Across one superproject's 39 submodules, four toolchain hooks are declared as repo: local entries and hand-copied:
go-test — 24 repositoriesgo-vet — 24gofmt — 24go-build — 22
They are byte-identical apart from one broken variant, and that variant is the argument. Two repositories declare a gofmt entry that can never exit nonzero, because gofmt -l prints the files it would reformat and exits 0 regardless. Twenty-two copies enforce; two report Passed over unformatted code. Nothing compares a copy against its siblings, so the fork was invisible until a fleet audit read all 24 side by side.
A published hook id turns 24 declarations into 24 pins. A pin can drift only in one dimension — the rev — and that dimension already has a check (no-stale-hook-pins). A copied entry: line can drift in every dimension and has no check at all.
Ask
Publish the four ids from this repository (or a companion hook repo) so adopters pin rather than transcribe. The gofmt id in particular should be written once, correctly — test -z "$(gofmt -l .)" or equivalent — rather than 24 times hopefully.
Related: #11 proposes uphold probe, which is what would have caught the broken gofmt copies at the moment they were written rather than at audit time. The two are complementary: publishing removes the chance to fork, probing catches a fork that predates the publishing.
Across one superproject's 39 submodules, four toolchain hooks are declared as
repo: localentries and hand-copied:go-test— 24 repositoriesgo-vet— 24gofmt— 24go-build— 22They are byte-identical apart from one broken variant, and that variant is the argument. Two repositories declare a
gofmtentry that can never exit nonzero, becausegofmt -lprints the files it would reformat and exits 0 regardless. Twenty-two copies enforce; two reportPassedover unformatted code. Nothing compares a copy against its siblings, so the fork was invisible until a fleet audit read all 24 side by side.A published hook id turns 24 declarations into 24 pins. A pin can drift only in one dimension — the rev — and that dimension already has a check (
no-stale-hook-pins). A copiedentry:line can drift in every dimension and has no check at all.Ask
Publish the four ids from this repository (or a companion hook repo) so adopters pin rather than transcribe. The
gofmtid in particular should be written once, correctly —test -z "$(gofmt -l .)"or equivalent — rather than 24 times hopefully.Related: #11 proposes
uphold probe, which is what would have caught the brokengofmtcopies at the moment they were written rather than at audit time. The two are complementary: publishing removes the chance to fork, probing catches a fork that predates the publishing.