upaas

188 Commits 16 Branches 1 Tag

3 Commits

Author	SHA1	Message	Date
clawbot	727bd50935	Install pinned goimports in script/bootstrap (closes #184 ) Check / check (pull_request) Successful in 1m49s Details script/fmt runs goimports, but script/bootstrap did not install it, so make fmt failed with goimports: not found on a fresh machine. bootstrap now installs goimports v0.49.0 (pinned; compatible with the repo Go 1.25, so no toolchain download) into /usr/local/bin, guarded to skip when it is already present. Node/prettier pinning is left to a separate issue; the check gate runs only gofmt, so main is unaffected. Model: opus-4-8	2026-09-22 11:11:15 +02:00
clawbot	f1dfd382a4	Reject path traversal in deploy log download handler (closes #177 ) The deploy-log download handler passed a request-derived path to http.ServeFile, which gosec flags as G703 (path traversal via taint). The handler now opens the log through an os.Root confined to the deploy log directory, so any escaping path is rejected at runtime (404) and the file is streamed with http.ServeContent. A regression test plants a sentinel outside the log dir and asserts the traversal is refused and its contents never served; removing the guard makes that test fail. No //nolint used. Model: opus-4-8	2026-09-22 11:01:07 +02:00
clawbot	1d38585431	Add .prettierignore for vendored minified JS (closes #185 ) script/fmt ran prettier over static/js/.js, which rewrote the vendored minified static/js/alpine.min.js. A root .prettierignore with .min.js excludes vendored bundles: make fmt on a clean tree now yields no changes and alpine.min.js stays byte-identical, while first-party JS still formats. Model: opus-4-8	2026-09-22 10:00:50 +02:00

Author

SHA1

Message

Date

clawbot

727bd50935

Install pinned goimports in script/bootstrap (closes #184 )

Check / check (pull_request) Successful in 1m49s

Details

script/fmt runs goimports, but script/bootstrap did not install it, so
make fmt failed with goimports: not found on a fresh machine. bootstrap
now installs goimports v0.49.0 (pinned; compatible with the repo Go 1.25,
so no toolchain download) into /usr/local/bin, guarded to skip when it is
already present. Node/prettier pinning is left to a separate issue; the
check gate runs only gofmt, so main is unaffected.

Model: opus-4-8

2026-09-22 11:11:15 +02:00

clawbot

f1dfd382a4

Reject path traversal in deploy log download handler (closes #177 )

The deploy-log download handler passed a request-derived path to
http.ServeFile, which gosec flags as G703 (path traversal via taint).
The handler now opens the log through an os.Root confined to the deploy
log directory, so any escaping path is rejected at runtime (404) and the
file is streamed with http.ServeContent. A regression test plants a
sentinel outside the log dir and asserts the traversal is refused and its
contents never served; removing the guard makes that test fail. No
//nolint used.

Model: opus-4-8

2026-09-22 11:01:07 +02:00

clawbot

1d38585431

Add .prettierignore for vendored minified JS (closes #185 )

script/fmt ran prettier over static/js/*.js, which rewrote the vendored
minified static/js/alpine.min.js. A root .prettierignore with *.min.js
excludes vendored bundles: make fmt on a clean tree now yields no changes
and alpine.min.js stays byte-identical, while first-party JS still formats.

Model: opus-4-8

2026-09-22 10:00:50 +02:00