 1m28s
Fixes: - Single source of truth: script now parses allowlist from CONVENTIONS.md - Fail closed: script exits non-zero if 'go list' fails - Direct deps only: uses '-f' flag to exclude transitive deps - Added 'precommit' to .PHONY in Makefile - Removed unused ALLOWED_PATTERN variable - Added Scope column to distinguish test-only vs production deps - Clarified that transitive deps of approved packages are allowed - Added note that enforcement script parses the table
51 lines
1.5 KiB
Markdown
51 lines
1.5 KiB
Markdown
# Conventions
|
|
|
|
## Language & Dependencies
|
|
|
|
- Target the latest stable Go release.
|
|
- **STRICT ALLOWLIST:** Only packages listed below may be imported. No exceptions.
|
|
|
|
### Approved Third-Party Packages
|
|
|
|
| Package | Use Case | Scope |
|
|
|---------|----------|-------|
|
|
| `gopkg.in/yaml.v3` | YAML parsing (persona files, config) | production |
|
|
| `github.com/google/go-cmp` | Test comparisons (`cmp.Diff`) | test only |
|
|
|
|
**Any import not in this table or the Go standard library is forbidden.**
|
|
|
|
Transitive dependencies of approved packages are automatically allowed.
|
|
|
|
To request a new dependency:
|
|
1. Open a PR that ONLY updates this table
|
|
2. Requires explicit approval from Aaron
|
|
3. After merge, a separate PR may use the package
|
|
|
|
*Enforcement: `scripts/check-deps.sh` parses this table — update only here.*
|
|
|
|
## Error Handling
|
|
|
|
- Return errors; never panic.
|
|
- Wrap errors with context using `fmt.Errorf("context: %w", err)`.
|
|
- Check all error returns.
|
|
|
|
## Testing
|
|
|
|
- Test every exported function.
|
|
- Use `net/http/httptest` for HTTP mocking.
|
|
- Table-driven tests where multiple inputs share the same assertion logic.
|
|
- Integration tests use build tags (`//go:build integration`).
|
|
|
|
## Style
|
|
|
|
- Keep functions short and focused.
|
|
- Prefer early returns over deep nesting.
|
|
- Meaningful variable names — no single-letter names outside loop indices.
|
|
- Comments explain *why*, not *what*.
|
|
|
|
## Process
|
|
|
|
- `go test ./...` must pass before commit.
|
|
- `go vet ./...` must pass before commit.
|
|
- Keep commits atomic and well-described.
|