Update TODO.md

Reviewed-on: #16

.gitea/workflows/check.yml

@@ -1,21 +1,9 @@
 name: check
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
+on: [push]
 jobs:
     check:
         runs-on: ubuntu-latest
         steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
-        with:
-          go-version-file: go.mod
-
-      - name: Install golangci-lint
-        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee # v2.10.1
-
-      - name: Run make check
-        run: make check
+            # actions/checkout v4.2.2, 2026-02-22
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+            - run: docker build .

Dockerfile

@@ -13,10 +13,20 @@ RUN apk add --no-cache \
     curl
 
 # golangci-lint v2.10.1, 2026-02-25
-RUN curl -sSfL https://github.com/golangci/golangci-lint/releases/download/v2.10.1/golangci-lint-2.10.1-linux-amd64.tar.gz -o /tmp/golangci-lint.tar.gz && \
-    echo "dfa775874cf0561b404a02a8f4481fc69b28091da95aa697259820d429b09c99  /tmp/golangci-lint.tar.gz" | sha256sum -c - && \
+# SHA-256 checksums per architecture (amd64 / arm64)
+RUN set -e; \
+    ARCH="$(uname -m)"; \
+    if [ "$ARCH" = "aarch64" ] || [ "$ARCH" = "arm64" ]; then \
+      GOARCH="arm64"; \
+      HASH="6652b42ae02915eb2f9cb2a2e0cac99514c8eded8388d88ae3e06e1a52c00de8"; \
+    else \
+      GOARCH="amd64"; \
+      HASH="dfa775874cf0561b404a02a8f4481fc69b28091da95aa697259820d429b09c99"; \
+    fi; \
+    curl -sSfL "https://github.com/golangci/golangci-lint/releases/download/v2.10.1/golangci-lint-2.10.1-linux-${GOARCH}.tar.gz" -o /tmp/golangci-lint.tar.gz && \
+    echo "${HASH}  /tmp/golangci-lint.tar.gz" | sha256sum -c - && \
     tar -xzf /tmp/golangci-lint.tar.gz -C /tmp && \
-    mv /tmp/golangci-lint-2.10.1-linux-amd64/golangci-lint /usr/local/bin/ && \
+    mv "/tmp/golangci-lint-2.10.1-linux-${GOARCH}/golangci-lint" /usr/local/bin/ && \
     rm -rf /tmp/golangci-lint*
 
 WORKDIR /src

TODO.md

@@ -1,65 +1,64 @@
-# Pixa 1.0 TODO
+# Status
 
-Remaining tasks sorted by priority for a working 1.0 release.
+pre-1.0. No git tags. Full policy file set is present, but make check
+fails on main with 10 gosec lint findings, so main is not green.
 
-## P0: Critical for 1.0
+# Next Step
 
-### Image Processing
-- [x] Add WebP encoding support (currently returns error)
-- [ ] Add AVIF encoding support (currently returns error)
+Fix the 10 gosec findings so make check passes on main. Fix each issue
+properly (no blanket nolint suppressions) and confirm lint, tests, and
+CI are green. This restores the main-always-green policy.
 
-### Manual Testing (verify auth/encrypted URLs work)
-- [ ] Manual test: visit `/`, see login form
-- [ ] Manual test: enter wrong key, see error
-- [ ] Manual test: enter correct signing key, see generator form
-- [ ] Manual test: generate encrypted URL, verify it works
-- [ ] Manual test: wait for expiration or use short TTL, verify expired URL returns 410
-- [ ] Manual test: logout, verify redirected to login
+# Completed Steps
 
-### Cache Management
-- [ ] Implement cache size management/eviction (prevent disk from filling up)
+- 2026-02-25: Docker arm64 build fixed via architecture detection for
+  golangci-lint download (#16)
+- 2026-02-25: full repo policy compliance pass (#14): LICENSE,
+  REPO_POLICIES.md, .editorconfig, Gitea Actions CI workflow, Docker
+  images pinned by hash, README restructured to policy sections, hooks
+  Makefile target, golangci-lint errors resolved
+- 2026-02-20: stale local dev config files removed (#12)
+- 2026-02-09: correctness fixes: negative cache checked in Service.Get()
+  before upstream fetch (#8); Stats() column scanning and HitRate
+  computation corrected (#9)
+- 2026-02-08: AllowHTTP propagated to SourceURL() scheme selection (#6)
+- WebP encoding support added (P0 item, checked off in TODO)
+- 2026-01-08: initial implementation with Makefile and TODO checklist
 
-### Configuration
-- [ ] Validate configuration on startup (fail fast on bad config)
+# Future Steps
 
-## P1: Important for Production
+Compliance:
 
-### Security
-- [ ] Implement blocked networks configuration (extend SSRF protection)
-- [ ] Add rate limiting global concurrent fetches (prevent resource exhaustion)
+- After the gosec fix lands, verify CI runs make check green on main
 
-### Image Processing
-- [ ] Implement EXIF/metadata stripping (privacy)
+P0, critical for 1.0 (from existing TODO.md):
 
-## P2: Nice to Have
+- Add AVIF encoding support (currently returns error)
+- Manual test pass for auth and encrypted URLs:
+    - visit /, see login form
+    - wrong key shows error; correct signing key shows generator form
+    - generated encrypted URL works
+    - expired URL (short TTL) returns 410
+    - logout redirects to login
+- Implement cache size management and eviction (prevent disk fill)
+- Validate configuration on startup (fail fast on bad config)
 
-### Security
-- [ ] Implement referer blacklist
-- [ ] Add rate limiting per-IP
-- [ ] Add rate limiting per-origin
+P1, important for production:
 
-### HTTP Response Handling
-- [ ] Implement Last-Modified headers
-- [ ] Implement Vary header for content negotiation
-- [ ] Implement X-Request-ID propagation
+- Blocked networks configuration (extend SSRF protection)
+- Rate limit global concurrent fetches (resource exhaustion)
+- EXIF/metadata stripping (privacy)
 
-### Additional Endpoints
-- [ ] Implement auto-format selection (format=auto based on Accept header)
+P2, nice to have:
 
-### Configuration
-- [ ] Add all configuration options from README
-- [ ] Implement environment variable overrides
-- [ ] Implement YAML config file support
-
-### Operational
-- [ ] Implement Sentry error reporting (optional)
-- [ ] Add comprehensive request logging
-- [ ] Add performance metrics (Prometheus)
-- [ ] Write integration tests for image proxy flow
-- [ ] Write load tests to verify 1-5k req/s target
-
-### Documentation
-- [ ] Document configuration options
-- [ ] Document API endpoints
-- [ ] Document deployment guide
-- [ ] Add example nginx/caddy reverse proxy config
+- Referer blacklist; per-IP and per-origin rate limiting
+- Last-Modified headers; Vary header; X-Request-ID propagation
+- Auto-format selection (format=auto based on Accept header)
+- All configuration options from README; env var overrides; YAML config
+  file support
+- Sentry error reporting (optional); comprehensive request logging;
+  Prometheus metrics
+- Integration tests for the image proxy flow; load tests for the
+  1-5k req/s target
+- Docs: configuration options, API endpoints, deployment guide, example
+  nginx/caddy reverse proxy config

internal/imgcache/processor_test.go

@@ -15,8 +15,7 @@ import (
 )
 
 func TestMain(m *testing.M) {
-	vips.LoggingSettings(nil, vips.LogLevelError)
-	vips.Startup(nil)
+	initVips()
 	code := m.Run()
 	vips.Shutdown()
 	os.Exit(code)