ci: pin actions to commit SHAs to prevent RCE

Pin actions/checkout and actions/setup-go to their full commit
SHAs instead of mutable tags, per review feedback.

- actions/checkout@v4 → 34e114876b0b11c390a56381ad16ebd13914f8d5
- actions/setup-go@v5 → 40f1582b2485089dde7abd97c1529aa768e1baff

.gitea/workflows/check.yml

@@ -0,0 +1,26 @@
+name: Check
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version-file: go.mod
+
+      - name: Install golangci-lint
+        run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
+
+      - name: Install goimports
+        run: go install golang.org/x/tools/cmd/goimports@latest
+
+      - name: Run make check
+        run: make check

internal/service/deploy/deploy.go

@@ -11,6 +11,7 @@ import (
 	"log/slog"
 	"os"
 	"path/filepath"
+	"strings"
 	"sync"
 	"time"
 
@@ -715,7 +716,7 @@ func (svc *Service) cleanupCancelledDeploy(
 	prefix := fmt.Sprintf("%d-", deployment.ID)
 
 	for _, entry := range entries {
-		if entry.IsDir() && len(entry.Name()) > len(prefix) && entry.Name()[:len(prefix)] == prefix {
+		if entry.IsDir() && strings.HasPrefix(entry.Name(), prefix) {
 			dirPath := filepath.Join(buildDir, entry.Name())
 
 			removeErr := os.RemoveAll(dirPath)

internal/service/deploy/export_test.go

@@ -6,6 +6,7 @@ import (
 	"log/slog"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"git.eeqj.de/sneak/upaas/internal/config"
 	"git.eeqj.de/sneak/upaas/internal/docker"
@@ -47,7 +48,9 @@ func NewTestServiceWithConfig(log *slog.Logger, cfg *config.Config, dockerClient
 	}
 }
 
-// CleanupCancelledDeploy exposes cleanupCancelledDeploy for testing.
+// CleanupCancelledDeploy exposes the build directory cleanup portion of
+// cleanupCancelledDeploy for testing. It removes build directories matching
+// the deployment ID prefix.
 func (svc *Service) CleanupCancelledDeploy(
 	ctx context.Context,
 	appName string,
@@ -66,7 +69,7 @@ func (svc *Service) CleanupCancelledDeploy(
 	prefix := fmt.Sprintf("%d-", deploymentID)
 
 	for _, entry := range entries {
-		if entry.IsDir() && len(entry.Name()) > len(prefix) && entry.Name()[:len(prefix)] == prefix {
+		if entry.IsDir() && strings.HasPrefix(entry.Name(), prefix) {
 			dirPath := filepath.Join(buildDir, entry.Name())
 			_ = os.RemoveAll(dirPath)
 		}