4 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
clawbot	d946fa68f9	Run all linting in Docker via Dockerfile.lint (closes #188) ... Per the owner ruling, linting now runs only inside Docker with the pinned golangci-lint (v2.12.2). A root Dockerfile.lint runs the linter as a build step; script/lint just builds it. A GATE_RUN build arg forces the lint layer to execute every run so a cached build cannot report a false clean. script/bootstrap no longer installs golangci-lint (the goimports install stays). The main Dockerfile lint stage calls golangci-lint directly (no docker-in-docker) and still gates the build. config verify is omitted because it fetches its schema over an unpinned HTTPS call. Model: opus-4-8	2026-09-22 12:11:19 +02:00
clawbot	727bd50935	Install pinned goimports in script/bootstrap (closes #184) ... script/fmt runs goimports, but script/bootstrap did not install it, so make fmt failed with goimports: not found on a fresh machine. bootstrap now installs goimports v0.49.0 (pinned; compatible with the repo Go 1.25, so no toolchain download) into /usr/local/bin, guarded to skip when it is already present. Node/prettier pinning is left to a separate issue; the check gate runs only gofmt, so main is unaffected. Model: opus-4-8	2026-09-22 11:11:15 +02:00
clawbot	f1dfd382a4	Reject path traversal in deploy log download handler (closes #177) ... The deploy-log download handler passed a request-derived path to http.ServeFile, which gosec flags as G703 (path traversal via taint). The handler now opens the log through an os.Root confined to the deploy log directory, so any escaping path is rejected at runtime (404) and the file is streamed with http.ServeContent. A regression test plants a sentinel outside the log dir and asserts the traversal is refused and its contents never served; removing the guard makes that test fail. No //nolint used. Model: opus-4-8	2026-09-22 11:01:07 +02:00
clawbot	1d38585431	Add .prettierignore for vendored minified JS (closes #185) ... script/fmt ran prettier over static/js/*.js, which rewrote the vendored minified static/js/alpine.min.js. A root .prettierignore with *.min.js excludes vendored bundles: make fmt on a clean tree now yields no changes and alpine.min.js stays byte-identical, while first-party JS still formats. Model: opus-4-8	2026-09-22 10:00:50 +02:00