fix: rebase onto main, fix SQLite concurrency, lint clean

- Add busy_timeout PRAGMA and MaxOpenConns(1) for SQLite stability
- Use per-test temp DB in handler tests to prevent state leaks
- Pre-allocate migrations slice (prealloc lint)
- Remove invalid linter names (wsl_v5, noinlineerr) from .golangci.yml
- Remove unused //nolint:gosec directives
- Replace context.Background() with t.Context() in tests
- Use goimports formatting for all files
- All make check passes with zero failures

.golangci.yml

@@ -11,10 +11,8 @@ linters:
     - depguard
     - godot
     - wsl
-    - wsl_v5
     - wrapcheck
     - varnamelen
-    - noinlineerr
     - dupl
     - paralleltest
     - nlreturn

Dockerfile

@@ -1,23 +1,26 @@
-# Build stage
+# golang:1.24-alpine, 2026-02-26
-FROM golang:1.24-alpine AS builder
+FROM golang@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191 AS builder
 WORKDIR /src
-RUN apk add --no-cache make gcc musl-dev
+RUN apk add --no-cache git build-base make
+
+# golangci-lint v2.1.6 (eabc2638a66d), 2026-02-26
+RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@eabc2638a66daf5bb6c6fb052a32fa3ef7b6600d
 
 COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
 
-# Run tests
+# Run all checks — build fails if branch is not green
-ENV DBURL="file::memory:?cache=shared"
+RUN make check
-RUN go test ./...
 
 # Build binaries
-RUN CGO_ENABLED=1 go build -trimpath -ldflags="-s -w" -o /chatd ./cmd/chatd/
+ARG VERSION=dev
+RUN CGO_ENABLED=1 go build -trimpath -ldflags="-s -w -X main.Version=${VERSION}" -o /chatd ./cmd/chatd/
 RUN CGO_ENABLED=1 go build -trimpath -ldflags="-s -w" -o /chat-cli ./cmd/chat-cli/
 
-# Final stage — server only
+# alpine:3.21, 2026-02-26
-FROM alpine:3.21
+FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
 RUN apk add --no-cache ca-certificates \
     && addgroup -S chat && adduser -S chat -G chat
 COPY --from=builder /chatd /usr/local/bin/chatd

Makefile

@@ -1,20 +1,49 @@
-VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
+.PHONY: all build lint fmt fmt-check test check clean run debug docker hooks
-LDFLAGS := -ldflags "-X main.Version=$(VERSION)"
 
-.PHONY: build test clean docker lint
+BINARY := chatd
+VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
+BUILDARCH := $(shell go env GOARCH)
+LDFLAGS := -X main.Version=$(VERSION) -X main.Buildarch=$(BUILDARCH)
+
+all: check build
 
 build:
-	go build $(LDFLAGS) -o chatd ./cmd/chatd/
+	go build -ldflags "$(LDFLAGS)" -o bin/$(BINARY) ./cmd/chatd
-	go build $(LDFLAGS) -o chat-cli ./cmd/chat-cli/
-
-test:
-	DBURL="file::memory:?cache=shared" go test ./...
-
-clean:
-	rm -f chatd chat-cli
 
 lint:
-	GOFLAGS=-buildvcs=false golangci-lint run ./...
+	golangci-lint run --config .golangci.yml ./...
+
+fmt:
+	gofmt -s -w .
+	goimports -w .
+
+fmt-check:
+	@test -z "$$(gofmt -l .)" || (echo "Files not formatted:" && gofmt -l . && exit 1)
+
+test:
+	go test -timeout 30s -v -race -cover ./...
+
+# check runs all validation without making changes
+# Used by CI and Docker build — fails if anything is wrong
+check: test lint fmt-check
+	@echo "==> Building..."
+	go build -ldflags "$(LDFLAGS)" -o /dev/null ./cmd/chatd
+	@echo "==> All checks passed!"
+
+run: build
+	./bin/$(BINARY)
+
+debug: build
+	DEBUG=1 GOTRACEBACK=all ./bin/$(BINARY)
+
+clean:
+	rm -rf bin/ chatd data.db
 
 docker:
-	docker build -t chat:$(VERSION) .
+	docker build -t chat .
+
+hooks:
+	@printf '#!/bin/sh\nset -e\n' > .git/hooks/pre-commit
+	@printf 'go mod tidy\ngo fmt ./...\ngit diff --exit-code -- go.mod go.sum || { echo "go mod tidy changed files; please stage and retry"; exit 1; }\n' >> .git/hooks/pre-commit
+	@printf 'make check\n' >> .git/hooks/pre-commit
+	@chmod +x .git/hooks/pre-commit

cmd/chat-cli/api/client.go

@@ -125,7 +125,7 @@ func (c *Client) PollMessages(
 
 	req.Header.Set("Authorization", "Bearer "+c.Token)
 
-	resp, err := client.Do(req) //nolint:gosec // URL built from trusted BaseURL + hardcoded path
+	resp, err := client.Do(req)
 	if err != nil {
 		return nil, err
 	}
@@ -272,7 +272,7 @@ func (c *Client) do(
 		)
 	}
 
-	resp, err := c.HTTPClient.Do(req) //nolint:gosec // URL built from trusted BaseURL + hardcoded path
+	resp, err := c.HTTPClient.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("http: %w", err)
 	}

internal/db/db.go

@@ -81,7 +81,7 @@ func (s *Database) GetDB() *sql.DB {
 func (s *Database) connect(ctx context.Context) error {
 	dbURL := s.params.Config.DBURL
 	if dbURL == "" {
-		dbURL = "file:./data.db?_journal_mode=WAL"
+		dbURL = "file:./data.db?_journal_mode=WAL&_busy_timeout=5000"
 	}
 
 	s.log.Info("connecting to database", "url", dbURL)
@@ -104,6 +104,8 @@ func (s *Database) connect(ctx context.Context) error {
 		return err
 	}
 
+	d.SetMaxOpenConns(1)
+
 	s.db = d
 	s.log.Info("database connected")
 
@@ -114,6 +116,13 @@ func (s *Database) connect(ctx context.Context) error {
 		return fmt.Errorf("enable foreign keys: %w", err)
 	}
 
+	_, err = s.db.ExecContext(
+		ctx, "PRAGMA busy_timeout = 5000",
+	)
+	if err != nil {
+		return fmt.Errorf("set busy timeout: %w", err)
+	}
+
 	return s.runMigrations(ctx)
 }
 
@@ -233,7 +242,7 @@ func (s *Database) loadMigrations() (
 		)
 	}
 
-	var migrations []migration
+	migrations := make([]migration, 0, len(entries))
 
 	for _, entry := range entries {
 		if entry.IsDir() ||

internal/db/queries_test.go

@@ -1,7 +1,6 @@
 package db_test
 
 import (
-	"context"
 	"encoding/json"
 	"testing"
 
@@ -32,7 +31,7 @@ func TestCreateUser(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	id, token, err := database.CreateUser(ctx, "alice")
 	if err != nil {
@@ -53,7 +52,7 @@ func TestGetUserByToken(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	_, token, err := database.CreateUser(ctx, "bob")
 	if err != nil {
@@ -79,7 +78,7 @@ func TestGetUserByNick(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	_, _, err := database.CreateUser(ctx, "charlie")
 	if err != nil {
@@ -101,7 +100,7 @@ func TestChannelOperations(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	chID, err := database.GetOrCreateChannel(ctx, "#test")
 	if err != nil || chID == 0 {
@@ -128,7 +127,7 @@ func TestJoinAndPart(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	uid, _, err := database.CreateUser(ctx, "user1")
 	if err != nil {
@@ -170,7 +169,7 @@ func TestDeleteChannelIfEmpty(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	chID, err := database.GetOrCreateChannel(
 		ctx, "#empty",
@@ -212,7 +211,7 @@ func createUserWithChannels(
 ) (int64, int64, int64) {
 	t.Helper()
 
-	ctx := context.Background()
+	ctx := t.Context()
 
 	uid, _, err := database.CreateUser(ctx, nick)
 	if err != nil {
@@ -255,7 +254,7 @@ func TestListChannels(t *testing.T) {
 	)
 
 	channels, err := database.ListChannels(
-		context.Background(), uid,
+		t.Context(), uid,
 	)
 	if err != nil || len(channels) != 2 {
 		t.Fatalf(
@@ -269,7 +268,7 @@ func TestListAllChannels(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	_, err := database.GetOrCreateChannel(ctx, "#x")
 	if err != nil {
@@ -294,7 +293,7 @@ func TestChangeNick(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	uid, token, err := database.CreateUser(ctx, "old")
 	if err != nil {
@@ -320,7 +319,7 @@ func TestSetTopic(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	_, err := database.GetOrCreateChannel(
 		ctx, "#topictest",
@@ -354,7 +353,7 @@ func TestInsertAndPollMessages(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	uid, _, err := database.CreateUser(ctx, "poller")
 	if err != nil {
@@ -415,7 +414,7 @@ func TestGetHistory(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	const msgCount = 10
 
@@ -452,7 +451,7 @@ func TestDeleteUser(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	uid, _, err := database.CreateUser(ctx, "deleteme")
 	if err != nil {
@@ -491,7 +490,7 @@ func TestChannelMembers(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
-	ctx := context.Background()
+	ctx := t.Context()
 
 	uid1, _, err := database.CreateUser(ctx, "m1")
 	if err != nil {
@@ -539,7 +538,7 @@ func TestGetAllChannelMembershipsForUser(t *testing.T) {
 
 	channels, err :=
 		database.GetAllChannelMembershipsForUser(
-			context.Background(), uid,
+			t.Context(), uid,
 		)
 	if err != nil || len(channels) != 2 {
 		t.Fatalf(

internal/handlers/api_test.go

@@ -8,6 +8,7 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"path/filepath"
 	"strings"
 	"sync"
 	"testing"
@@ -35,6 +36,10 @@ type testServer struct {
 func newTestServer(t *testing.T) *testServer {
 	t.Helper()
 
+	// Use a unique DB per test to avoid SQLite BUSY and state leaks.
+	dbPath := filepath.Join(t.TempDir(), "test.db")
+	t.Setenv("DBURL", "file:"+dbPath+"?_journal_mode=WAL&_busy_timeout=5000")
+
 	var s *server.Server
 
 	app := fxtest.New(t,
@@ -158,7 +163,7 @@ func (ts *testServer) doReq(
 		req.Header.Set("Content-Type", "application/json")
 	}
 
-	return http.DefaultClient.Do(req) //nolint:gosec // test server URL
+	return http.DefaultClient.Do(req)
 }
 
 func (ts *testServer) doReqAuth(
@@ -181,7 +186,7 @@ func (ts *testServer) doReqAuth(
 		req.Header.Set("Authorization", "Bearer "+token)
 	}
 
-	return http.DefaultClient.Do(req) //nolint:gosec // test server URL
+	return http.DefaultClient.Do(req)
 }
 
 func (ts *testServer) createSession(nick string) string {
@@ -984,7 +989,7 @@ func TestConcurrentSessions(t *testing.T) {
 		go func(i int) {
 			defer wg.Done()
 
-			nick := "concurrent_" + string(rune('a'+i)) //nolint:gosec // i is 0-19, safe range
+			nick := "concurrent_" + string(rune('a'+i))
 
 			body, err := json.Marshal(map[string]string{"nick": nick})
 			if err != nil {