ci(template): sync

.github/workflows/codeql.yml

@@ -16,9 +16,16 @@ on:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
+  workflow_dispatch:
   schedule:
     - cron: '23 23 * * 2'
 
+permissions: {}
+
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -61,7 +68,14 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      with:
+        persist-credentials: false
+
+    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      if: matrix.language == 'go'
+      with:
+        go-version-file: go.mod
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -71,7 +85,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -99,6 +113,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/go.yml

@@ -8,75 +8,60 @@ on:
       - 'go.mod'
       - 'go.sum'
       - '.golangci.yml'
+      - 'Makefile'
       - '.github/workflows/go.yml'
   pull_request:
     paths:
       - '**.go'
       - 'go.mod'
       - 'go.sum'
       - '.golangci.yml'
+      - 'Makefile'
       - '.github/workflows/go.yml'
   workflow_dispatch:
 
+permissions: {}
+
+concurrency:
+  group: ci-go-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   vet-test-update-build:
     name: Vet, Test, Update and Build
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      pull-requests: write
+      contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
-          go-version-file: 'go.mod'
+          go-version: stable
           cache: true
 
-      - name: Update dependencies
-        run: go get all
-
-      - name: Update go.sum
-        run: go mod tidy
+      - name: Verify dependencies
+        run: go mod download && go mod verify
 
       - name: Run vet
         run: go vet $(go list ./...)
 
       - name: Run tests
-        run: go test -vet=off $(go list ./...)
+        run: make test
 
       - name: Build binary
         run: go build -v -o dist/QuickNote .
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: QuickNote-Binary
           path: dist/QuickNote
 
-      - name: Check for file changes
-        id: git-check
-        run: |
-          if git diff --exit-code; then
-            echo "changed=false" >> $GITHUB_OUTPUT
-          else
-            echo "changed=true" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Create Pull Request with update dependencies
-        if: steps.git-check.outputs.changed == 'true' && github.ref == 'refs/heads/main'
-        uses: peter-evans/create-pull-request@v7
-        with:
-          commit-message: "chore(backend): update dependencies"
-          title: "chore(backend): update dependencies"
-          body: "The `Update dependencies` action wants to apply these fixes."
-          branch: "chore/go-dependencies"
-          base: main
-          signoff: true
-          sign-commits: true
-
   lint:
     name: Lint and Auto-fix
     runs-on: ubuntu-latest
@@ -85,21 +70,21 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
-          go-version-file: 'go.mod'
+          go-version: stable
           cache: true
 
       - name: Run golangci-lint with auto-fix
-        uses: golangci/golangci-lint-action@v8
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
         with:
           version: latest
           args: --fix
-          cache-key: golangci-lint
-          cache: true
 
       - name: Check for file changes
         id: git-check
@@ -112,12 +97,12 @@ jobs:
 
       - name: Create Pull Request with lint fixes
         if: steps.git-check.outputs.changed == 'true' && github.ref == 'refs/heads/main'
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
           commit-message: "chore(backend): fix lint issues"
           title: "chore(backend): fix lint issues"
           body: "The `golangci-lint` action wants to apply these fixes."
           branch: "chore/go-lint-fixes"
           base: main
           signoff: true
-          sign-commits: true
+          sign-commits: true

.golangci.yml

@@ -1,9 +1,11 @@
 version: "2"
 
 linters:
+  default: none
   enable:
     - govet
     - errcheck
+    - ineffassign
     - staticcheck
     - unused
     - nilnesserr
@@ -20,9 +22,10 @@ linters:
     - whitespace
     - tagalign
     - dupl
+    - dogsled
     - nolintlint
     - maintidx
-    - wsl
+    - wsl_v5
     - decorder
     - asciicheck
     - bidichk
@@ -44,6 +47,7 @@ linters:
     - ginkgolinter
     - gocheckcompilerdirectives
     - gochecksumtype
+    - gosec
     - gomoddirectives
     - goprintffuncname
     - importas
@@ -63,6 +67,7 @@ linters:
     - protogetter
     - reassign
     - recvcheck
+    - revive
     - rowserrcheck
     - sloglint
     - spancheck
@@ -81,6 +86,12 @@ linters:
     - misspell
     - tparallel
 
+  settings:
+    revive:
+      enable-default-rules: false
+      rules:
+        - name: var-declaration
+
 run:
   tests: true
   concurrency: 4
@@ -91,7 +102,6 @@ run:
 issues:
   max-issues-per-linter: 0
   uniq-by-line: true
-  fix: true
 
 formatters:
   enable:

Makefile

@@ -8,13 +8,21 @@ RM_RF := rm -rf ./static
 
 UNAME_S := $(shell uname -s)
 
+RACE_PLATFORMS := \
+	linux/amd64 linux/arm64 linux/ppc64le linux/s390x \
+	freebsd/amd64 netbsd/amd64 darwin/amd64 darwin/arm64 windows/amd64
+GO_TEST_PLATFORM := $(shell go env GOOS)/$(shell go env GOARCH)
+GO_TEST_RACE := $(if $(and \
+	$(filter 1,$(shell go env CGO_ENABLED)), \
+	$(filter $(GO_TEST_PLATFORM),$(RACE_PLATFORMS))),-race)
+
 ifeq ($(OS),Windows_NT)
 	EXT := .exe
 	MOVE := move
 	RM_RF := if exist static ( rmdir /s /q static )
 endif
 
-.PHONY: test_release run_docker update_depends update_frontend_depends build
+.PHONY: test_release run_docker update_depends update_frontend_depends build lint lint-fix test security ci
 
 test_release:
 	@echo "<<< Starting test release"
@@ -61,3 +69,17 @@ build:
 		-asmflags="-trimpath" main.go
 
 	@echo "<<< Build complete: ./QuicKNote$(EXT)"
+
+lint:
+	go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.15.0 run
+
+lint-fix:
+	go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.15.0 run --fix
+
+test:
+	go test $(GO_TEST_RACE) ./...
+
+security:
+	go run golang.org/x/vuln/cmd/govulncheck@latest ./...
+
+ci: lint test security

internal/note/instance.go

@@ -13,6 +13,7 @@ func InitNoteSchema() error {
 
 func GetNote(nid string) (Note, error) {
 	var note Note
+
 	err := orm.Instance.Get().First(&note, "n_id = ?", nid).Error
 
 	return note, err

internal/note/marshal.go

@@ -14,6 +14,7 @@ const (
 	magicVersion = 1
 	fieldTitle   = 1
 	fieldContent = 2
+	maxFieldSize = 64 << 20
 )
 
 // magicHeader First 2 bytes of SHA-256 hash of "QuickNote"
@@ -38,6 +39,7 @@ func (n *Note) Encode() error {
 	writeField(fieldContent, n.Content)
 
 	var err error
+
 	n.Data, err = compress.FlateCompress(buf.Bytes())
 	n.Title, n.Content = nil, nil
 
@@ -85,7 +87,12 @@ func (n *Note) Decode(data []byte) error {
 			return fmt.Errorf("read field %d length: %w", id, err)
 		}
 
-		value := make([]byte, binary.LittleEndian.Uint32(buf))
+		fieldLen := binary.LittleEndian.Uint32(buf)
+		if fieldLen > maxFieldSize || int64(fieldLen) > int64(r.Len()) {
+			return fmt.Errorf("field %d length exceeds remaining data", id)
+		}
+
+		value := make([]byte, int(fieldLen))
 		if _, err = io.ReadFull(r, value); err != nil {
 			return fmt.Errorf("read field %d: %w", id, err)
 		}

internal/note/marshal_test.go

@@ -2,19 +2,18 @@ package note
 
 import (
 	"bytes"
-	"math/rand/v2"
 	"testing"
 )
 
-func generateRandomNote() *Note {
+func generateNote() *Note {
 	return &Note{
-		Title:   bytes.Repeat([]byte{'a'}, rand.IntN(100)+50),
-		Content: bytes.Repeat([]byte{'b'}, rand.IntN(1000)+500),
+		Title:   bytes.Repeat([]byte{'a'}, 100),
+		Content: bytes.Repeat([]byte{'b'}, 1000),
 	}
 }
 
 func BenchmarkEncode(b *testing.B) {
-	note := generateRandomNote()
+	note := generateNote()
 
 	b.ResetTimer()
 
@@ -24,7 +23,7 @@ func BenchmarkEncode(b *testing.B) {
 }
 
 func BenchmarkDecode(b *testing.B) {
-	note := generateRandomNote()
+	note := generateNote()
 	if err := note.Encode(); err != nil {
 		b.Fatalf("Failed to encode note for benchmark: %v", err)
 	}
@@ -40,7 +39,7 @@ func BenchmarkDecode(b *testing.B) {
 }
 
 func BenchmarkEncodeDecode(b *testing.B) {
-	note := generateRandomNote()
+	note := generateNote()
 
 	b.ResetTimer()
 

pkg/compress/flate.go

@@ -3,9 +3,12 @@ package compress
 import (
 	"bytes"
 	"compress/flate"
+	"fmt"
 	"io"
 )
 
+const maxDecompressedSize = 64 << 20
+
 func FlateCompress(data []byte) ([]byte, error) {
 	var b bytes.Buffer
 	// level: flate.DefaultCompression, flate.BestSpeed, etc.
@@ -32,10 +35,14 @@ func FlateDecompress(compressed []byte) ([]byte, error) {
 
 	var out bytes.Buffer
 
-	_, err := io.Copy(&out, reader)
+	_, err := io.Copy(&out, io.LimitReader(reader, maxDecompressedSize+1))
 	if err != nil {
 		return nil, err
 	}
 
+	if out.Len() > maxDecompressedSize {
+		return nil, fmt.Errorf("decompressed data exceeds %d bytes", maxDecompressedSize)
+	}
+
 	return out.Bytes(), nil
 }