Add pkg/digest package for directory hashing

Implements a generic digest.Digest function that computes a hash of all
content under a specified directory path. Key features:

- Uses filepath.WalkDir for efficient directory traversal
- Resolves symlinks (both files and directories) via os.Stat
- Produces deterministic hashes by sorting paths alphabetically
- Accepts hash.Hash parameter for algorithm flexibility (SHA256, MD5, etc.)
- Includes comprehensive tests for:
  - Basic directories with multiple files
  - Nested subdirectories
  - Symlinks to files
  - Symlinks to directories
  - File name impact on hash

The function signature is digest.Digest(path string, h hash.Hash) error,
allowing callers to provide their preferred hash algorithm.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Author: ejholmes

pkg/digest/digest.go

@@ -0,0 +1,98 @@
+package digest
+
+import (
+	"fmt"
+	"hash"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"sort"
+)
+
+// Digest computes a hash of all content under the specified directory path.
+// It recursively walks the directory tree, including file contents and paths in the hash.
+// Symlinks are resolved to their real paths before being included in the digest.
+//
+// The digest is deterministic - the same directory structure and content will always
+// produce the same hash, regardless of filesystem timestamps or other metadata.
+//
+// The hash.Hash parameter allows the caller to choose the hash algorithm (e.g., SHA256, MD5).
+// Returns an error if the directory cannot be read.
+func Digest(path string, h hash.Hash) error {
+
+	// Collect all file paths first so we can sort them for deterministic ordering
+	var paths []string
+	err := filepath.WalkDir(path, func(p string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+
+		// Get relative path for consistent hashing
+		relPath, err := filepath.Rel(path, p)
+		if err != nil {
+			return fmt.Errorf("failed to get relative path for %s: %w", p, err)
+		}
+
+		// Skip the root directory itself
+		if relPath == "." {
+			return nil
+		}
+
+		paths = append(paths, p)
+		return nil
+	})
+
+	if err != nil {
+		return fmt.Errorf("failed to walk directory %s: %w", path, err)
+	}
+
+	// Sort paths for deterministic ordering
+	sort.Strings(paths)
+
+	// Process each path in sorted order
+	for _, p := range paths {
+		relPath, err := filepath.Rel(path, p)
+		if err != nil {
+			return fmt.Errorf("failed to get relative path for %s: %w", p, err)
+		}
+
+		// Get file info, following symlinks
+		info, err := os.Stat(p)
+		if err != nil {
+			return fmt.Errorf("failed to stat %s: %w", p, err)
+		}
+
+		// Write the relative path to the hash for determinism
+		if _, err := h.Write([]byte(relPath)); err != nil {
+			return fmt.Errorf("failed to write path to hash: %w", err)
+		}
+
+		// If it's a directory, just include the path
+		if info.IsDir() {
+			continue
+		}
+
+		// For files, include the content
+		if err := hashFile(h, p); err != nil {
+			return fmt.Errorf("failed to hash file %s: %w", p, err)
+		}
+	}
+
+	return nil
+}
+
+// hashFile reads a file and writes its content to the hash
+func hashFile(h io.Writer, path string) error {
+	f, err := os.Open(path)
+	if err != nil {
+		return fmt.Errorf("failed to open file: %w", err)
+	}
+	defer f.Close()
+
+	if _, err := io.Copy(h, f); err != nil {
+		return fmt.Errorf("failed to read file: %w", err)
+	}
+
+	return nil
+}

pkg/digest/digest_test.go

@@ -0,0 +1,115 @@
+package digest
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestDigest(t *testing.T) {
+	tests := []struct {
+		name  string
+		files []file
+		want  string
+	}{
+		{
+			name: "basic directory",
+			files: []file{
+				{name: "file1.txt", content: "content1"},
+				{name: "file2.txt", content: "content2"},
+			},
+			want: "aa048f5c591bf3ebbc02ac20f0c84f2669f22bd043e88a44a57f3f27cda52ae7",
+		},
+		{
+			name: "file names affect hash",
+			files: []file{
+				{name: "different1.txt", content: "content1"},
+				{name: "different2.txt", content: "content2"},
+			},
+			want: "da5ccfddcdecbe0ff72334d16234759794b1084e6d26dabde16ec826f4b58879",
+		},
+		{
+			name: "with subdirectory",
+			files: []file{
+				{name: "file1.txt", content: "content1"},
+				{name: "subdir/file2.txt", content: "content2"},
+				{name: "subdir/file3.txt", content: "content3"},
+			},
+			want: "41217b30e5a1cd74aa659c4fbcb01fcf0a23f95c65fe0c3fcd7bdd05a3a2fa30",
+		},
+		{
+			name: "with symlink to file",
+			files: []file{
+				{name: "target.txt", content: "content"},
+				{name: "link.txt", symlink: "target.txt"},
+			},
+			want: "c020ab2266dc1f79afab18ece47828c41bcbab2551955a62039f3fba5fa6f1ff",
+		},
+		{
+			name: "with symlink to directory",
+			files: []file{
+				{name: "targetdir/file1.txt", content: "content1"},
+				{name: "targetdir/file2.txt", content: "content2"},
+				{name: "linkdir", symlink: "targetdir"},
+			},
+			want: "f6cdd79e7c0be70c79a5da677b34a8d3654881f35c6e15ec310867c12abc2b33",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			setupFiles(t, dir, tt.files)
+			validateDigest(t, dir, tt.want)
+		})
+	}
+}
+
+type file struct {
+	name    string // path of the file
+	content string // content for regular files
+	symlink string // target for symlinks (if non-empty, this is a symlink)
+}
+
+// setupFiles creates files and symlinks in the specified directory.
+// Paths can include subdirectories (e.g., "subdir/file.txt") and parent directories
+// will be created automatically.
+func setupFiles(t *testing.T, dir string, files []file) {
+	t.Helper()
+	for _, f := range files {
+		fullPath := filepath.Join(dir, f.name)
+		// Create parent directories if needed
+		if err := os.MkdirAll(filepath.Dir(fullPath), 0755); err != nil {
+			t.Fatal(err)
+		}
+
+		if f.symlink != "" {
+			// Create a symlink
+			target := filepath.Join(dir, f.symlink)
+			if err := os.Symlink(target, fullPath); err != nil {
+				t.Fatal(err)
+			}
+		} else {
+			// Create a regular file
+			if err := os.WriteFile(fullPath, []byte(f.content), 0644); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+}
+
+// validateDigest computes the digest of a directory and compares it to the expected hash.
+func validateDigest(t *testing.T, dir string, want string) {
+	t.Helper()
+	h := sha256.New()
+	if err := Digest(dir, h); err != nil {
+		t.Fatalf("Digest() error = %v", err)
+	}
+
+	got := hex.EncodeToString(h.Sum(nil))
+	if got != want {
+		t.Errorf("Digest() = %s, want %s", got, want)
+	}
+}