Flags any contiguous comment block longer than 30 lines — the threshold
above which a why/impl-notes block should move to docs/ rather than live
in-code (the #2077 rubric, made self-enforcing).
- scripts/check-comment-blocks.sh: git+awk, mirrors check-issue-refs.sh's
capture-output shape (robust to xargs batching). Handles # line comments
(nix/sh), // line comments (rs/js/ts), and /* */ (rs/js/ts/css) + <!-- -->
(html) block comments. Blank separates line-comment blocks; a blank inside
a /* */ / <!-- --> block stays part of it. lint:allow-long-comment escape
hatch. Threshold is a tunable constant.
- ci.yml: own 'comment-block lint' job, kept OUT of required checks while the
tree settles (red signal, not a merge gate), like the tracker-tag lint.
Current tree has 6 blocks > 30 (all in the frontend + hive-c0re-core #2077
slices, none in nix/infra): matrix-accounts.js, permissions.js,
stream-worker.js, terminal.js, hivectl.rs:1036, assets.rs. Non-required, so
non-blocking — they're the remaining #2077 targets for those area owners.
Clean the legacy backlog so the tracker-tag lint can become a required
gate (mara's warn-during-cleanup -> full-tree-enforcement path). Rewrite
the ~33 real `closes/see #NNN` provenance refs in doc-comments to prose
across hive-forge, hive-c0re, hive-ag3nt, hive-matrix-mcp, hive-sh4re,
and add a `lint:allow` line marker to check-issue-refs.sh for genuine
non-tracker `#<digits>` (a hash-digit heading-detection test input).
Tree is now lint-clean; tracker-tag lint ready to promote to required.
The tracker-tag lint's trailing class `[^0-9a-fA-F]` treated a non-hex
letter as a valid terminator, so it flagged hash-route fragments like
#24h / #1h (the stats-page window-selector routes) as tracker tags — four
false positives in the frontend. A real tracker tag is never immediately
followed by a letter, so widen the trailing class to [^0-9a-zA-Z]: still
catches every real tag (followed by space / punctuation / EOL) while
excluding any digit-run glued to a letter. Letter-bearing and 6-8-digit
hex stay excluded as before.
Also write theme.css's --crust fallback in six-digit form (#000 -> #000000)
to dodge the one remaining pure-numeric-short-hex residual the lint
documents. Pixel-identical colour. With both, the frontend tree
contributes zero lint hits; only the legacy backlog (Rust) remains.
Pattern + cases reviewed and approved by atlas on the issue.
Per operator guidance: the required-status-checks config gates merge
on the nix flake check only, not this lint. So drop the warn|deny
mode — the lint just fails (exit 1, error annotations) when it finds
tracker tags, and runs as its own CI job so that failure shows red on
the PR without failing the required nix flake check job or blocking
merge. Once the legacy backlog is cleaned up, promoting this job to a
required check flips it to a hard gate — no code change.
The hive convention is prose, not tracker tags, in code, but it was
enforced only at review time — three PRs this session needed
request-changes purely for stray tags in new comments.
Add scripts/check-issue-refs.sh: scans tracked source (rust, nix, js,
ts, css, html; markdown exempt) for a hash followed by an issue number
and emits a CI warning annotation per hit. The pattern is a hash, 2-5
digits, then a non-hex char or end-of-line, so it skips CSS hex
colours (letter-bearing or six/eight-digit) while catching tags; a
pure-numeric short hex is the only residual false positive (dodge with
the six-digit form).
Wire it into the CI workflow as a fast pre-check before nix flake
check. It runs in warn mode (exit 0) so it does not block while the
legacy backlog is cleaned up; the script takes a warn|deny arg so the
later flip to a hard gate is a one-word change, not a rewrite — the
same rollout shape as tightening a clippy lint.
home-manager / nix-managed git configs ship the file from the nix
store, so `git config --global` errors out. catch the failure and
print the equivalent home-manager snippet instead of aborting — the
tea + netrc steps still want to run.
forge-create-token.sh mints an access token for an existing user
(prints to stdout — forgejo only shows it once). forge-login.sh
configures the operator's shell: git config --global user.name /
user.email, ~/.netrc entry for HTTP clones, and `tea login add`
when tea is on PATH. takes the token interactively (hidden input)
so it doesn't land in shell history.
