build: dev harness routing all builds through the digest-pinned builder

.gitignore

@@ -0,0 +1,5 @@
+# Credentials NEVER live in the repo. Any *.env landing here is ignored
+# as a tripwire (env.example is the only committed shape).
+*.env
+bin/
+.smoke/

Makefile

@@ -0,0 +1,19 @@
+# Makefile: thin front door over dev.sh so `make build/vet/test/check/smoke`
+# route through the digest-pinned Docker builder (ALL dev work in Docker —
+# the host never runs a Go toolchain).
+.PHONY: build vet test check smoke
+
+build:
+	@./dev.sh build
+
+vet:
+	@./dev.sh vet
+
+test:
+	@./dev.sh test
+
+check:
+	@./dev.sh check
+
+smoke:
+	@./dev.sh smoke

dev.sh

@@ -0,0 +1,56 @@
+#!/bin/sh
+# mopac-gitea-go dev wrapper. EVERY compile/vet/test path routes through
+# the digest-pinned Docker builder (same image as mopac-redmine-go,
+# mopac-bitwarden-go and mopac-keyproxy; the host runs containers, never
+# toolchains).
+#
+# Usage: ./dev.sh {build|vet|test|check|smoke|shell} [args...]
+#
+#   build    compile ./cmd/mgit into bin/mgit
+#   vet      go vet ./...
+#   test     go test ./... (all tests run against the in-process fake
+#            Gitea server; the real forge is NEVER contacted)
+#   check    build + vet + test (the pre-push gate)
+#   smoke    end-to-end smoke: builds, boots the fake Gitea in a
+#            container on 127.0.0.1:8602, drives the real CLI from the
+#            host through a 0600 env file (repo create/list, branch
+#            list, commit status, PR create/list/merge, -o json,
+#            redaction check on stderr), tears everything down
+#   shell    interactive sh inside the builder
+set -e
+
+IMAGE="golang@sha256:e8c859f5632dcfde7b32d2012b4351728f6437930887c2f6a91ea242459e5514" # = golang:1.26-bookworm (bash present; alpine lacks it)
+
+run() {
+    docker run --rm -v "$PWD:/h" -w /h \
+        -u "$(id -u):$(id -g)" -e HOME=/tmp -e GOFLAGS=-buildvcs=false \
+        "$IMAGE" "$@"
+}
+
+cmd=${1:-check}
+shift || true
+
+case "$cmd" in
+build)
+    run go build -o bin/mgit ./cmd/mgit
+    ;;
+vet)
+    run go vet ./...
+    ;;
+test)
+    run go test "$@" ./...
+    ;;
+check)
+    run sh -c 'go build -o bin/mgit ./cmd/mgit && go vet ./... && go test ./...'
+    ;;
+smoke)
+    ./smoke/smoke.sh
+    ;;
+shell)
+    run sh
+    ;;
+*)
+    echo "dev.sh: unknown command $cmd (build|vet|test|check|smoke|shell)" >&2
+    exit 1
+    ;;
+esac

gitea/doc.go

@@ -0,0 +1,13 @@
+// Package gitea is a stdlib-only client for the Gitea API (JSON over
+// /api/v1). It exists so the harness, the loop, and every vertical talk
+// to the forge through one Go library instead of shell glue: repo
+// create/list, branch list, commit statuses, and the full pull-request
+// flow (create/list/merge) — the surface the turn harness needs to land
+// work via PRs.
+//
+// Security discipline: the token travels ONLY in the
+// "Authorization: token <key>" header. Response bodies are never
+// surfaced in error strings (a server echo is assumed to be able to
+// carry the token), so errors are one-line, parseable
+// "sentinel: http NNN" shapes.
+package gitea

go.mod

@@ -0,0 +1,3 @@
+module git.knownelement.com/ukrrs/mopac-gitea-go
+
+go 1.26