security: pin all go install refs to commit SHAs

security: pin CI actions to commit SHAs
add CI workflow for make check
2026-02-20 03:10:59 -08:00 · 2026-02-20 02:58:26 -08:00 · 2026-02-20 02:53:26 -08:00 · 2026-02-20 02:53:26 -08:00 · 2026-02-20 11:38:52 +01:00 · 2026-02-20 11:37:23 +01:00
3 changed files with 35 additions and 0 deletions
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -0,0 +1,24 @@
 name: check
 on:
  push:
    branches: [main, next]
  pull_request:
    branches: [main, next]
 jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
        with:
          go-version-file: go.mod
      - name: Install golangci-lint
        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee # v2.10.1
      - name: Install protoc-gen-go
        run: go install google.golang.org/protobuf/cmd/protoc-gen-go@4dfe9d308b477d29e8c2b6d75abf3e78aafe3cb8 # v1.28.1
      - name: Generate protobuf
        run: |
          sudo apt-get update && sudo apt-get install -y protobuf-compiler
          cd mfer && go generate .
      - name: Run checks
        run: make check
--- a/9
+++ b/9
@@ -79,3 +79,12 @@ modcache.tzst: go.mod go.sum
 	go mod download -x
 	cd $(shell go env GOMODCACHE) && tar -c . | pv | zstdmt -19 > $(PWD)/$@.tmp
 	mv $@.tmp $@
 # Run all checks (formatting, linting, tests) without modifying files
 check:
 	@echo "==> Checking formatting..."
 	@test -z "$$(gofmt -l .)" || (echo "Files not formatted:" && gofmt -l . && exit 1)
 	@echo "==> Running linter..."
 	golangci-lint run ./...
 	@echo "==> Running tests..."
 	go test -race -timeout 30s ./...
--- a/mfer/scanner_test.go
+++ b/mfer/scanner_test.go
@@ -352,6 +352,8 @@ func TestIsHiddenPath(t *testing.T) {
 		{"/absolute/.hidden", true},
 		{"./relative", false}, // path.Clean removes leading ./
 		{"a/b/c/.d/e", true},
 		{".", false}, // current directory is not hidden
 		{"/", false}, // root is not hidden
 	}
 	for _, tt := range tests {
Author	SHA1	Message	Date
clawbot	6b592ee7b6	security: pin all go install refs to commit SHAs	2026-02-20 03:10:59 -08:00
user	4023ef28a1	security: pin CI actions to commit SHAs	2026-02-20 02:58:26 -08:00
user	4f98c1eb88	add CI workflow for make check	2026-02-20 02:53:26 -08:00
user	7b1cd0debc	add make check target	2026-02-20 02:53:26 -08:00
Jeffrey Paul	ae70cf6fb5	Fix FindExtraFiles reporting manifest and dotfiles as extra (closes #16 ) (#21 ) Reviewed-on: #21	2026-02-20 11:38:52 +01:00
Jeffrey Paul	5099b6951b	Fix IsHiddenPath treating current directory as hidden (closes #14 ) (#19 ) Reviewed-on: #19	2026-02-20 11:37:23 +01:00
clawbot	8c7eef6240	fix: handle errcheck warnings in gpg.go and gpg_test.go, fix gofmt	2026-02-19 23:40:50 -08:00
clawbot	f6478858d7	fix: IsHiddenPath returns false for "." and "/" (current dir/root are not hidden) path.Clean(".") returns "." which starts with a dot, causing IsHiddenPath to incorrectly treat the current directory as hidden. Add explicit checks for "." and "/" before the dot-prefix check. Fixed in both mfer/scanner.go and internal/scanner/scanner.go.	2026-02-19 23:36:42 -08:00