clawbot 7a1ee6e5a8 lint: adopt org-standard .golangci.yml and golangci-lint v2.12.2 (closes #14) ...

The old backend/.golangci.yml declared version "2" but used v1 schema
keys, so under v2 it never validated and its thresholds were inert: the
linter ran at defaults. Replace it verbatim with the org-standard file,
repin the Dockerfile.backend lint stage to golangci-lint v2.12.2, and
assert the config's sha256 as the first step of the backend lint target
so it cannot silently drift again -- a local hash check, no network.

The standard config surfaces findings only in the tests: the repeated
IP literals in middleware_test.go become named constants (goconst) and
its request switches to NewRequestWithContext (noctx). reportbuf.go's
gosec suppression gains a plain justification comment. The rest of the
backend, including the fx-based server lifecycle, is already clean.
TODO.md updated.

Model: opus-4-8

2026-09-21 19:30:06 +02:00

..

export_test.go

feat(backend): server hardening: timeouts, security headers, trusted-proxy client IP (closes #19)

2026-09-21 15:05:25 +02:00

middleware_test.go

lint: adopt org-standard .golangci.yml and golangci-lint v2.12.2 (closes #14)

2026-09-21 19:30:06 +02:00

middleware.go

feat(backend): server hardening: timeouts, security headers, trusted-proxy client IP (closes #19)

2026-09-21 15:05:25 +02:00