From 4744736dc5a2c599b953079d262893049c7cc441 Mon Sep 17 00:00:00 2001
From: PJ <ipriyanshujain@gmail.com>
Date: Sat, 18 Apr 2026 06:46:20 +0700
Subject: [PATCH] refactor(sidecar): gate JAR embed behind withsidecar build
 tag

Splits embed.go so the go:embed directive only fires under
-tags withsidecar. Default builds get a stub with a nil JAR
and IsPlaceholder()=true. This removes the landmine where
make uatu overwrote a tracked placeholder file, making any
git add silently stage 130 MB.
---
 internal/sidecar/embed.go      | 18 +-----------------
 internal/sidecar/embed_real.go | 12 ++++++++++++
 internal/sidecar/embed_stub.go | 10 ++++++++++
 3 files changed, 23 insertions(+), 17 deletions(-)
 create mode 100644 internal/sidecar/embed_real.go
 create mode 100644 internal/sidecar/embed_stub.go

diff --git a/internal/sidecar/embed.go b/internal/sidecar/embed.go
index 48c730f..e3f42ec 100644
--- a/internal/sidecar/embed.go
+++ b/internal/sidecar/embed.go
@@ -3,28 +3,12 @@ package sidecar
 import (
 	"crypto/sha256"
 	"encoding/hex"
-	_ "embed"
 	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
 )
 
-//go:embed assets/sidecar-all.jar
-var embeddedJAR []byte
-
-// PlaceholderMagic is the byte sequence written to the placeholder JAR that
-// ships in the repository. A binary that still carries the placeholder is
-// not runnable against a real sidecar — `make sidecar && make uatu` must
-// have been invoked to embed the real fat JAR.
-const PlaceholderMagic = "uatu-sidecar-placeholder"
-
-// IsPlaceholder reports whether the embedded JAR is the development
-// placeholder rather than a real sidecar fat JAR.
-func IsPlaceholder() bool {
-	return string(embeddedJAR) == PlaceholderMagic
-}
-
 // EmbeddedSize returns the size in bytes of the embedded JAR.
 func EmbeddedSize() int { return len(embeddedJAR) }
 
@@ -39,7 +23,7 @@ func EmbeddedSHA256() string {
 // matching checksum, no rewrite happens. Returns the JAR path.
 func Extract(dir string) (string, error) {
 	if len(embeddedJAR) == 0 {
-		return "", errors.New("sidecar: embedded JAR is empty")
+		return "", errors.New("sidecar: binary built without -tags withsidecar; rebuild with `make uatu`")
 	}
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		return "", fmt.Errorf("mkdir %s: %w", dir, err)
diff --git a/internal/sidecar/embed_real.go b/internal/sidecar/embed_real.go
new file mode 100644
index 0000000..3e43ee7
--- /dev/null
+++ b/internal/sidecar/embed_real.go
@@ -0,0 +1,12 @@
+//go:build withsidecar
+
+package sidecar
+
+import _ "embed"
+
+//go:embed assets/sidecar-all.jar
+var embeddedJAR []byte
+
+// IsPlaceholder reports whether the binary was built without the real
+// sidecar JAR embedded. -tags withsidecar builds always return false.
+func IsPlaceholder() bool { return false }
diff --git a/internal/sidecar/embed_stub.go b/internal/sidecar/embed_stub.go
new file mode 100644
index 0000000..e9c707f
--- /dev/null
+++ b/internal/sidecar/embed_stub.go
@@ -0,0 +1,10 @@
+//go:build !withsidecar
+
+package sidecar
+
+var embeddedJAR []byte
+
+// IsPlaceholder reports whether the binary was built without the real
+// sidecar JAR embedded. Build with `make uatu` (which passes
+// -tags withsidecar) to embed the real fat JAR.
+func IsPlaceholder() bool { return true }