From c3b86b16b74e0ee48d5a0ee7712ea706e86073b8 Mon Sep 17 00:00:00 2001
From: reachableceo <charles@turnsys.com>
Date: Sat, 29 Aug 2026 06:26:22 -0500
Subject: [PATCH] Add dev harness routing all builds through the digest-pinned
 builder

---
 .gitignore |  5 +++++
 Makefile   | 19 +++++++++++++++++++
 dev.sh     | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 go.mod     |  3 +++
 4 files changed, 82 insertions(+)
 create mode 100644 .gitignore
 create mode 100644 Makefile
 create mode 100755 dev.sh
 create mode 100644 go.mod

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..2faf672
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,5 @@
+# Credentials NEVER live in the repo. Any *.env landing here is ignored
+# as a tripwire (env.example is the only committed shape).
+*.env
+bin/
+.smoke/
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..cce9a33
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,19 @@
+# Makefile: thin front door over dev.sh so `make build/vet/test/check/smoke`
+# route through the digest-pinned Docker builder (ALL dev work in Docker —
+# the host never runs a Go toolchain).
+.PHONY: build vet test check smoke
+
+build:
+	@./dev.sh build
+
+vet:
+	@./dev.sh vet
+
+test:
+	@./dev.sh test
+
+check:
+	@./dev.sh check
+
+smoke:
+	@./dev.sh smoke
diff --git a/dev.sh b/dev.sh
new file mode 100755
index 0000000..cb2355f
--- /dev/null
+++ b/dev.sh
@@ -0,0 +1,55 @@
+#!/bin/sh
+# mopac-redmine-go dev wrapper. EVERY compile/vet/test path routes through
+# the digest-pinned Docker builder (same image as mopac-bitwarden-go and
+# mopac-keyproxy; the host runs containers, never toolchains).
+#
+# Usage: ./dev.sh {build|vet|test|check|smoke|shell} [args...]
+#
+#   build    compile ./cmd/mred into bin/mred
+#   vet      go vet ./...
+#   test     go test ./... (all tests run against the in-process fake
+#            Redmine server; the real tracker is NEVER contacted)
+#   check    build + vet + test (the pre-push gate)
+#   smoke    end-to-end smoke: builds, boots the fake Redmine in a
+#            container on 127.0.0.1:8601, drives the real CLI from the
+#            host through a 0600 env file (issue create/list/show/update,
+#            version + category + relation round-trips, -o json,
+#            redaction check on stderr), tears everything down
+#   shell    interactive sh inside the builder
+set -e
+
+IMAGE="golang@sha256:e8c859f5632dcfde7b32d2012b4351728f6437930887c2f6a91ea242459e5514" # = golang:1.26-bookworm (bash present; alpine lacks it)
+
+run() {
+    docker run --rm -v "$PWD:/h" -w /h \
+        -u "$(id -u):$(id -g)" -e HOME=/tmp -e GOFLAGS=-buildvcs=false \
+        "$IMAGE" "$@"
+}
+
+cmd=${1:-check}
+shift || true
+
+case "$cmd" in
+build)
+    run go build -o bin/mred ./cmd/mred
+    ;;
+vet)
+    run go vet ./...
+    ;;
+test)
+    run go test "$@" ./...
+    ;;
+check)
+    run sh -c 'go build -o bin/mred ./cmd/mred && go vet ./... && go test ./...'
+    ;;
+smoke)
+    ./smoke/smoke.sh
+    ;;
+shell)
+    run sh
+    ;;
+*)
+    echo "dev.sh: unknown command $cmd (build|vet|test|check|smoke|shell)" >&2
+    exit 1
+    ;;
+esac
diff --git a/go.mod b/go.mod
new file mode 100644
index 0000000..632b9c9
--- /dev/null
+++ b/go.mod
@@ -0,0 +1,3 @@
+module git.knownelement.com/ukrrs/mopac-redmine-go
+
+go 1.26