popertots/Crussell
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: pin go install tool versions (gitleaks/golangci-lint/staticcheck/gosec/govulncheck), env-docs check covers getEnv reads, ignore .sisyphus session artifacts

Browse Source 
- ci.yaml: no more @latest — pinned to released versions; supply-chain audit clean (govulncheck gates CI, npm audit gate, lockfiles committed, npm ci)
- check-env-docs.py: detects env vars read via the getEnv() helper (R2_* blind spot closed); 42 vars documented
- .gitignore: .sisyphus/ review reports

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
This commit is contained in:
popertots
2026-08-22 00:34:51 +01:00
co-authored by Sisyphus
parent 93be93f86c
commit fba00a10ad
3 changed files with 55 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yaml
+8 -7
View File
@@ -41,7 +41,8 @@ jobs:
run: apk add --no-cache git
- name: Install gitleaks
run: go install github.com/zricethezav/gitleaks/v8@latest
# Pinned to a released version (supply-chain: never install @latest).
run: go install github.com/gitleaks/gitleaks/v8@v8.30.1
- name: Detect secrets
run: gitleaks detect --source . --verbose --no-banner
@@ -198,7 +199,7 @@ jobs:
- name: golangci-lint
run: |
go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
go install github.com/golangci/golangci-lint/cmd/golangci-lint@v2.12.2
golangci-lint run ./... --timeout 5m
working-directory: backend
@@ -235,7 +236,7 @@ jobs:
- name: Staticcheck (dev tags)
run: |
go install honnef.co/go/tools/cmd/staticcheck@latest
go install honnef.co/go/tools/cmd/staticcheck@2026.1
staticcheck -tags "test,dev" ./...
working-directory: backend
@@ -272,7 +273,7 @@ jobs:
- name: Staticcheck (prod tags)
run: |
go install honnef.co/go/tools/cmd/staticcheck@latest
go install honnef.co/go/tools/cmd/staticcheck@2026.1
staticcheck -tags "test,!dev" ./...
working-directory: backend
@@ -309,7 +310,7 @@ jobs:
- name: gosec (dev tags)
run: |
go install github.com/securego/gosec/v2/cmd/gosec@latest
go install github.com/securego/gosec/v2/cmd/gosec@v2.27.1
gosec -severity medium -tags "test,dev" ./...
working-directory: backend
@@ -346,7 +347,7 @@ jobs:
- name: gosec (prod tags)
run: |
go install github.com/securego/gosec/v2/cmd/gosec@latest
go install github.com/securego/gosec/v2/cmd/gosec@v2.27.1
gosec -severity medium -tags "test,!dev" ./...
working-directory: backend
@@ -609,7 +610,7 @@ jobs:
- name: Go vulnerability scan
working-directory: backend
run: |
go install golang.org/x/vuln/cmd/govulncheck@latest
go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
govulncheck ./...
frontend-deps: