security: pin CI actions to commit SHAs

.gitea/workflows/check.yml

@@ -0,0 +1,23 @@
+name: Check
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version-file: go.mod
+
+      - name: Install golangci-lint
+        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.10.1
+
+      - name: Run make check
+        run: make check

.gitignore

@@ -18,7 +18,3 @@ vendor/
 # Data
 /data/
 *.sqlite3
-
-# Local dev configs
-config.yaml
-config.dev.yml

config.dev.yml

@@ -0,0 +1,11 @@
+# Development config for local Docker testing
+signing_key: "dev-signing-key-minimum-32-chars!"
+debug: true
+allow_http: true
+whitelist_hosts:
+  - localhost
+  - s3.sneak.cloud
+  - static.sneak.cloud
+  - sneak.berlin
+  - github.com
+  - user-images.githubusercontent.com

config.yaml

@@ -0,0 +1,10 @@
+debug: true
+port: 8080
+state_dir: ./data
+signing_key: "test-signing-key-for-development-only"
+whitelist_hosts:
+  - "*.example.com"
+  - "images.unsplash.com"
+  - "picsum.photos"
+  - "s3.sneak.cloud"
+allow_http: false