9 Commits

Include renames

Author	SHA1	Message	Date
clawbot	f0c4a5bb47	dockerfile: use CGO_ENABLED=0 for binary builds ... modernc.org/sqlite is pure Go — no cgo needed at runtime. build-base remains for make check (-race requires cgo). Fixes #13.	2026-02-26 22:28:23 -08:00
clawbot	a57a73e94e	fix: address all PR #10 review findings ... Security: - Add channel membership check before PRIVMSG (prevents non-members from sending) - Add membership check on history endpoint (channels require membership, DMs scoped to own nick) - Enforce MaxBytesReader on all POST request bodies - Fix rand.Read error being silently ignored in token generation Data integrity: - Fix TOCTOU race in GetOrCreateChannel using INSERT OR IGNORE + SELECT Build: - Add CGO_ENABLED=0 to golangci-lint install in Dockerfile (fixes alpine build) Linting: - Strict .golangci.yml: only wsl disabled (deprecated in v2) - Re-enable exhaustruct, depguard, godot, wrapcheck, varnamelen - Fix linters-settings -> linters.settings for v2 config format - Fix ALL lint findings in actual code (no linter config weakening) - Wrap all external package errors (wrapcheck) - Fill struct fields or add targeted nolint:exhaustruct where appropriate - Rename short variables (ts->timestamp, n->bufIndex, etc.) - Add depguard deny policy for io/ioutil and math/rand - Exclude G704 (SSRF) in gosec config (CLI client takes user-configured URLs) Tests: - Add security tests (TestNonMemberCannotSend, TestHistoryNonMember) - Split TestInsertAndPollMessages for reduced complexity - Fix parallel test safety (viper global state prevents parallelism) - Use t.Context() instead of context.Background() in tests Docker build verified passing locally.	2026-02-26 21:21:49 -08:00
clawbot	b7ec171ea6	build: Dockerfile non-root user, healthcheck, .dockerignore	2026-02-26 20:17:20 -08:00
clawbot	5d31c17a9d	Revert: exclude chat-cli from final Docker image (server-only) ... CLI is built during Docker build to verify compilation, but only chatd is included in the final image. CLI distributed separately.	2026-02-26 20:16:43 -08:00
clawbot	368ef4dfc9	Include chat-cli in final Docker image	2026-02-26 20:16:43 -08:00
clawbot	e342472712	Update Dockerfile for Go 1.24, no Node build step needed ... SPA is vanilla JS shipped as static files in web/dist/, no npm build step required.	2026-02-26 20:16:43 -08:00
clawbot	84303c969a	fix: pin golangci-lint to v2.1.6 in Dockerfile ... Replace @latest with @v2.1.6 to comply with hash-pinning policy defined in REPO_POLICIES.md.	2026-02-26 11:43:52 -08:00
clawbot	27de1227c4	chore: pin Dockerfile images by sha256, run make check in build (refs #17)	2026-02-26 06:09:04 -08:00
clawbot	03cbc3cd1a	Add Dockerfile and .dockerignore ... Multi-stage build: golang:1.24-alpine builder, alpine:3.21 runtime. Verified locally: all fx modules instantiate, migrations run, healthcheck responds at /.well-known/healthcheck.json.	2026-02-09 12:36:55 -08:00