Merge pull request 'revert: undo PR #98 (CI + linter config changes)' (#99) from revert/pr-98 into main

Reviewed-on: #99

.gitea/workflows/check.yml

@@ -1,20 +0,0 @@
-name: check
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    container:
-      image: golang:1.25
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install golangci-lint
-        run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
-
-      - name: Run make check
-        run: make check

.golangci.yml

@@ -14,23 +14,19 @@ linters:
     - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
-  settings:
-    gosec:
-      excludes:
-        - G117  # false positives on exported fields named Password/Secret/Key
-        - G703  # path traversal — paths from internal config, not user input
-        - G704  # SSRF — URLs come from server config, not user input
-        - G705  # XSS — log endpoints with text/plain content type
+
+linters-settings:
   lll:
-      line-length: 120
+    line-length: 88
   funlen:
     lines: 80
     statements: 50
   cyclop:
     max-complexity: 15
   dupl:
-      threshold: 150
+    threshold: 100
 
 issues:
+  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0

internal/docker/client.go

@@ -480,20 +480,6 @@ func (c *Client) CloneRepo(
 	return c.performClone(ctx, cfg)
 }
 
-// RemoveImage removes a Docker image by ID or tag.
-// It returns nil if the image was successfully removed or does not exist.
-func (c *Client) RemoveImage(ctx context.Context, imageID string) error {
-	_, err := c.docker.ImageRemove(ctx, imageID, image.RemoveOptions{
-		Force:         true,
-		PruneChildren: true,
-	})
-	if err != nil && !client.IsErrNotFound(err) {
-		return fmt.Errorf("failed to remove image %s: %w", imageID, err)
-	}
-
-	return nil
-}
-
 func (c *Client) performBuild(
 	ctx context.Context,
 	opts BuildImageOptions,
@@ -754,6 +740,20 @@ func (c *Client) connect(ctx context.Context) error {
 	return nil
 }
 
+// RemoveImage removes a Docker image by ID or tag.
+// It returns nil if the image was successfully removed or does not exist.
+func (c *Client) RemoveImage(ctx context.Context, imageID string) error {
+	_, err := c.docker.ImageRemove(ctx, imageID, image.RemoveOptions{
+		Force:         true,
+		PruneChildren: true,
+	})
+	if err != nil && !client.IsErrNotFound(err) {
+		return fmt.Errorf("failed to remove image %s: %w", imageID, err)
+	}
+
+	return nil
+}
+
 func (c *Client) close() error {
 	if c.docker != nil {
 		err := c.docker.Close()

internal/docker/validation_test.go

@@ -70,7 +70,7 @@ func TestValidCommitSHARegex(t *testing.T) {
 	}
 }
 
-func TestCloneRepoRejectsInjection(t *testing.T) {
+func TestCloneRepoRejectsInjection(t *testing.T) { //nolint:funlen // table-driven test
 	t.Parallel()
 
 	c := &Client{

internal/handlers/app.go

@@ -6,7 +6,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"html"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -40,7 +39,7 @@ func (h *Handlers) HandleAppNew() http.HandlerFunc {
 }
 
 // HandleAppCreate handles app creation.
-func (h *Handlers) HandleAppCreate() http.HandlerFunc {
+func (h *Handlers) HandleAppCreate() http.HandlerFunc { //nolint:funlen // validation adds necessary length
 	tmpl := templates.GetParsed()
 
 	return func(writer http.ResponseWriter, request *http.Request) {
@@ -193,7 +192,7 @@ func (h *Handlers) HandleAppEdit() http.HandlerFunc {
 }
 
 // HandleAppUpdate handles app updates.
-func (h *Handlers) HandleAppUpdate() http.HandlerFunc {
+func (h *Handlers) HandleAppUpdate() http.HandlerFunc { //nolint:funlen // validation adds necessary length
 	tmpl := templates.GetParsed()
 
 	return func(writer http.ResponseWriter, request *http.Request) {
@@ -500,7 +499,7 @@ func (h *Handlers) HandleAppLogs() http.HandlerFunc {
 			return
 		}
 
-		_, _ = writer.Write([]byte(html.EscapeString(logs)))
+		_, _ = writer.Write([]byte(logs))
 	}
 }
 
@@ -583,8 +582,6 @@ func (h *Handlers) HandleDeploymentLogDownload() http.HandlerFunc {
 		}
 
 		// Check if file exists
-		logPath = filepath.Clean(logPath)
-
 		_, err := os.Stat(logPath)
 		if os.IsNotExist(err) {
 			http.NotFound(writer, request)

internal/models/models_test.go

@@ -706,6 +706,7 @@ func TestAppGetWebhookEvents(t *testing.T) {
 
 // Cascade Delete Tests.
 
+//nolint:funlen // Test function with many assertions - acceptable for integration tests
 func TestCascadeDelete(t *testing.T) {
 	t.Parallel()
 

internal/service/deploy/deploy.go

@@ -726,7 +726,6 @@ func (svc *Service) cleanupCancelledDeploy(
 			} else {
 				svc.log.Info("cleaned up build dir from cancelled deploy",
 					"app", app.Name, "path", dirPath)
-
 				_ = deployment.AppendLog(ctx, "Cleaned up build directory")
 			}
 		}

internal/service/deploy/deploy_cleanup_test.go

@@ -32,7 +32,7 @@ func TestCleanupCancelledDeploy_RemovesBuildDir(t *testing.T) {
 	require.NoError(t, os.MkdirAll(deployDir, 0o750))
 
 	// Create a file inside to verify full removal
-	require.NoError(t, os.WriteFile(filepath.Join(deployDir, "work"), []byte("test"), 0o600))
+	require.NoError(t, os.WriteFile(filepath.Join(deployDir, "work"), []byte("test"), 0o640))
 
 	// Also create a dir for a different deployment (should NOT be removed)
 	otherDir := filepath.Join(buildDir, "99-xyz789")

internal/service/deploy/export_test.go

@@ -52,10 +52,10 @@ func NewTestServiceWithConfig(log *slog.Logger, cfg *config.Config, dockerClient
 // cleanupCancelledDeploy for testing. It removes build directories matching
 // the deployment ID prefix.
 func (svc *Service) CleanupCancelledDeploy(
-	_ context.Context,
+	ctx context.Context,
 	appName string,
 	deploymentID int64,
-	_ string,
+	imageID string,
 ) {
 	// We can't create real models.App/Deployment in tests easily,
 	// so we test the build dir cleanup portion directly.

internal/service/webhook/webhook_test.go

@@ -102,6 +102,7 @@ func createTestApp(
 	return app
 }
 
+//nolint:funlen // table-driven test with comprehensive test cases
 func TestExtractBranch(testingT *testing.T) {
 	testingT.Parallel()