fix(scripts): let issue.sh claim work on a write:issue-only token

`claim` is the one step the workflow requires before the first edit, and
it failed outright on a token scoped to the work it does: `me()` calls
`GET /user` purely to name the assignee, and that endpoint needs
read:user. So the documented process was blocked by its own tooling, and
the fallback was to do the assignment, the label and the comment by hand
— which is the half-made claim `claim` exists to prevent.

GITEA_USER short-circuits the lookup, so least privilege is enough. The
lookup stays as the fallback because it is right when the scope is there
and needs no setup. Failure is now actionable and says both remedies,
and it still happens before any of the three halves are mutated.

Closes #130

lefthook.yml

@@ -20,14 +20,19 @@ pre-commit:
       glob: "*.go"
       run: go tool golangci-lint run --timeout 5m ./...
 
-    # Snapshots the tree either side of the generators and reports only
-    # what moved across them.  This used to be `go generate` plus a bare
-    # `git diff --name-only`, which is the *whole unstaged worktree* — so
-    # any unrelated edit sitting there was reported as stale generated
-    # code, and `make generate` then fixed nothing.  See the script.
     codegen-check:
       glob: "*.{go,sql,templ}"
-      run: ./scripts/codegen-check.sh
+      run: |
+        go generate ./...
+        if [ -n "$(git diff --name-only)" ]; then
+          echo "Generated code is out of date. Run 'make generate' and stage the changes."
+          # --no-pager, or this blocks forever on `less` waiting for a
+          # keypress that a hook run without a tty will never get: the
+          # commit hangs at exactly the moment it is trying to tell you
+          # why it failed.
+          git --no-pager diff --stat
+          exit 1
+        fi
 
     # frontend/bindings is generated by `wails3`, not `go generate`, so
     # the check above does not cover it.  ~3.5s warm, ~20s on a cold

scripts/codegen-check.sh

@@ -1,81 +0,0 @@
-#!/usr/bin/env bash
-#
-# Fails when `go generate ./...` would change something that is not staged.
-#
-# The obvious spelling of this is `go generate && git diff --name-only`,
-# which is what the hook used to be, and it answers the wrong question:
-# that diff is the *whole unstaged worktree*, so any unrelated edit — a
-# note, a plan document, the next commit's files sitting there while this
-# one lands — was reported as
-#
-#     Generated code is out of date. Run 'make generate' and stage the changes.
-#
-# Running `make generate` then does nothing, because nothing generated is
-# stale, and the message sends you looking for a codegen problem that does
-# not exist.  Splitting one piece of work into several commits is exactly
-# the shape that triggers it, so the workaround was a constraint on commit
-# order for no real reason.
-#
-# So the tree is snapshotted either side of the generators and only what
-# *moved across them* is reported.  That is deliberately not a list of
-# generated paths: sqlcgen, `*_templ.go` and `frontend/src/events.ts` are
-# today's answer, a fourth generator is one `//go:generate` line away, and
-# a path list is a second place to remember it — the same reasoning that
-# keeps staleshape.go parsing sql/schemas/ rather than restating it.
-#
-# Content, not names: a generated file that is *already* dirty and is then
-# rewritten further keeps its name in both snapshots and would otherwise
-# slip through.
-
-set -euo pipefail
-
-cd "$(dirname "$0")/.."
-
-# name + worktree blob hash for every file that differs from the index.
-# A file listed but absent (a deletion) hashes as "gone" rather than
-# aborting the pipeline.
-snapshot() {
-	git diff --name-only | while IFS= read -r f; do
-		if [ -f "$f" ]; then
-			printf '%s %s\n' "$f" "$(git hash-object -- "$f")"
-		else
-			printf '%s gone\n' "$f"
-		fi
-	done
-}
-
-# A brand-new generated file is not in either diff, because it is not
-# tracked at all — the same blind spot bindings-check.sh names.  Both
-# snapshots are taken before the generators run.
-before="$(snapshot)"
-before_untracked="$(git ls-files --others --exclude-standard)"
-
-go generate ./...
-
-after="$(snapshot)"
-after_untracked="$(git ls-files --others --exclude-standard)"
-
-# Symmetric difference, and the symmetry is the whole point.  Generation
-# can push a file *into* the unstaged set (it was current, now it is not)
-# or *out* of it (someone hand-edited generated output and the generator
-# put it back) — and the second is stale generated code just as much as
-# the first.  Comparing one direction only reports "current" for it,
-# which is the failure this script was written to stop.
-moved="$(comm -3 <(printf '%s\n' "$before" | sort) <(printf '%s\n' "$after" | sort) |
-	cut -d' ' -f1 | tr -d '\t' | sort -u | grep -v '^$' || true)"
-
-if [ -n "$moved" ]; then
-	echo "codegen-check: generated code is out of date." >&2
-	echo "Run 'make generate' and stage:" >&2
-	printf '  %s\n' $moved >&2
-	exit 1
-fi
-
-if [ "$after_untracked" != "$before_untracked" ]; then
-	echo "codegen-check: generation produced new files. Stage them:" >&2
-	comm -13 <(printf '%s\n' "$before_untracked" | sort) \
-		<(printf '%s\n' "$after_untracked" | sort) >&2
-	exit 1
-fi
-
-echo "codegen-check: generated code is current"

scripts/issue.sh

@@ -38,8 +38,10 @@
 # Where a body is taken and no --body-file is given, it is read from stdin.
 #
 # Environment:
-#   GITEA_TOKEN   a PAT with write:issue (plus write:repository and read:user,
-#                 which the rest of this repo's tooling reaches for)
+#   GITEA_TOKEN   a PAT with write:issue.  `claim` and `mine` additionally
+#                 need to know your username: set GITEA_USER, or give the
+#                 token read:user and it is looked up.
+#   GITEA_USER    your Gitea login.  Optional; see above.
 #   GITEA_URL     defaults to https://git.ljones.me
 #   GITEA_REPO    defaults to yonlu/yellowjacket
 set -euo pipefail
@@ -81,7 +83,29 @@ read_body() {
 	if [ "$file" = "-" ]; then cat; else cat "$file"; fi
 }
 
-me() { curl -sS -H "Authorization: token $GITEA_TOKEN" "$server/api/v1/user" | python3 "$py" login; }
+# The one lookup in this script that needs a scope beyond write:issue.
+# `GET /user` requires read:user, and it is reached for exactly two reasons:
+# to name the assignee in `claim`, and to filter in `mine`.  A token scoped to
+# the work this script does — write:issue — therefore failed at `claim`, which
+# is the one step the workflow requires before the first edit, so the whole
+# documented process was blocked by its own tooling.
+#
+# GITEA_USER short-circuits it, which is what lets a least-privilege token do
+# the job.  The lookup stays as the fallback because it is right when the
+# scope is there and needs no setup at all.
+me() {
+	if [ -n "${GITEA_USER:-}" ]; then
+		printf '%s' "$GITEA_USER"
+		return
+	fi
+	curl -sS -H "Authorization: token $GITEA_TOKEN" "$server/api/v1/user" |
+		python3 "$py" login ||
+		{
+			echo "issue.sh: could not resolve your username. Set GITEA_USER, or" >&2
+			echo "issue.sh: re-issue GITEA_TOKEN with read:user." >&2
+			exit 1
+		}
+}
 
 label_id() { call GET "/labels?limit=100" | python3 "$py" label-id "$1"; }