From fba00a10ade61997e35a071bf31465fb3fe0eed8 Mon Sep 17 00:00:00 2001 From: Stephen Adamson Date: Sun, 16 Aug 2026 18:26:01 +0100 Subject: [PATCH] ci: pin go install tool versions (gitleaks/golangci-lint/staticcheck/gosec/govulncheck), env-docs check covers getEnv reads, ignore .sisyphus session artifacts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - ci.yaml: no more @latest — pinned to released versions; supply-chain audit clean (govulncheck gates CI, npm audit gate, lockfiles committed, npm ci) - check-env-docs.py: detects env vars read via the getEnv() helper (R2_* blind spot closed); 42 vars documented - .gitignore: .sisyphus/ review reports Co-authored-by: Sisyphus Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) --- .gitea/workflows/ci.yaml | 15 ++++++++------- .gitignore | 24 +++++++++++++++++++++++- scripts/check-env-docs.py | 29 ++++++++++++++++++++++++----- 3 files changed, 55 insertions(+), 13 deletions(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 8785da2..d805ebd 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -41,7 +41,8 @@ jobs: run: apk add --no-cache git - name: Install gitleaks - run: go install github.com/zricethezav/gitleaks/v8@latest + # Pinned to a released version (supply-chain: never install @latest). + run: go install github.com/gitleaks/gitleaks/v8@v8.30.1 - name: Detect secrets run: gitleaks detect --source . --verbose --no-banner @@ -198,7 +199,7 @@ jobs: - name: golangci-lint run: | - go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest + go install github.com/golangci/golangci-lint/cmd/golangci-lint@v2.12.2 golangci-lint run ./... --timeout 5m working-directory: backend @@ -235,7 +236,7 @@ jobs: - name: Staticcheck (dev tags) run: | - go install honnef.co/go/tools/cmd/staticcheck@latest + go install honnef.co/go/tools/cmd/staticcheck@2026.1 staticcheck -tags "test,dev" ./... working-directory: backend @@ -272,7 +273,7 @@ jobs: - name: Staticcheck (prod tags) run: | - go install honnef.co/go/tools/cmd/staticcheck@latest + go install honnef.co/go/tools/cmd/staticcheck@2026.1 staticcheck -tags "test,!dev" ./... working-directory: backend @@ -309,7 +310,7 @@ jobs: - name: gosec (dev tags) run: | - go install github.com/securego/gosec/v2/cmd/gosec@latest + go install github.com/securego/gosec/v2/cmd/gosec@v2.27.1 gosec -severity medium -tags "test,dev" ./... working-directory: backend @@ -346,7 +347,7 @@ jobs: - name: gosec (prod tags) run: | - go install github.com/securego/gosec/v2/cmd/gosec@latest + go install github.com/securego/gosec/v2/cmd/gosec@v2.27.1 gosec -severity medium -tags "test,!dev" ./... working-directory: backend @@ -609,7 +610,7 @@ jobs: - name: Go vulnerability scan working-directory: backend run: | - go install golang.org/x/vuln/cmd/govulncheck@latest + go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 govulncheck ./... frontend-deps: diff --git a/.gitignore b/.gitignore index 933cb79..11e1c38 100644 --- a/.gitignore +++ b/.gitignore @@ -69,7 +69,24 @@ sabredav/vendor/ composer.lock # ------------------------------------ -# 5. Local Tools and Notes +# 5. Obsidian vault junk (machine-local state / plugin binaries) +# ------------------------------------ + +# Untitled canvas scratch file +obsidian/Untitled.canvas + +# Volatile per-session workspace/graph/view state +obsidian/.obsidian/workspace.json +obsidian/.obsidian/graph.json +obsidian/.obsidian/appearance.json +obsidian/.obsidian/core-plugins.json + +# Plugin binaries (multi-MB main.js files) — regenerated on plugin install +obsidian/.obsidian/plugins/ +obsidian/Crussell/.obsidian/plugins/ + +# ------------------------------------ +# 6. Local Tools and Notes # ------------------------------------ # Bruno testing environments (keep collection files, ignore secrets) @@ -83,6 +100,10 @@ bruno/*/environments/ .Trash/ Thumbs.db +# Python bytecode +__pycache__/ +*.pyc + # ------------------------------------ # Git-specific # ------------------------------------ @@ -102,3 +123,4 @@ nginx/*.log # Temp files frontend/node_modules/.vite-temp +.sisyphus/ diff --git a/scripts/check-env-docs.py b/scripts/check-env-docs.py index c852f30..4390c11 100644 --- a/scripts/check-env-docs.py +++ b/scripts/check-env-docs.py @@ -20,6 +20,12 @@ GETENV_RE = re.compile( r'os\.(?:Getenv|LookupEnv)\(\s*(?:"([A-Z_][A-Z0-9_]*)"|([A-Za-z_]\w*))\s*\)' ) +# Matches the codebase's custom getEnv(key, ...) helper (db/db.go, +# db/db_dev.go, internal/s3/s3.go, internal/dav/service_dev.go, +# internal/dav/service_prod.go, handlers/user/profile.go) — the first +# argument is always a literal env var name. +GETENV_HELPER_RE = re.compile(r'getEnv\(\s*"([A-Z_][A-Z0-9_]*)"') + def go_const_map(): """Return {package_name: {const_name: "ENV_NAME"}} from all backend Go files. @@ -78,6 +84,7 @@ def find_env_vars_in_code(): env_vars.add(pkg_consts[identifier]) # Non-const identifiers (e.g. function params like getEnv(key)) # cannot be resolved to a specific env var — skip them. + env_vars.update(GETENV_HELPER_RE.findall(content)) # Search frontend files for import.meta.env.VITE_* / import.meta.env.* frontend_dir = os.path.join(REPO_ROOT, 'frontend') @@ -95,11 +102,23 @@ def find_env_vars_in_code(): # itself and cannot be defined in .env.example — never treat them as user env vars. env_vars -= {'DEV', 'PROD', 'SSR', 'MODE', 'BASE_URL', 'BUILD'} - # GO_WANT_HELPER_PROCESS is the conventional Go test-internal sentinel for - # the "re-exec self as helper process" pattern (startup_checks_test.go sets - # it via cmd.Env on the re-exec'd binary). It is NOT a user-configurable - # variable — it never belongs in .env.example, so never flag it. - env_vars -= {'GO_WANT_HELPER_PROCESS'} + # Test-internal sentinels that are NOT user-configurable variables and so + # never belong in .env.example (never flag them): + # - GO_WANT_HELPER_PROCESS: the conventional Go test-internal sentinel + # for the "re-exec self as helper process" pattern + # (startup_checks_test.go sets it via cmd.Env on the re-exec'd binary). + # - TEST_DB_VAR / TEST_DB_MISSING_VAR: set by db_test.go's getEnv unit + # tests (os.Setenv within the test itself), not read from any real + # environment. + # - SNAPSHOT_ENC_KEY_BRANCH / WEBHOOK_BRANCH / SQUARE_CRED_BRANCH: + # re-exec sentinels for the fatal-branch startup tests + # (startup_checks_test.go, square_http_client_test.go), set via cmd.Env + # like GO_WANT_HELPER_PROCESS. + env_vars -= { + 'GO_WANT_HELPER_PROCESS', + 'TEST_DB_VAR', 'TEST_DB_MISSING_VAR', + 'SNAPSHOT_ENC_KEY_BRANCH', 'WEBHOOK_BRANCH', 'SQUARE_CRED_BRANCH', + } return sorted(env_vars)