Merge pull request 'Run CI on push to main' (#11) from ci/test-on-push into main

Reviewed-on: #11

.gitea/workflows/test-pr.yaml

@@ -1,24 +1,35 @@
-name: PR Check
+name: CI
 on:
-  - pull_request
+  pull_request:
+  push:
+    branches:
+      - main
 
 jobs:
   check-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@main
+      - uses: actions/checkout@v4
-      - uses: actions/setup-go@main
+      - uses: actions/setup-go@v5
         with:
-          go-version-file: 'go.mod'
+          go-version: '1.26.7'
       - run: go mod tidy
       - run: go build ./...
       - run: go vet ./...
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v4
+        uses: golangci/golangci-lint-action@v8
         with:
-          version: latest
+          version: v2.12
           args: --timeout=5m
-      - run: go install golang.org/x/vuln/cmd/govulncheck@latest
-      - run: govulncheck ./...
       - run: go test -race -v -shuffle=on -coverprofile=coverage.out -timeout=5m ./...
       - run: go tool cover -func=coverage.out | tail -10  # basic coverage report
+
+  vulncheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.27.0'
+      - run: go install golang.org/x/vuln/cmd/govulncheck@latest
+      - run: govulncheck ./...

.golangci.yml

@@ -1,58 +1,55 @@
-# .golangci.yml - steamcache2 lint config
+# .golangci.yml - steamcache2 lint config (golangci-lint v2)
 # Philosophy: enable reasonable linters by default (golangci curated set + key additions)
 # then use most specific suppressions possible (source //nosec with justification,
 # _ = discard for errcheck on unavoidable client writes, narrow exclude-rules only for tests).
 # This makes remaining accepted issues visible and actionable in the code.
 # Run with: make lint (or golangci-lint run ./...)
-# Install: go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
+version: "2"
 
 run:
   timeout: 5m
   modules-download-mode: readonly
 
 linters:
-  # No disable-all: use golangci defaults (errcheck, govet, ineffassign, staticcheck, unused, gosimple, etc.)
+  # No default: none — use golangci defaults (errcheck, govet, ineffassign, staticcheck, unused, etc.)
   # Explicitly enable the non-default linters we require for this LAN cache proxy.
   enable:
     - gosec     # security checks (re-audited; see source //nosec for justified cases)
     - misspell  # documentation hygiene
-    - goimports # import formatting (enforced)
+  settings:
-    # gofmt covered via linter or goimports; errcheck/govet etc. from defaults
-
-linters-settings:
     errcheck:
       check-type-assertions: false
       check-blank: false
+    # gosec: keep source-level //nosec for G104/G115/G301/G304/G306.
+    # G704/G705 are new taint-analysis rules (SSRF/XSS) not present in v1.64.8;
+    # a CDN cache proxy forwards upstream URLs and response bodies by design.
     gosec:
-    # Broad global excludes removed (G104/G115/G301/G304/G306).
+      excludes:
-    # - G301 addressed by switching cache MkdirAll to 0700 (least privilege for CDN content).
+        - G704
-    # - Remaining justified cases documented with precise //nosec (or #nosec) + comments at the call sites.
+        - G705
-    # - G104 largely eliminated by errcheck + explicit _ = handling (or defer wrappers).
+    # v1 staticcheck checks: ["all"] meant SA* only. v2 merged stylecheck (ST*)
+    # and quickfix (QF*) into staticcheck; keep the previous SA*+gosimple set.
     staticcheck:
-    checks: ["all"] # SA1019 exclusion removed (no deprecated API usages in tree)
+      checks:
+        - all
+        - "-ST*"
+        - "-QF*"
     govet:
       enable-all: true
       disable:
         - fieldalignment # performance tuning not a priority for this proxy appliance
         - shadow # common idiomatic "err" redeclarations in error-handling chains (large ServeHTTP, root, parse funcs); enabling adds noise with no real bugs; would require scope refactor for little gain
-
+  exclusions:
-# Old global errcheck disable + aspirational "re-enable after refactors" comments deleted.
+    generated: lax
-# errcheck is now on via defaults. Unavoidable cases handled at source with _ = or (rarely) narrow rules.
+    paths:
-
-issues:
-  max-issues-per-linter: 0
-  max-same-issues: 0
-  exclude-use-default: false
-  exclude-dirs:
       - dist
       - bin
-  exclude-rules:
+    rules:
       - path: _test\.go
         linters:
           - errcheck
           - gosec # tests often use weak patterns intentionally (e.g. error injection, temp files)
       # NOTE: narrow SA9003 exclude retained only for the one remaining intentional empty branch in test (best-effort status check; main assert is metrics side-effect).
-    # The config one was a truly redundant check (already errored above); deleted surgically in Fix Round 1 (Issue 1), eliminating its exclude-rule.
       - path: steamcache/steamcache_test.go
         linters:
           - staticcheck
@@ -82,5 +79,16 @@ issues:
         linters:
           - gosec
         text: "G304"
-    # Predictive/* rules deleted: vfs/predictive/ removed in commit 0dbb2e0; rules were stale/dead.
+
-    # All other suppressions use source-level //nosec (gosec) or _= (errcheck) for precision and visibility.
+formatters:
+  enable:
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - dist
+      - bin
+
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0

go.mod

@@ -1,6 +1,6 @@
 module s1d3sw1ped/steamcache2
 
-go 1.23.0
+go 1.26.0
 
 require (
 	github.com/docker/go-units v0.5.0