security: pin all go install refs to commit SHAs

.drone.yml

@@ -0,0 +1,23 @@
+kind: pipeline
+name: test-docker-build
+
+steps:
+- name: test-docker-build
+  image: plugins/docker
+  network_mode: bridge
+  settings:
+    repo: sneak/mfer
+    build_args_from_env: [ DRONE_COMMIT_SHA ]
+    dry_run: true
+    custom_dns: [ 116.202.204.30 ]
+    tags:
+      - ${DRONE_COMMIT_SHA:0:7}
+      - ${DRONE_BRANCH}
+      - latest
+- name: notify
+  image: plugins/slack
+  settings:
+    webhook:
+      from_secret: SLACK_WEBHOOK_URL
+  when:
+    event: pull_request

.gitea/workflows/check.yml

@@ -0,0 +1,24 @@
+name: check
+on:
+  push:
+    branches: [main, next]
+  pull_request:
+    branches: [main, next]
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version-file: go.mod
+      - name: Install golangci-lint
+        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee # v2.10.1
+      - name: Install protoc-gen-go
+        run: go install google.golang.org/protobuf/cmd/protoc-gen-go@4dfe9d308b477d29e8c2b6d75abf3e78aafe3cb8 # v1.28.1
+      - name: Generate protobuf
+        run: |
+          sudo apt-get update && sudo apt-get install -y protobuf-compiler
+          cd mfer && go generate .
+      - name: Run checks
+        run: make check

.gitignore

@@ -3,6 +3,3 @@
 *.tmp
 *.dockerimage
 /vendor
-
-# Stale files
-.drone.yml

Makefile

@@ -79,3 +79,12 @@ modcache.tzst: go.mod go.sum
 	go mod download -x
 	cd $(shell go env GOMODCACHE) && tar -c . | pv | zstdmt -19 > $(PWD)/$@.tmp
 	mv $@.tmp $@
+
+# Run all checks (formatting, linting, tests) without modifying files
+check:
+	@echo "==> Checking formatting..."
+	@test -z "$$(gofmt -l .)" || (echo "Files not formatted:" && gofmt -l . && exit 1)
+	@echo "==> Running linter..."
+	golangci-lint run ./...
+	@echo "==> Running tests..."
+	go test -race -timeout 30s ./...