Repository navigation
docs: document CI-faithful lint one-liner using ci-slim - #7533
PastaPastaPasta merged 1 commit into
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review. WalkthroughAdded Docker instructions to Updated the lint images to verify and build Cppcheck 2.21.0. Updated ShellCheck installation to select Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to This PR adds a pinned cppcheck build and documents a CI-faithful local lint command; the reported builds and end-to-end lint run succeeded, so no actionable merge-blocking risk remains beyond normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
✅ Final review complete — Phase 1 only — no blockers (commit f6c7277) · triage: trivial |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bf43d43bb7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
bf43d43 to
4de30bb
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4de30bb3a6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
AGENTS.md (1)
145-145: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winScope Git trust to the mounted worktree.
safe.directory "*"treats every repository in the container as safe. Scope the exception to the mounted worktree instead.
AGENTS.md#L145-L145: replacesafe.directory "*"withsafe.directory "$PWD".CLAUDE.md#L145-L145: replacesafe.directory "*"withsafe.directory "$PWD".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@AGENTS.md` at line 145, Scope Git’s safe-directory exception to the mounted worktree by replacing the wildcard with "$PWD" in the docker lint command; apply this change in AGENTS.md at lines 145-145 and CLAUDE.md at lines 145-145.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@AGENTS.md`:
- Line 145: Scope Git’s safe-directory exception to the mounted worktree by
replacing the wildcard with "$PWD" in the docker lint command; apply this change
in AGENTS.md at lines 145-145 and CLAUDE.md at lines 145-145.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b205ea4a-712a-4e42-8c0e-9d3f2aae14b9
📒 Files selected for processing (2)
AGENTS.mdCLAUDE.md
4de30bb to
97ad6fb
Compare
PastaPastaPasta
changed the title
|
Addressed all three Codex findings:
🤖 Posted autonomously by Claude on behalf of pasta. |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
ci/lint/Dockerfile (1)
21-26: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winVerify the Cppcheck archive before building it.
Both
ci/lint/Dockerfileandcontrib/containers/ci/ci-slim.Dockerfiledownloadcppcheck/${CPPCHECK_VERSION}.tar.gzinto a build container and run CMake without integrity or signature validation. Pin the archive to the intended commit and check the digest or signature beforetar, so a moved tag or compromised archive cannot execute build-time code and place a modifiedcppcheckbinary in the lint image.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci/lint/Dockerfile` around lines 21 - 26, Update the Cppcheck download-and-build flow in the Dockerfile, and apply the same change to the corresponding ci-slim.Dockerfile flow: pin the archive to the intended immutable commit and verify its expected digest or signature before extracting it with tar or running CMake. Keep the existing build steps unchanged after validation succeeds.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@ci/lint/Dockerfile`:
- Around line 21-26: Update the Cppcheck download-and-build flow in the
Dockerfile, and apply the same change to the corresponding ci-slim.Dockerfile
flow: pin the archive to the intended immutable commit and verify its expected
digest or signature before extracting it with tar or running CMake. Keep the
existing build steps unchanged after validation succeeds.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: a6b472b8-3f00-4890-991f-c04a6b5209de
📒 Files selected for processing (3)
AGENTS.mdCLAUDE.mdci/lint/Dockerfile
🚧 Files skipped from review as they are similar to previous changes (2)
- AGENTS.md
- CLAUDE.md
|
Prepared the follow-up for the new Codex/CodeRabbit findings, but the active Final two-commit branch, rebased onto current
Validation passed: docs remain identical, To update this PR while preserving the intended two-commit history, the branch owner can fetch |
thepastaclaw
left a comment
thepastaclaw
left a comment
There was a problem hiding this comment.
Final validation — Codex + Sonnet
The cppcheck builder correctly mirrors the existing CI builder and enables a lint that previously self-skipped in the local image. The documented workflow still needs adjustments for ARM hosts, bind-mount ownership, and placement of its destructive-operation warning, and the commits should be reordered so the documentation is accurate at every point in history. No blocking correctness defects were found.
Review provenance
- Codex reviewers:
gpt-5.6-sol— general (completed),gpt-5.6-sol— dash-core-commit-history (completed) - Verifier:
gpt-5.6-sol— final-verifier (fallback) - Sonnet reviewers:
claude-sonnet-5— general (failed),claude-sonnet-5— dash-core-commit-history (completed),claude-sonnet-5— general (failed),claude-sonnet-5— general (completed)
🟡 4 suggestion(s)
1 additional finding(s) omitted (not in diff).
🤖 Prompt for all review comments with AI agents
These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.
In `AGENTS.md`:
- [SUGGESTION] AGENTS.md:141: Force the CI architecture for the lint image
This build selects the host architecture, while `ci/lint/04_install.sh` unconditionally downloads the x86_64 ShellCheck executable. On a native arm64 host without x86 binary emulation, the image builds successfully but `lint-shell.py` later fails with an exec-format error. Since the CI lint job runs on amd64, pin this workflow to `linux/amd64`, or make the installer select ShellCheck using the target architecture as `ci-slim.Dockerfile` already does. Apply the same correction to the mirrored section in `CLAUDE.md`.
- [SUGGESTION] AGENTS.md:145: Run the bind-mounted lint job as the host user
The lint image has no `USER` directive and this invocation supplies no `--user`, so it writes through the native Linux bind mount as UID 0. The lint suite creates `test/.mypy_cache` and `ci-cache-linux64/cppcheck`, leaving root-owned cache contents that subsequent host-side runs cannot update or remove recursively without elevated privileges. CI also runs its container as root, but its checkout is disposable rather than a contributor's live working tree. Run the local container with the host UID/GID and a writable `HOME`, and apply the same correction to `CLAUDE.md`.
- [SUGGESTION] AGENTS.md:139-155: Put the destructive-operation warning before the copy-pasteable command
With `PULL_REQUEST=true`, `ci/dash/lint.sh` invokes `commit-script-check.sh`. If the selected range contains a `scripted-diff:` commit, that script checks out the parent and executes `git reset --hard` against the live bind-mounted working tree, which can erase dirty tracked changes that survive the checkout. The documentation discloses this only after the command users and agents are expected to copy. Move the commit-or-stash warning above the command or add a clean-working-tree preflight to the command itself. Make the same change in `CLAUDE.md`.
In `<commit:e37b1d5>`:
- [SUGGESTION] <commit:e37b1d5>:1: Place the cppcheck implementation before documentation that depends on it
Commit `e37b1d5` states that the lint image builds cppcheck and reproduces CI with pinned tools, but the Dockerfile does not acquire cppcheck until its child commit `97ad6fb`. Checking out or bisecting to the documentation commit therefore leaves an inaccurate command whose cppcheck lint still self-skips. Reorder the cppcheck implementation before the documentation commit, or squash the two commits so every retained commit is internally accurate.
97ad6fb to
04d86ab
Compare
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Pushed
Since the claw had no Docker daemon, the scoped 🤖 Posted autonomously by Claude on behalf of pasta. |
04d86ab to
0523bda
Compare
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Restacked on #7535 ( Changes in the restack:
Re-validated end-to-end on the stacked branch from a git worktree (macOS, Docker 29.4.0): digest check passes during build, The base stays 🤖 Posted autonomously by Claude on behalf of pasta. |
|
This pull request has conflicts, please rebase. |
thepastaclaw
left a comment
thepastaclaw
left a comment
There was a problem hiding this comment.
Final validation — Codex/Sol only (Phase 2 disabled)
At exact head be798c6, the two-commit PR correctly aligns the local lint image with CI and documents the resulting workflow; no in-scope defects remain. All six prior findings are verified fixed in the current source and retained commit order.
Source: codex-general reviewer backend gpt-5.6-sol; codex-dash-core-commit-history reviewer backend gpt-5.6-sol; final verifier backend gpt-5.6-sol. openclaw-agent/cliproxy/gpt-5.6-sol is orchestration-only and is not reviewer evidence.
Validated zero-blocker Codex/Sol precheck evidence was promoted to final because Phase 2 (Sonnet/Opus) is temporarily disabled. This is Codex/Sol-only final validation, not Codex + Sonnet/Opus coverage.
Review provenance
- Codex reviewers:
gpt-5.6-sol— general (completed),gpt-5.6-sol— dash-core-commit-history (completed) - Verifier:
gpt-5.6-sol— verifier - Sonnet/Opus: not run (Phase 2 disabled — temporary Codex/Sol-only final)
- Secondary pass: disabled (
temporary_phase2_sonnet_disable)
be798c6 to
22e900e
Compare
thepastaclaw
left a comment
thepastaclaw
left a comment
There was a problem hiding this comment.
Final validation — Codex/Sol only (Phase 2 disabled)
At exact head 22e900e, the local lint image matches CI's cppcheck 2.21.0 builder, verifies the archive digest, and selects the correct ShellCheck artifact for supported architectures. The byte-identical agent guides accurately document the CI lint entry point, environment, worktree mounts, host ownership, architecture pinning, local develop requirement, and scripted-diff safety warning; no in-scope defects were found. Source: codex-general and codex-dash-core-commit-history reviewer backend gpt-5.6-sol; final verifier backend gpt-5.6-sol. openclaw-agent/cliproxy/gpt-5.6-sol is orchestration-only and not reviewer evidence.
Validated zero-blocker Codex/Sol precheck evidence was promoted to final because Phase 2 (Sonnet/Opus) is temporarily disabled. This is Codex/Sol-only final validation, not Codex + Sonnet/Opus coverage.
Review provenance
- Codex reviewers:
gpt-5.6-sol— general (completed),gpt-5.6-sol— dash-core-commit-history (completed) - Verifier:
gpt-5.6-sol— verifier - Sonnet/Opus: not run (Phase 2 disabled — temporary Codex/Sol-only final)
- Secondary pass: disabled (
temporary_phase2_sonnet_disable)
| cmake \ | ||
| make \ | ||
| g++ \ | ||
| && rm -rf /var/lib/apt/lists/*; \ |
There was a problem hiding this comment.
don't forget "", especially around "*", especially in the same line with rm, especially as an argument of "rm -rf"
There was a problem hiding this comment.
The flagged line was && rm -rf /var/lib/apt/lists/* in the cppcheck builder stage. There is no variable expansion on it, so there is nothing to word-split, and quoting the * would turn off the glob: rm -rf "/var/lib/apt/lists/*" targets a file literally named * and, because of -f, silently removes nothing.
That said, the builder stage is thrown away (only the cppcheck binary and cfg/ are copied out), so cleaning its apt lists was pointless anyway. After the rebase onto ci/lint_imagefile (366544d) I dropped that cleanup from the lint image's builder, so the line no longer exists in this PR. The identical line in ci-slim.Dockerfile is unchanged from develop and not touched here. I'm leaving this thread open so you can confirm.
🤖 Posted autonomously by Codex on behalf of pasta.
| # contrib/containers/ci/ci-slim.Dockerfile so results match the CI lint job. | ||
| FROM debian:bookworm-slim AS cppcheck-builder | ||
| ARG CPPCHECK_VERSION=2.21.0 | ||
| ARG CPPCHECK_ARCHIVE_SHA256=f028ff75ca5372738f3737c8b3e8611426a6526b6aea2ef01301ab0f5902f044 |
There was a problem hiding this comment.
is it copy-paste of ci-slim.Dockerfile?
So, now 2 files need to be bumped in case if version is changed. Try to avoid code duplication here.
Also, why ci-clim can't be used directly to run linters? Looks like perfect match, why not?
There was a problem hiding this comment.
Yes, the builder stage is a copy of the one in ci-slim.Dockerfile, so the cppcheck version and digest now need bumping in two places. The Python tool pins already work this way: 04_install.sh carries a NOTE: BUMP ALSO contrib/containers/ci/ci-slim.Dockerfile. Docker can't share a stage between two Dockerfiles without extra tooling (bake files or named build contexts), so removing the duplication really means picking one image.
Using ci-slim directly would work, and it would match CI by construction because it is the image the CI lint job runs in (.github/workflows/lint.yml). Build it with docker build --platform=linux/amd64 -f contrib/containers/ci/ci-slim.Dockerfile -t dash-ci-slim contrib/containers/ci and use the same docker run command. The trade-offs:
ci-slimis the general slim CI image (Ubuntu noble, build-essential, LLVM 19 dev for sanitizer builds, dash_hash), so it is much heavier to build locally than the lint-only image.- The documented image would no longer be the
ci/lint_imagefilefrom the ci: Use DOCKER_BUILDKIT for lint image bitcoin/bitcoin#28083 backport, and the cppcheck stage this PR adds there would be dropped.
On your later question about reusing the backport's image: after the rebase this PR does exactly that. The old ci/lint/Dockerfile is gone and the cppcheck stage now sits in ci/lint_imagefile.
Which image to standardise on is a judgement call, so I've flagged it for pasta and left this thread open rather than switching approaches in a rebase.
🤖 Posted autonomously by Codex on behalf of pasta.
There was a problem hiding this comment.
Agreed, switched to ci-slim directly in f6c7277. The PR is now a single docs commit:
test/lint/README.mdbuildsci-slimfromcontrib/containers/ci/ci-slim.Dockerfilewith the same context CI uses, then runs./ci/dash/lint.shinside it with the envlint.ymlsets (BUILD_TARGET=linux64,CHECK_DOC=1,PULL_REQUEST=true,COMMIT_RANGEfrommerge-base develop HEAD). The only deliberate differences: it runs as the host user instead of--user rootso files stay owned by you, andCACHE_DIRpoints at the git-ignoredci/scratch/cache/instead of/cache. The worktree mount,safe.directoryand dirty-tree warning are unchanged.- The cppcheck builder stage in
ci/lint_imagefileis gone, so the cppcheck version only lives inci-slim.Dockerfile. I also dropped the other image tweaks: the checksum pin inci-slim.Dockerfile(it would also change the hash CI uses in cache keys) and the ShellCheck architecture change inci/lint/04_install.sh(Bitcoin Core still has the x86_64-only line, so it would only add a backport divergence in a flow we no longer point people to). ci-slimis built for amd64 and arm64 in CI, so the docs build it natively with no--platformemulation.
Tested locally on Apple Silicon (OrbStack): the image builds natively and the documented command run verbatim from a worktree exits 0. All 21 linters pass, including shellcheck and cppcheck, and the only output is the same non-fatal codespell list CI prints on develop. A rerun takes cppcheck about 10 s with the cache.
Leaving this open for you to resolve.
🤖 Posted autonomously by Codex on behalf of pasta.
|
This pull request has conflicts, please rebase. |
|
Should be Docker image from this backport re-used?
|
22e900e to
49ca342
Compare
|
Rebased onto develop
One question is still open: whether to drop the mirrored builder and document 🤖 Posted autonomously by Codex on behalf of pasta. |
thepastaclaw
left a comment
thepastaclaw
left a comment
There was a problem hiding this comment.
Re-review — Final validation — Phase 1 + Phase 2
Verified the complete two-commit diff at head 49ca342. The cppcheck builders and ShellCheck architecture mapping are consistent with CI, and the documented invocation addresses worktree mounts, host ownership, and scripted-diff hazards; the only confirmed finding is minor cache-directory hygiene. This was a static review: the supplied CI snapshot shows both slim-container architecture builds passing, while lint and four source-build jobs remain pending.
💬 1 nitpick(s)
Review provenance
Source: reviewer 1: glm-5.3-flash (agent: phase1-reviewer, role: general); reviewer 2: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 3: gpt-6.1-sol (agent: phase2-reviewer, role: dash-core-commit-history); reviewer 4: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 5: gpt-6.1-sol (agent: phase2-reviewer, role: dash-core-commit-history); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)
- Triage:
lowbygpt-6.1-sol(effort low) — The diff makes small, contained CI tooling changes to install and verify cppcheck, select the correct ShellCheck architecture, and document matching local lint execution, without changing critical runtime behavior. - Phase 1 reviewers:
glm-5.3-flash— general (completed, effort high); agentphase1-reviewer - Phase 1 model:
glm-5.3-flash— zai quota: 5h 99% left, weekly 69% left; passed overgemini-3.8-flash-high(antigravity below 15% reserve: weekly 15% left, 5h 100% left) - Fresh final gate: an independent Phase-2 review ran after iterative findings were reconciled
- Fresh verifier:
gpt-6.1-sol— final-verifier; agentsol-verifier - Phase 2 reviewers:
gpt-6.1-sol— general (completed, effort medium); agentphase2-reviewer,gpt-6.1-sol— dash-core-commit-history (completed, effort medium); agentphase2-reviewer,gpt-6.1-sol— general (completed, effort medium); agentphase2-reviewer,gpt-6.1-sol— dash-core-commit-history (completed, effort medium); agentphase2-reviewer
🤖 Prompt for all review comments with AI agents
These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.
In `test/lint/README.md`:
- [NITPICK] test/lint/README.md:41-42: Keep the documented lint cache out of git status
The new invocation sources ci/test/00_setup_env.sh through ci/dash/matrix.sh, which defaults CACHE_DIR to the mounted repository's ci-cache-linux64 directory. The cppcheck linter creates files there, but no repository ignore rule covers that path; git check-ignore also confirms it is unignored. Following the documented workflow therefore leaves generated cache files visible in git status and available for accidental staging. Add /ci-cache-*/ to .gitignore, or direct the documented run's CACHE_DIR to an already ignored location while preserving cache reuse.
thepastaclaw
added
the
pastaclaw:commented
Running test/lint scripts on the host uses local tool versions, and the ci/lint_imagefile container diverges from CI: its entrypoint merge-bases against master, runs check-doc/subtree checks CI has disabled, and has no cppcheck. The CI lint job runs ci/dash/lint.sh inside the ci-slim image. Document in test/lint/README.md how to build ci-slim and run ci/dash/lint.sh with the environment lint.yml sets, as the host user, from a repository or git worktree, with the cppcheck cache in the ignored ci/scratch directory. Point the agent guides at it. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
49ca342 to
f6c7277
Compare
PastaPastaPasta
changed the title
thepastaclaw
removed
the
pastaclaw:commented
thepastaclaw
left a comment
thepastaclaw
left a comment
There was a problem hiding this comment.
Re-review — Final review — Phase 1 only (trivial change)
Verified the supplied Codex evidence against exact head f6c7277: the documentation matches the CI image, lint entrypoint, and required environment, with deliberate local differences explained. The prior cache finding is fixed, and no in-scope findings remain. This was a static review; the supplied CI snapshot shows lint and both slim-container architecture builds passing, while six dependency-build jobs were still running.
🔴 0 blocking | 🟡 0 suggestion(s) | 💬 0 nitpick(s)
Review provenance
Source: reviewer 1: glm-5.3-flash (agent: phase1-reviewer, role: general); reviewer 2: glm-5.3-flash (agent: phase1-reviewer, role: dash-core-commit-history); final verifier: gpt-6.1-sol (agent: sol-gate-verifier, role: final-verifier)
- Triage:
trivialbygpt-6.1-sol(effort low) — The diff only adds documentation for reproducing CI lint locally and matching pointers in the agent guides, without changing code, tooling, or CI behavior. - Phase 1 reviewers:
glm-5.3-flash— general (completed, effort high); agentphase1-reviewer,glm-5.3-flash— dash-core-commit-history (completed, effort high); agentphase1-reviewer - Phase 1 model:
glm-5.3-flash— zai quota: 5h 99% left, weekly 69% left; passed overgemini-3.8-flash-high(antigravity below 15% reserve: weekly 15% left, 5h 100% left) - Fresh verifier:
gpt-6.1-sol— final-verifier; agentsol-gate-verifier - Phase 2 reviewers: not run (triage rated this change trivial); this review comments and never approves
🤖 Prompt for all review comments with AI agents
These findings are from an automated code review. Verify the current code and confirm that no unresolved issues remain.
No unresolved findings remain from the prior review on this head.
thepastaclaw
removed
the
pastaclaw:commented
3 participants
Issue being fixed or feature implemented
Local lint runs frequently disagree with CI, which slows down and confuses both human contributors and coding agents:
test/lint/*scripts on the host uses whatever tool versions happen to be installed locally, while CI pins specific versions of codespell/flake8/mypy/shellcheck/cppcheck.test/lint/README.md(ci/lint_imagefileplus a baredocker run) is not CI-faithful either: its default entrypoint (ci/lint/06_script.sh) merge-bases againstmasterinstead ofdevelop, runscheck-doc.pyplus git-subtree checks that the CI lint job (ci/dash/lint.sh) has disabled, and the image has no cppcheck, solint-cppcheck-dash.pysilently self-skips.The CI lint job (
.github/workflows/lint.yml) runsci/dash/lint.shinside theci-slimimage (contrib/containers/ci/ci-slim.Dockerfile). Running that same image locally is CI-faithful by construction and needs no second copy of any tool version.What was done?
A single documentation commit:
test/lint/README.mdthat buildsci-slimfromcontrib/containers/ci/ci-slim.Dockerfile(the same file and context CI uses) and runsci/dash/lint.shwith the environmentlint.ymlsets:BUILD_TARGET=linux64,CHECK_DOC=1,PULL_REQUEST=trueand aCOMMIT_RANGEfrommerge-base develop HEAD.HOME=/tmpinstead of--user root, so files it writes stay owned by the user; Git trust is scoped to the mounted worktree viasafe.directory(as CI does); a second mount of the git common dir makes it work from git worktrees; andCACHE_DIRpoints at the git-ignoredci/scratch/cache/instead of CI's/cache, so cppcheck reruns are fast without leaving untracked files ingit status.commit-script-check.shresets the worktree and executes scripted-diff verification commands, so tracked changes must be committed or stashed first and it should only be run against trusted commits.ci-slimis built for bothlinux/amd64andlinux/arm64in CI, so the documented build is native (no--platformemulation).AGENTS.md/CLAUDE.md(kept identical).Earlier revisions of this PR added a cppcheck builder stage to
ci/lint_imagefile, an architecture-aware ShellCheck download inci/lint/04_install.sh, and a cppcheck archive checksum inci-slim.Dockerfile. Those were dropped following review: usingci-slimdirectly removes the need to duplicate the cppcheck version, and the remaining tweaks would make Dash diverge from Bitcoin Core inci/lint/04_install.sh(and change theci-slimhash used in CI cache keys) without serving the documented flow.How Has This Been Tested?
ci-slimnatively (linux/arm64) on an Apple Silicon host with OrbStack (Docker 29.4.0) using the documenteddocker buildcommand.docker runcommand verbatim from a git worktree whose localdevelopmatcheddashpay/dashdevelop: exit 0. Output is the same non-fatal codespell warning list CI prints on develop; all 21 linters exited 0, includinglint-shell.pyandlint-cppcheck-dash.py(cppcheck actually ran, ~264 s cold).ci/scratch/cache/are owned by the host user andgit statusstays clean.test/lint/lint-shell.py,test/lint/lint-whitespace.pyandgit diff --checkpass;AGENTS.mdandCLAUDE.mdare byte-identical.Breaking Changes
None.
Checklist:
🤖 Generated with Claude Code