Merge remote-tracking branch 'upstream/main' into msukkari/sync-upstream

# Conflicts:
#	cmd/zoekt-webserver/main.go
#	go.mod
#	go.sum
#	query/parse.go

Author: msukkari

.github/workflows/ci.yml

@@ -48,10 +48,7 @@ jobs:
     steps:
       - name: add dependencies
         run: apk add bash go
-      # Pinned a commit to make go version configurable.
-      # This should be safe to upgrade once this commit is in a released version:
-      # https://github.com/jidicula/go-fuzz-action/commit/23cc553941669144159507e2cccdbb4afc5b3076
-      - uses: jidicula/go-fuzz-action@0206b61afc603b665297621fa5e691b1447a5e57
+      - uses: jidicula/go-fuzz-action@2d8b802597c47a79764d83dabc27fb672f2fb8d9
         with:
           packages: 'github.com/sourcegraph/zoekt' # This is the package where the Protobuf round trip tests are defined
           fuzz-time: 30s
@@ -116,73 +113,3 @@ jobs:
       # Check if the generated code is up-to-date
       - run: .github/workflows/buf-generate-check.sh
 
-  # We build a shared docker image called "zoekt". This is not pushed, but is
-  # used for creating the indexserver and webserver images.
-  docker:
-    if: github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
-    needs:
-      - "test"
-      - "shellcheck"
-    steps:
-      - name: checkout
-        uses: actions/checkout@v3
-
-      - name: version
-        id: version
-        run: .github/workflows/docker-version.sh
-
-      - name: docker-meta-webserver
-        id: meta-webserver
-        uses: docker/metadata-action@v3
-        with:
-          images: |
-            sourcegraph/zoekt-webserver
-          tags: |
-            type=ref,event=branch
-            type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=sha
-      - name: docker-meta-indexserver
-        id: meta-indexserver
-        uses: docker/metadata-action@v3
-        with:
-          images: |
-            sourcegraph/zoekt-indexserver
-          tags: |
-            type=ref,event=branch
-            type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=sha
-
-      - name: build-zoekt
-        uses: docker/build-push-action@v4
-        with:
-          context: .
-          tags: "zoekt:latest"
-          push: "false"
-          build-args: VERSION=${{ steps.version.outputs.value }}
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: build-push-webserver
-        uses: docker/build-push-action@v4
-        with:
-          context: .
-          tags: sourcegraph/zoekt-webserver:${{ steps.version.outputs.value }}, ${{ steps.meta-webserver.outputs.tags }}, sourcegraph/zoekt-webserver:latest
-          file: Dockerfile.webserver
-          cache-from: sourcegraph/zoekt-webserver:latest
-          push: true
-
-      - name: build-push-indexserver
-        uses: docker/build-push-action@v4
-        with:
-          context: .
-          tags: sourcegraph/zoekt-indexserver:${{ steps.version.outputs.value }}, ${{ steps.meta-indexserver.outputs.tags }}, sourcegraph/zoekt-indexserver:latest
-          file: Dockerfile.indexserver
-          cache-from: sourcegraph/zoekt-indexserver:latest
-          push: true

.github/workflows/docker-version.sh

@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
 
-# This is the psuedo-version that go.mod uses. We use the same version string
-# so that sourcegraph/sourcegraph's go.mod is kept in sync with the version we
-# publish.
+set -euo pipefail
 
-printf "::set-output name=value::"
-
-TZ=UTC git --no-pager show \
+# This is the pseudo-version that go.mod uses. We use the same version string
+# so that downstream consumers can line up image versions with module versions.
+version="$(TZ=UTC git --no-pager show \
   --quiet \
   --abbrev=12 \
   --date='format-local:%Y%m%d%H%M%S' \
-  --format="0.0.0-%cd-%h"
+  --format='0.0.0-%cd-%h')"
+
+printf 'value=%s\n' "$version" >>"$GITHUB_OUTPUT"

.github/workflows/docker.yml

@@ -0,0 +1,59 @@
+name: Publish Docker Image
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: version
+        id: version
+        run: .github/workflows/docker-version.sh
+
+      - name: setup-buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: docker-meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=${{ steps.version.outputs.value }},enable={{is_default_branch}}
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=sha,prefix=sha-,format=short
+
+      - name: login to ghcr.io
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          build-args: |
+            VERSION=${{ steps.version.outputs.value }}

AGENT.md

@@ -0,0 +1,26 @@
+# Zoekt Coding Agent Guidelines
+
+## Build & Test Commands
+- Build: `go build ./cmd/...`
+- Run all tests: `go test ./... -short`
+- Run a single test: `go test -run=TestName ./path/to/package`
+- Run specific test with verbose output: `go test -v -run=TestName ./path/to/package`
+- Benchmark: `go test -bench=BenchmarkName ./path/to/package`
+- Fuzzing: `go test -fuzz=FuzzTestName -fuzztime=30s ./package`
+- Smoke test: Check a specific repo: `go run ./cmd/zoekt-git-index /path/to/repo`
+
+## Code Style Guidelines
+- Import format: standard Go imports (stdlib, external, internal) with alphabetical sorting
+- Error handling: explicit error checking with proper returns (no ignored errors)
+- Naming: Go standard (CamelCase for exported, camelCase for private)
+- Tests: Table-driven tests preferred with descriptive names
+- Documentation: All exported functions should have comments
+- Shell scripts: Use shfmt with `-i 2 -ci -bn` flags
+- Proto files: Run buf lint and format checks
+- Memory optimization: As a code search database, Zoekt is memory-sensitive - be conscious of struct field ordering and memory usage in core structures
+
+## Documentation Resources
+- Design overview: `doc/design.md` - Core architecture and search methodology
+- Indexing details: `doc/indexing.md` - How the indexing process works
+- Query syntax: `doc/query_syntax.md` - Search query language reference
+- FAQ: `doc/faq.md` - Common questions and troubleshooting

CONTRIBUTING.md

@@ -0,0 +1,17 @@
+# Contributing
+
+We welcome contributions to the project! To propose a change, please fork the repository, make your changes, then submit
+a pull request. If the change is significant or potentially controversial, please open an issue first to discuss it.
+Zoekt does not require a CLA to contribute.
+
+Before opening a pull request, make sure that you have run the tests locally:
+```sh
+go test ./...
+```
+
+It's also good to run a local smoke test for the relevant component. For example, if you've made changes in
+`zoekt-git-index`, you can try indexing a repository locally:
+```sh
+go run ./cmd/zoekt-git-index /path/to/repo
+```
+

Dockerfile

@@ -1,25 +1,47 @@
-FROM golang:1.23.4-alpine3.19 AS builder
+# syntax=docker/dockerfile:1.7
+FROM golang:1.26.2-alpine AS builder
 
 RUN apk add --no-cache ca-certificates
 
 ENV CGO_ENABLED=0
-WORKDIR /go/src/github.com/sourcegraph/zoekt
+WORKDIR /src
 
-# Cache dependencies
+# Cache dependency resolution separately from source changes.
 COPY go.mod go.sum ./
-RUN go mod download
+RUN --mount=type=cache,target=/go/pkg/mod \
+    go mod download
+
+COPY . .
+ARG VERSION=dev
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    mkdir -p /out && \
+    go build \
+      -trimpath \
+      -ldflags "-X github.com/sourcegraph/zoekt.Version=$VERSION" \
+      -o /out/ \
+      ./cmd/...
+
+FROM alpine:3
 
-COPY . ./
-ARG VERSION
-RUN go install -ldflags "-X github.com/sourcegraph/zoekt.Version=$VERSION" ./cmd/...
+RUN apk add --no-cache git ca-certificates bind-tools tini jansson wget
 
-FROM alpine:3.19 AS zoekt
+COPY --chmod=755 install-ctags-alpine.sh /usr/local/bin/install-ctags-alpine.sh
+RUN /usr/local/bin/install-ctags-alpine.sh && \
+    rm /usr/local/bin/install-ctags-alpine.sh \
+      /usr/local/bin/universal-optscript
 
-RUN apk add --no-cache git ca-certificates bind-tools tini jansson wget
+RUN addgroup -S zoekt && \
+    adduser -S -G zoekt -h /home/zoekt zoekt && \
+    mkdir -p /data/index /home/zoekt && \
+    chown -R zoekt:zoekt /data /home/zoekt
+
+COPY --from=builder /out/ /usr/local/bin/
 
-COPY install-ctags-alpine.sh .
-RUN ./install-ctags-alpine.sh && rm install-ctags-alpine.sh
+USER zoekt
+WORKDIR /home/zoekt
 
-COPY --from=builder /go/bin/* /usr/local/bin/
+ENV DATA_DIR=/data/index
 
 ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["zoekt-webserver", "-index", "/data/index", "-pprof", "-rpc"]