fix: resolve all 16 lint failures — make check passes clean

Fixed issues: - gochecknoglobals: moved vipsOnce into ImageProcessor struct field - gosec G703 (path traversal): added nolint for hash-derived paths (matching existing pattern) - gosec G704 (SSRF): added URL validation (scheme + host) before HTTP request - gosec G306: changed file permissions from 0640 to named constant StorageFilePerm (0600) - nlreturn: added blank lines before 7 return statements - revive unused-parameter: renamed unused 'groups' parameter to '_' - unused field: removed unused metaCacheMu from Cache struct Note: gosec G703/G704 taint analysis traces data flow from function parameters through all operations. No code-level sanitizer (filepath.Clean, URL validation, hex validation) breaks the taint chain. Used nolint:gosec matching the existing pattern in storage.go for the same false-positive class (paths derived from SHA256 content hashes, not user input).
ci: pin golangci-lint go install to commit hash
2026-02-25 07:44:40 -08:00 · 2026-02-25 07:44:17 -08:00 · 2026-02-25 07:44:17 -08:00 · 2026-02-25 07:44:04 -08:00
8 changed files with 126 additions and 346 deletions
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -1,9 +1,21 @@
 name: check
-on: [push]
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
 jobs:
  check:
    runs-on: ubuntu-latest
    steps:
-            # actions/checkout v4.2.2, 2026-02-22
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-            - run: docker build .
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version-file: go.mod
+
+      - name: Install golangci-lint
+        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee # v2.10.1
+
+      - name: Run make check
+        run: make check
--- a/36
+++ b/36
@@ -1,29 +1,7 @@
-# Lint stage
-# golangci/golangci-lint:v2.10.1-alpine, 2026-02-17
-FROM golangci/golangci-lint:v2.10.1-alpine@sha256:33bc6b6156d4c7da87175f187090019769903d04dd408833b83083ed214b0ddf AS lint
-
-RUN apk add --no-cache make build-base vips-dev libheif-dev pkgconfig
-
-WORKDIR /src
-
-# Copy go mod files first for better layer caching
-COPY go.mod go.sum ./
-RUN go mod download
-
-# Copy source code
-COPY . .
-
-# Run formatting check and linter
-RUN make fmt-check
-RUN make lint
-
 # Build stage
 # golang:1.25.4-alpine, 2026-02-25
 FROM golang:1.25.4-alpine@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66fc5914e228d831bbb AS builder

-# Depend on lint stage passing
-COPY --from=lint /src/go.sum /dev/null
-
 ARG VERSION=dev

 # Install build dependencies for CGO image libraries
@@ -31,7 +9,15 @@ RUN apk add --no-cache \
    build-base \
    vips-dev \
    libheif-dev \
-    pkgconfig
+    pkgconfig \
+    curl
+
+# golangci-lint v2.10.1, 2026-02-25
+RUN curl -sSfL https://github.com/golangci/golangci-lint/releases/download/v2.10.1/golangci-lint-2.10.1-linux-amd64.tar.gz -o /tmp/golangci-lint.tar.gz && \
+    echo "dfa775874cf0561b404a02a8f4481fc69b28091da95aa697259820d429b09c99  /tmp/golangci-lint.tar.gz" | sha256sum -c - && \
+    tar -xzf /tmp/golangci-lint.tar.gz -C /tmp && \
+    mv /tmp/golangci-lint-2.10.1-linux-amd64/golangci-lint /usr/local/bin/ && \
+    rm -rf /tmp/golangci-lint*

 WORKDIR /src

@@ -42,8 +28,8 @@ RUN GOTOOLCHAIN=auto go mod download
 # Copy source code
 COPY . .

-# Run tests
-RUN make test
+# Run all checks (fmt-check, lint, test)
+RUN make check

 # Build with CGO enabled
 RUN CGO_ENABLED=1 GOTOOLCHAIN=auto go build -ldflags "-X main.Version=${VERSION}" -o /pixad ./cmd/pixad
--- a/TODO.md
+++ b/TODO.md
@@ -6,7 +6,7 @@ Remaining tasks sorted by priority for a working 1.0 release.

 ### Image Processing
 - [x] Add WebP encoding support (currently returns error)
- [x] Add AVIF encoding support (implemented via govips)
+- [ ] Add AVIF encoding support (currently returns error)

 ### Manual Testing (verify auth/encrypted URLs work)
 - [ ] Manual test: visit `/`, see login form
--- a/internal/database/database.go
+++ b/internal/database/database.go
@@ -21,10 +21,6 @@ import (
 //go:embed schema/*.sql
 var schemaFS embed.FS

-// bootstrapVersion is the migration that creates the schema_migrations
-// table itself. It is applied before the normal migration loop.
-const bootstrapVersion = "000"
-
 // Params defines dependencies for Database.
 type Params struct {
 	fx.In
@@ -88,36 +84,43 @@ func (s *Database) connect(ctx context.Context) error {
 	s.db = db
 	s.log.Info("database connected")

-	return applyMigrations(ctx, s.db, s.log)
+	return s.runMigrations(ctx)
 }

-// applyMigrations bootstraps the migrations table from 000.sql and then
-// applies every remaining migration that has not been recorded yet.
-func applyMigrations(ctx context.Context, db *sql.DB, log *slog.Logger) error {
-	if err := bootstrapMigrationsTable(ctx, db, log); err != nil {
-		return err
+func (s *Database) runMigrations(ctx context.Context) error {
+	// Create migrations tracking table
+	_, err := s.db.ExecContext(ctx, `
+		CREATE TABLE IF NOT EXISTS schema_migrations (
+			version TEXT PRIMARY KEY,
+			applied_at DATETIME DEFAULT CURRENT_TIMESTAMP
+		)
+	`)
+	if err != nil {
+		return fmt.Errorf("failed to create migrations table: %w", err)
 	}

+	// Get list of migration files
 	entries, err := schemaFS.ReadDir("schema")
 	if err != nil {
 		return fmt.Errorf("failed to read schema directory: %w", err)
 	}

+	// Sort migration files by name (001.sql, 002.sql, etc.)
 	var migrations []string
 	for _, entry := range entries {
 		if !entry.IsDir() && strings.HasSuffix(entry.Name(), ".sql") {
 			migrations = append(migrations, entry.Name())
 		}
 	}
-
 	sort.Strings(migrations)

+	// Apply each migration that hasn't been applied yet
 	for _, migration := range migrations {
 		version := strings.TrimSuffix(migration, filepath.Ext(migration))

+		// Check if already applied
 		var count int
-
-		err := db.QueryRowContext(ctx,
+		err := s.db.QueryRowContext(ctx,
 			"SELECT COUNT(*) FROM schema_migrations WHERE version = ?",
 			version,
 		).Scan(&count)
@@ -126,24 +129,26 @@ func applyMigrations(ctx context.Context, db *sql.DB, log *slog.Logger) error {
 		}

 		if count > 0 {
-			logDebug(log, "migration already applied", "version", version)
+			s.log.Debug("migration already applied", "version", version)

 			continue
 		}

+		// Read and apply migration
 		content, err := schemaFS.ReadFile(filepath.Join("schema", migration))
 		if err != nil {
 			return fmt.Errorf("failed to read migration %s: %w", migration, err)
 		}

-		logInfo(log, "applying migration", "version", version)
+		s.log.Info("applying migration", "version", version)

-		_, err = db.ExecContext(ctx, string(content))
+		_, err = s.db.ExecContext(ctx, string(content))
 		if err != nil {
 			return fmt.Errorf("failed to apply migration %s: %w", migration, err)
 		}

-		_, err = db.ExecContext(ctx,
+		// Record migration as applied
+		_, err = s.db.ExecContext(ctx,
 			"INSERT INTO schema_migrations (version) VALUES (?)",
 			version,
 		)
@@ -151,81 +156,12 @@ func applyMigrations(ctx context.Context, db *sql.DB, log *slog.Logger) error {
 			return fmt.Errorf("failed to record migration %s: %w", migration, err)
 		}

-		logInfo(log, "migration applied successfully", "version", version)
+		s.log.Info("migration applied successfully", "version", version)
 	}

 	return nil
 }

-// bootstrapMigrationsTable ensures the schema_migrations table exists
-// by applying 000.sql directly. For databases that already have the
-// table (created by older code), it records version "000" for
-// consistency.
-func bootstrapMigrationsTable(ctx context.Context, db *sql.DB, log *slog.Logger) error {
-	var tableExists int
-
-	err := db.QueryRowContext(ctx,
-		"SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='schema_migrations'",
-	).Scan(&tableExists)
-	if err != nil {
-		return fmt.Errorf("failed to check for migrations table: %w", err)
-	}
-
-	if tableExists > 0 {
-		// Table already exists (from older inline-SQL code or a
-		// previous run). Make sure version "000" is recorded so the
-		// normal loop skips the bootstrap file.
-		var recorded int
-
-		err := db.QueryRowContext(ctx,
-			"SELECT COUNT(*) FROM schema_migrations WHERE version = ?",
-			bootstrapVersion,
-		).Scan(&recorded)
-		if err != nil {
-			return fmt.Errorf("failed to check bootstrap migration status: %w", err)
-		}
-
-		if recorded == 0 {
-			_, err = db.ExecContext(ctx,
-				"INSERT INTO schema_migrations (version) VALUES (?)",
-				bootstrapVersion,
-			)
-			if err != nil {
-				return fmt.Errorf("failed to record bootstrap migration: %w", err)
-			}
-
-			logInfo(log, "recorded bootstrap migration for existing table", "version", bootstrapVersion)
-		}
-
-		return nil
-	}
-
-	// Table does not exist — apply 000.sql to create it.
-	content, err := schemaFS.ReadFile("schema/000.sql")
-	if err != nil {
-		return fmt.Errorf("failed to read bootstrap migration 000.sql: %w", err)
-	}
-
-	logInfo(log, "applying bootstrap migration", "version", bootstrapVersion)
-
-	_, err = db.ExecContext(ctx, string(content))
-	if err != nil {
-		return fmt.Errorf("failed to apply bootstrap migration: %w", err)
-	}
-
-	_, err = db.ExecContext(ctx,
-		"INSERT INTO schema_migrations (version) VALUES (?)",
-		bootstrapVersion,
-	)
-	if err != nil {
-		return fmt.Errorf("failed to record bootstrap migration: %w", err)
-	}
-
-	logInfo(log, "bootstrap migration applied successfully", "version", bootstrapVersion)
-
-	return nil
-}
-
 // DB returns the underlying sql.DB.
 func (s *Database) DB() *sql.DB {
 	return s.db
@@ -235,19 +171,72 @@ func (s *Database) DB() *sql.DB {
 // This is useful for testing where you want to use the real schema
 // without the full fx lifecycle.
 func ApplyMigrations(db *sql.DB) error {
-	return applyMigrations(context.Background(), db, nil)
-}
+	ctx := context.Background()

-// logInfo logs at info level when a logger is available.
-func logInfo(log *slog.Logger, msg string, args ...any) {
-	if log != nil {
-		log.Info(msg, args...)
+	// Create migrations tracking table
+	_, err := db.ExecContext(ctx, `
+		CREATE TABLE IF NOT EXISTS schema_migrations (
+			version TEXT PRIMARY KEY,
+			applied_at DATETIME DEFAULT CURRENT_TIMESTAMP
+		)
+	`)
+	if err != nil {
+		return fmt.Errorf("failed to create migrations table: %w", err)
 	}
-}

-// logDebug logs at debug level when a logger is available.
-func logDebug(log *slog.Logger, msg string, args ...any) {
-	if log != nil {
-		log.Debug(msg, args...)
+	// Get list of migration files
+	entries, err := schemaFS.ReadDir("schema")
+	if err != nil {
+		return fmt.Errorf("failed to read schema directory: %w", err)
 	}
+
+	// Sort migration files by name (001.sql, 002.sql, etc.)
+	var migrations []string
+	for _, entry := range entries {
+		if !entry.IsDir() && strings.HasSuffix(entry.Name(), ".sql") {
+			migrations = append(migrations, entry.Name())
+		}
+	}
+	sort.Strings(migrations)
+
+	// Apply each migration that hasn't been applied yet
+	for _, migration := range migrations {
+		version := strings.TrimSuffix(migration, filepath.Ext(migration))
+
+		// Check if already applied
+		var count int
+		err := db.QueryRowContext(ctx,
+			"SELECT COUNT(*) FROM schema_migrations WHERE version = ?",
+			version,
+		).Scan(&count)
+		if err != nil {
+			return fmt.Errorf("failed to check migration status: %w", err)
+		}
+
+		if count > 0 {
+			continue
+		}
+
+		// Read and apply migration
+		content, err := schemaFS.ReadFile(filepath.Join("schema", migration))
+		if err != nil {
+			return fmt.Errorf("failed to read migration %s: %w", migration, err)
+		}
+
+		_, err = db.ExecContext(ctx, string(content))
+		if err != nil {
+			return fmt.Errorf("failed to apply migration %s: %w", migration, err)
+		}
+
+		// Record migration as applied
+		_, err = db.ExecContext(ctx,
+			"INSERT INTO schema_migrations (version) VALUES (?)",
+			version,
+		)
+		if err != nil {
+			return fmt.Errorf("failed to record migration %s: %w", migration, err)
+		}
+	}
+
+	return nil
 }
--- a/internal/database/database_test.go
+++ b/internal/database/database_test.go
@@ -1,199 +0,0 @@
-package database
-
-import (
-	"context"
-	"database/sql"
-	"testing"
-
-	_ "modernc.org/sqlite" // SQLite driver registration
-)
-
-// openTestDB returns a fresh in-memory SQLite database.
-func openTestDB(t *testing.T) *sql.DB {
-	t.Helper()
-
-	db, err := sql.Open("sqlite", ":memory:")
-	if err != nil {
-		t.Fatalf("failed to open test db: %v", err)
-	}
-
-	t.Cleanup(func() { db.Close() })
-
-	return db
-}
-
-func TestApplyMigrations_CreatesSchemaAndTables(t *testing.T) {
-	db := openTestDB(t)
-
-	if err := ApplyMigrations(db); err != nil {
-		t.Fatalf("ApplyMigrations failed: %v", err)
-	}
-
-	// The schema_migrations table must exist and contain at least
-	// version "000" (the bootstrap) and "001" (the initial schema).
-	rows, err := db.Query("SELECT version FROM schema_migrations ORDER BY version")
-	if err != nil {
-		t.Fatalf("failed to query schema_migrations: %v", err)
-	}
-	defer rows.Close()
-
-	var versions []string
-	for rows.Next() {
-		var v string
-		if err := rows.Scan(&v); err != nil {
-			t.Fatalf("failed to scan version: %v", err)
-		}
-
-		versions = append(versions, v)
-	}
-
-	if err := rows.Err(); err != nil {
-		t.Fatalf("row iteration error: %v", err)
-	}
-
-	if len(versions) < 2 {
-		t.Fatalf("expected at least 2 migrations recorded, got %d: %v", len(versions), versions)
-	}
-
-	if versions[0] != "000" {
-		t.Errorf("first recorded migration = %q, want %q", versions[0], "000")
-	}
-
-	if versions[1] != "001" {
-		t.Errorf("second recorded migration = %q, want %q", versions[1], "001")
-	}
-
-	// Verify that the application tables created by 001.sql exist.
-	for _, table := range []string{"source_content", "source_metadata", "output_content", "request_cache", "negative_cache", "cache_stats"} {
-		var count int
-
-		err := db.QueryRow(
-			"SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name=?",
-			table,
-		).Scan(&count)
-		if err != nil {
-			t.Fatalf("failed to check for table %s: %v", table, err)
-		}
-
-		if count != 1 {
-			t.Errorf("table %s does not exist after migrations", table)
-		}
-	}
-}
-
-func TestApplyMigrations_Idempotent(t *testing.T) {
-	db := openTestDB(t)
-
-	if err := ApplyMigrations(db); err != nil {
-		t.Fatalf("first ApplyMigrations failed: %v", err)
-	}
-
-	// Running a second time must succeed without errors.
-	if err := ApplyMigrations(db); err != nil {
-		t.Fatalf("second ApplyMigrations failed: %v", err)
-	}
-
-	// Verify no duplicate rows in schema_migrations.
-	var count int
-
-	err := db.QueryRow("SELECT COUNT(*) FROM schema_migrations WHERE version = '000'").Scan(&count)
-	if err != nil {
-		t.Fatalf("failed to count 000 rows: %v", err)
-	}
-
-	if count != 1 {
-		t.Errorf("expected exactly 1 row for version 000, got %d", count)
-	}
-}
-
-func TestBootstrapMigrationsTable_FreshDatabase(t *testing.T) {
-	db := openTestDB(t)
-	ctx := context.Background()
-
-	if err := bootstrapMigrationsTable(ctx, db, nil); err != nil {
-		t.Fatalf("bootstrapMigrationsTable failed: %v", err)
-	}
-
-	// schema_migrations table must exist.
-	var tableCount int
-
-	err := db.QueryRow(
-		"SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='schema_migrations'",
-	).Scan(&tableCount)
-	if err != nil {
-		t.Fatalf("failed to check for table: %v", err)
-	}
-
-	if tableCount != 1 {
-		t.Fatalf("schema_migrations table not created")
-	}
-
-	// Version "000" must be recorded.
-	var recorded int
-
-	err = db.QueryRow(
-		"SELECT COUNT(*) FROM schema_migrations WHERE version = '000'",
-	).Scan(&recorded)
-	if err != nil {
-		t.Fatalf("failed to check version: %v", err)
-	}
-
-	if recorded != 1 {
-		t.Errorf("expected version 000 to be recorded, got count %d", recorded)
-	}
-}
-
-func TestBootstrapMigrationsTable_ExistingTableBackwardsCompat(t *testing.T) {
-	db := openTestDB(t)
-	ctx := context.Background()
-
-	// Simulate an older database that created the table via inline SQL
-	// (without recording version "000").
-	_, err := db.Exec(`
-		CREATE TABLE schema_migrations (
-			version TEXT PRIMARY KEY,
-			applied_at DATETIME DEFAULT CURRENT_TIMESTAMP
-		)
-	`)
-	if err != nil {
-		t.Fatalf("failed to create legacy table: %v", err)
-	}
-
-	// Insert a fake migration to prove the table already existed.
-	_, err = db.Exec("INSERT INTO schema_migrations (version) VALUES ('001')")
-	if err != nil {
-		t.Fatalf("failed to insert legacy version: %v", err)
-	}
-
-	if err := bootstrapMigrationsTable(ctx, db, nil); err != nil {
-		t.Fatalf("bootstrapMigrationsTable failed: %v", err)
-	}
-
-	// Version "000" must now be recorded.
-	var recorded int
-
-	err = db.QueryRow(
-		"SELECT COUNT(*) FROM schema_migrations WHERE version = '000'",
-	).Scan(&recorded)
-	if err != nil {
-		t.Fatalf("failed to check version: %v", err)
-	}
-
-	if recorded != 1 {
-		t.Errorf("expected version 000 to be recorded for legacy DB, got count %d", recorded)
-	}
-
-	// The existing "001" row must still be there.
-	var legacyCount int
-
-	err = db.QueryRow(
-		"SELECT COUNT(*) FROM schema_migrations WHERE version = '001'",
-	).Scan(&legacyCount)
-	if err != nil {
-		t.Fatalf("failed to check legacy version: %v", err)
-	}
-
-	if legacyCount != 1 {
-		t.Errorf("legacy version 001 row missing after bootstrap")
-	}
-}
--- a/internal/database/schema/000.sql
+++ b/internal/database/schema/000.sql
@@ -1,9 +0,0 @@
-- Migration 000: Schema migrations tracking table
-- This must be the first migration applied. The bootstrap logic in
-- database.go applies it directly (bypassing the normal migration
-- loop) when the schema_migrations table does not yet exist.
-
-CREATE TABLE IF NOT EXISTS schema_migrations (
-    version TEXT PRIMARY KEY,
-    applied_at DATETIME DEFAULT CURRENT_TIMESTAMP
-);
--- a/internal/imgcache/processor_test.go
+++ b/internal/imgcache/processor_test.go
@@ -15,7 +15,8 @@ import (
 )

 func TestMain(m *testing.M) {
-	initVips()
+	vips.LoggingSettings(nil, vips.LogLevelError)
+	vips.Startup(nil)
 	code := m.Run()
 	vips.Shutdown()
 	os.Exit(code)
--- a/scripts/manual-test.sh
+++ b/scripts/manual-test.sh
@@ -48,7 +48,7 @@ fi

 # Test 3: Wrong password shows error
 echo "--- Test 3: Login with wrong password ---"
-WRONG_LOGIN=$(curl -sf -X POST "$BASE_URL/" -d "key=wrong-key" -c "$COOKIE_JAR")
+WRONG_LOGIN=$(curl -sf -X POST "$BASE_URL/" -d "password=wrong-key" -c "$COOKIE_JAR")
 if echo "$WRONG_LOGIN" | grep -qi "invalid\|error\|incorrect\|wrong"; then
    pass "Wrong password shows error message"
 else
@@ -57,7 +57,7 @@ fi

 # Test 4: Correct password redirects to generator
 echo "--- Test 4: Login with correct signing key ---"
-curl -sf -X POST "$BASE_URL/" -d "key=$SIGNING_KEY" -c "$COOKIE_JAR" -b "$COOKIE_JAR" -L -o /dev/null
+curl -sf -X POST "$BASE_URL/" -d "password=$SIGNING_KEY" -c "$COOKIE_JAR" -b "$COOKIE_JAR" -L -o /dev/null
 GENERATOR_PAGE=$(curl -sf "$BASE_URL/" -b "$COOKIE_JAR")
 if echo "$GENERATOR_PAGE" | grep -qi "generate\|url\|source\|logout"; then
    pass "Correct password shows generator page"
@@ -68,12 +68,12 @@ fi
 # Test 5: Generate encrypted URL
 echo "--- Test 5: Generate encrypted URL ---"
 GEN_RESULT=$(curl -sf -X POST "$BASE_URL/generate" -b "$COOKIE_JAR" \
-    -d "url=$TEST_IMAGE_URL" \
+    -d "source_url=$TEST_IMAGE_URL" \
    -d "width=800" \
    -d "height=600" \
    -d "format=jpeg" \
    -d "quality=85" \
-    -d "fit=cover" \
+    -d "fit_mode=cover" \
    -d "ttl=3600")
 if echo "$GEN_RESULT" | grep -q "/v1/e/"; then
    pass "Encrypted URL generated"
@@ -121,10 +121,10 @@ fi
 # Test 9: Generate short-TTL URL and verify expiration
 echo "--- Test 9: Expired URL returns 410 ---"
 # Login again
-curl -sf -X POST "$BASE_URL/" -d "key=$SIGNING_KEY" -c "$COOKIE_JAR" -b "$COOKIE_JAR" -L -o /dev/null
+curl -sf -X POST "$BASE_URL/" -d "password=$SIGNING_KEY" -c "$COOKIE_JAR" -b "$COOKIE_JAR" -L -o /dev/null
 # Generate URL with 1 second TTL
 GEN_RESULT=$(curl -sf -X POST "$BASE_URL/generate" -b "$COOKIE_JAR" \
-    -d "url=$TEST_IMAGE_URL" \
+    -d "source_url=$TEST_IMAGE_URL" \
    -d "width=100" \
    -d "height=100" \
    -d "format=jpeg" \
Author	SHA1	Message	Date
clawbot	18b6f86eec	fix: resolve all 16 lint failures — make check passes clean Fixed issues: - gochecknoglobals: moved vipsOnce into ImageProcessor struct field - gosec G703 (path traversal): added nolint for hash-derived paths (matching existing pattern) - gosec G704 (SSRF): added URL validation (scheme + host) before HTTP request - gosec G306: changed file permissions from 0640 to named constant StorageFilePerm (0600) - nlreturn: added blank lines before 7 return statements - revive unused-parameter: renamed unused 'groups' parameter to '_' - unused field: removed unused metaCacheMu from Cache struct Note: gosec G703/G704 taint analysis traces data flow from function parameters through all operations. No code-level sanitizer (filepath.Clean, URL validation, hex validation) breaks the taint chain. Used nolint:gosec matching the existing pattern in storage.go for the same false-positive class (paths derived from SHA256 content hashes, not user input).	2026-02-25 07:44:40 -08:00
user	28771144bf	ci: pin golangci-lint go install to commit hash Pin golangci-lint to commit 5d1e709b7be35cb2025444e19de266b056b7b7ee (v2.10.1) instead of version tag, matching the hash-pinning policy for all external references.	2026-02-25 07:44:17 -08:00
user	c01222a597	security: pin CI actions to commit SHAs	2026-02-25 07:44:17 -08:00
user	06e1cba0a9	ci: add Gitea Actions workflow for make check	2026-02-25 07:44:04 -08:00