# Workflow

* branch (from `main`)
* do the work in Next Step
* move Next Step to the top of Completed Steps
* move the top item of Future Steps into Next Step
* commit (`TODO.md` changes in the same commit as the work)
* merge to `main` if the branch is not protected, otherwise open a PR
* push

# Status

1.0+. Tagged 1.0.0 on 2026-02-26. Policy violation: main currently
fails make check under golangci-lint >= 2.12 (47 lint issues remaining:
23 gosec, 24 goconst), so the tree is out of compliance until fixed. CI
(Dockerfile lint stage, pinned golangci-lint v2.10.1) is green; the pin
bump is tracked in issue #179. The road to release 1.1.0 is tracked in
Gitea issues #175-#182 (milestone 1.1.0).

# Next Step

Fix the 22 gosec G710 open-redirect findings in
internal/handlers/app.go (issue #176) by validating app IDs in a
shared redirect helper.

# Completed Steps

- 2026-08-07: Fixed all 47 noctx lint findings: tests now use
  httptest.NewRequestWithContext with t.Context() (#175).
- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
  Makefile shims, README Entrypoints section
- 2026-03-11: Monolithic env var editing with bulk save (#158).
- 2026-03-10: Webhook event history UI page (#164); added missing
  Makefile docker and hooks targets plus test timeout (#159);
  notification settings passed from create form (#160).
- 2026-03-03: REPO_POLICIES compliance file set added (#155).
- 2026-03-01: Module path changed to sneak.berlin/go/upaas (#143);
  Dockerfile split into lint and build stages with forced lint
  execution (#152, #154).
- 2026-02-26: 1.0.0 tagged; dashboard CSRFField crash fixed (#146).
- 1.0 audit bug fixes (#120-#125): deferred rollback on commit error,
  deployment log size cap, error path rendering, docker-compose bind
  mount, domain type refactor.
- CI simplified to docker build only (#130).
- 2025-12-29 onward: core PaaS built out: deploys with real-time build
  log streaming, container start/stop/restart and logs, TCP/UDP port
  mapping, Alpine.js UI, Slack notifications, ULID app IDs, session
  handling.

# Future Steps

- Get main green (compliance, ordered):
    - Fix 22 gosec G710 findings (Next Step, #176).
    - Fix 1 gosec G703 finding (#177).
    - Fix 24 goconst findings (#178).
    - Bump Dockerfile golangci-lint pin to v2.12.x (#179).
    - Run make check clean on main and keep it green; main must always
      pass.
- Confirm .gitea/workflows/check.yml gates merges on make check so main
  cannot regress (#180).
- Deploy to fsn1app1 and verify end-to-end (#181), then tag 1.1.0
  (#182).
- Resume feature work only after main is green.