chore: modernize Go toolchain, CI, and lint setup#2
Open
dwin wants to merge 4 commits into
Open
Conversation
- Bump go.mod to Go 1.23 and refresh dependencies (golang.org/x/crypto v0.32.0,
github.com/icrowley/fake latest, github.com/corpix/uarand v0.2.0)
- Drop legacy vendor/ directory in favor of Go modules
- Remove .travis.yml; add .github/workflows/ci.yml running tests with -race on
Go 1.23 and 1.24 plus golangci-lint v2
- Add .golangci.yml (v2 config) enabling errcheck, govet, staticcheck, gosec,
errorlint, gocritic, revive, etc., with gofmt/goimports formatters
- Update codeql-analysis.yml to actions/checkout@v4, setup-go@v5, and
github/codeql-action v3
- Replace Travis badge with CI badge; switch GoDoc badge to pkg.go.dev
- Fix issues surfaced by the new linters:
* Stop swallowing errors from scryptHash and base64.Decode in Hash,
updateMasterV1 and verifyV1 (ineffassign was masking real bugs)
* Lowercase exported error message strings (ST1005)
* Replace naked returns with explicit returns
* Use errors.Is in tests instead of sentinel != comparison
* Drop redundant []byte conversions and remove variable shadowing
Prevents accidental commits of locally-built example binary, coverage.out, and test executables.
Aligns casing with the nacl/secretbox package name.
- Bump golangci/golangci-lint-action to v8 (required for golangci-lint v2; the previous v6 only supports v1.x, which caused the Lint job to fail setup before running) - Pin every GHA reference to a full commit SHA with the tag in a trailing comment, per OpenSSF / GitHub hardening guidance
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Modernizes the repository's Go toolchain and CI plumbing, and resolves the lint findings that surfaced as a result.
Tooling
go.modto Go 1.23; refresh deps (golang.org/x/crypto v0.32.0, latesticrowley/fake,corpix/uarand v0.2.0)vendor/directory (modules-only — libraries shouldn't vendor).travis.yml.github/workflows/ci.ymlrunninggo build -race+go test -race -coverprofileon Go 1.23 and 1.24, plus agolangci-lint v2.5.0jobcodeql-analysis.ymltoactions/checkout@v4,actions/setup-go@v5, andgithub/codeql-action@v3.golangci.yml(v2 schema) witherrcheck,govet(enable-all),staticcheck,gosec,errorlint,gocritic,revive,bodyclose,unparam,prealloc, etc., plusgofmt/goimportsformatters.gitignorenow coverscoverage.out,*.test, and the example binarySource fixes from new linters
scryptHashandbase64.Decodewere being silently overwritten inHash,verifyV1, andupdateMasterV1. They are now propagated (ineffassignwas masking real bugs)password.go[]byte(...)conversions on values already[]byteerrinencrypt/scryptHashST1005);errors.Isis unaffectederr != ErrXxxchecks witherrors.Is(err, ErrXxx)(errorlint)total += lgth,t.Logf("Output: %s", output), comment spacingTest plan
go build ./...go vet ./...gofmt -l .(clean)golangci-lint run ./...→ 0 issuesgo test -race -count=1 ./...→ PASS (~195s, scrypt is intentionally slow)go mod verifyNotes / follow-ups
Two pre-existing items intentionally left out of scope:
GetHashVersionusesstrings.Trim(parts[0], "secBoxv")which strips a cutset rather than the prefix. Works for the current version string but should bestrings.TrimPrefixfor correctness.icrowley/faketest dependency is largely unmaintained upstream; could be replaced with a small inline random-password helper in a follow-up.Generated by Claude Code