popertots/Crussell
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: pin go install tool versions (gitleaks/golangci-lint/staticcheck/gosec/govulncheck), env-docs check covers getEnv reads, ignore .sisyphus session artifacts

Browse Source 
- ci.yaml: no more @latest — pinned to released versions; supply-chain audit clean (govulncheck gates CI, npm audit gate, lockfiles committed, npm ci)
- check-env-docs.py: detects env vars read via the getEnv() helper (R2_* blind spot closed); 42 vars documented
- .gitignore: .sisyphus/ review reports

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
This commit is contained in:
popertots
2026-08-22 00:34:51 +01:00
co-authored by Sisyphus
parent 93be93f86c
commit fba00a10ad
3 changed files with 55 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yaml
+8 -7
View File
@@ -41,7 +41,8 @@ jobs:
run: apk add --no-cache git
- name: Install gitleaks
run: go install github.com/zricethezav/gitleaks/v8@latest
# Pinned to a released version (supply-chain: never install @latest).
run: go install github.com/gitleaks/gitleaks/v8@v8.30.1
- name: Detect secrets
run: gitleaks detect --source . --verbose --no-banner
@@ -198,7 +199,7 @@ jobs:
- name: golangci-lint
run: |
go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
go install github.com/golangci/golangci-lint/cmd/golangci-lint@v2.12.2
golangci-lint run ./... --timeout 5m
working-directory: backend
@@ -235,7 +236,7 @@ jobs:
- name: Staticcheck (dev tags)
run: |
go install honnef.co/go/tools/cmd/staticcheck@latest
go install honnef.co/go/tools/cmd/staticcheck@2026.1
staticcheck -tags "test,dev" ./...
working-directory: backend
@@ -272,7 +273,7 @@ jobs:
- name: Staticcheck (prod tags)
run: |
go install honnef.co/go/tools/cmd/staticcheck@latest
go install honnef.co/go/tools/cmd/staticcheck@2026.1
staticcheck -tags "test,!dev" ./...
working-directory: backend
@@ -309,7 +310,7 @@ jobs:
- name: gosec (dev tags)
run: |
go install github.com/securego/gosec/v2/cmd/gosec@latest
go install github.com/securego/gosec/v2/cmd/gosec@v2.27.1
gosec -severity medium -tags "test,dev" ./...
working-directory: backend
@@ -346,7 +347,7 @@ jobs:
- name: gosec (prod tags)
run: |
go install github.com/securego/gosec/v2/cmd/gosec@latest
go install github.com/securego/gosec/v2/cmd/gosec@v2.27.1
gosec -severity medium -tags "test,!dev" ./...
working-directory: backend
@@ -609,7 +610,7 @@ jobs:
- name: Go vulnerability scan
working-directory: backend
run: |
go install golang.org/x/vuln/cmd/govulncheck@latest
go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
govulncheck ./...
frontend-deps:
.gitignore
+23 -1
View File
@@ -69,7 +69,24 @@ sabredav/vendor/
composer.lock
# ------------------------------------
# 5. Local Tools and Notes
# 5. Obsidian vault junk (machine-local state / plugin binaries)
# ------------------------------------
# Untitled canvas scratch file
obsidian/Untitled.canvas
# Volatile per-session workspace/graph/view state
obsidian/.obsidian/workspace.json
obsidian/.obsidian/graph.json
obsidian/.obsidian/appearance.json
obsidian/.obsidian/core-plugins.json
# Plugin binaries (multi-MB main.js files) — regenerated on plugin install
obsidian/.obsidian/plugins/
obsidian/Crussell/.obsidian/plugins/
# ------------------------------------
# 6. Local Tools and Notes
# ------------------------------------
# Bruno testing environments (keep collection files, ignore secrets)
@@ -83,6 +100,10 @@ bruno/*/environments/
.Trash/
Thumbs.db
# Python bytecode
__pycache__/
*.pyc
# ------------------------------------
# Git-specific
# ------------------------------------
@@ -102,3 +123,4 @@ nginx/*.log
# Temp files
frontend/node_modules/.vite-temp
.sisyphus/
scripts/check-env-docs.py
+24 -5
View File
@@ -20,6 +20,12 @@ GETENV_RE = re.compile(
r'os\.(?:Getenv|LookupEnv)\(\s*(?:"([A-Z_][A-Z0-9_]*)"|([A-Za-z_]\w*))\s*\)'
)
# Matches the codebase's custom getEnv(key, ...) helper (db/db.go,
# db/db_dev.go, internal/s3/s3.go, internal/dav/service_dev.go,
# internal/dav/service_prod.go, handlers/user/profile.go) — the first
# argument is always a literal env var name.
GETENV_HELPER_RE = re.compile(r'getEnv\(\s*"([A-Z_][A-Z0-9_]*)"')
def go_const_map():
"""Return {package_name: {const_name: "ENV_NAME"}} from all backend Go files.
@@ -78,6 +84,7 @@ def find_env_vars_in_code():
env_vars.add(pkg_consts[identifier])
# Non-const identifiers (e.g. function params like getEnv(key))
# cannot be resolved to a specific env var — skip them.
env_vars.update(GETENV_HELPER_RE.findall(content))
# Search frontend files for import.meta.env.VITE_* / import.meta.env.*
frontend_dir = os.path.join(REPO_ROOT, 'frontend')
@@ -95,11 +102,23 @@ def find_env_vars_in_code():
# itself and cannot be defined in .env.example — never treat them as user env vars.
env_vars -= {'DEV', 'PROD', 'SSR', 'MODE', 'BASE_URL', 'BUILD'}
# GO_WANT_HELPER_PROCESS is the conventional Go test-internal sentinel for
# the "re-exec self as helper process" pattern (startup_checks_test.go sets
# it via cmd.Env on the re-exec'd binary). It is NOT a user-configurable
# variable — it never belongs in .env.example, so never flag it.
env_vars -= {'GO_WANT_HELPER_PROCESS'}
# Test-internal sentinels that are NOT user-configurable variables and so
# never belong in .env.example (never flag them):
# - GO_WANT_HELPER_PROCESS: the conventional Go test-internal sentinel
# for the "re-exec self as helper process" pattern
# (startup_checks_test.go sets it via cmd.Env on the re-exec'd binary).
# - TEST_DB_VAR / TEST_DB_MISSING_VAR: set by db_test.go's getEnv unit
# tests (os.Setenv within the test itself), not read from any real
# environment.
# - SNAPSHOT_ENC_KEY_BRANCH / WEBHOOK_BRANCH / SQUARE_CRED_BRANCH:
# re-exec sentinels for the fatal-branch startup tests
# (startup_checks_test.go, square_http_client_test.go), set via cmd.Env
# like GO_WANT_HELPER_PROCESS.
env_vars -= {
'GO_WANT_HELPER_PROCESS',
'TEST_DB_VAR', 'TEST_DB_MISSING_VAR',
'SNAPSHOT_ENC_KEY_BRANCH', 'WEBHOOK_BRANCH', 'SQUARE_CRED_BRANCH',
}
return sorted(env_vars)