Skip to content

File operations (hash, archive) #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
et-nik merged 4 commits into from
Jul 31, 2026
Merged

File operations (hash, archive) #6

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3f517f8
file operations
et-nik Jul 30, 2026
f165f24
review changes
et-nik Jul 30, 2026
c548f5e
review changes
et-nik Jul 31, 2026
d307614
review changes
et-nik Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 38 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
version: 2
updates:
- package-ecosystem: gomod
directory: /
schedule:
interval: weekly
open-pull-requests-limit: 10
groups:
# The archive decoders parse untrusted user-uploaded bytes; keep them
# together so a security bump lands as one reviewable change. Groups
# cover version updates only unless applies-to says otherwise, so the
# security updates these exist for need their own entry.
archive-decoders:
patterns:
- github.com/bodgit/*
- github.com/nwaples/rardecode/*
- github.com/dsnet/compress
- github.com/ulikunitz/xz
- github.com/klauspost/compress
Comment on lines +9 to +19

@coderabbitai coderabbitai Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- .github/dependabot.yml ---'
cat -n .github/dependabot.yml
printf '%s\n' '--- Dependabot-related files and patterns ---'
rg -n --hidden -S 'archive-decoders|applies-to|dependabot|github.com/(bodgit|nwaples/rardecode|dsnet/compress|ulikunitz/xz|klauspost/compress)' .github go.mod go.sum 2>/dev/null || true

Repository: gameap/daemon

Length of output: 3435

🏁 Script executed (no clone):

curl -Ls https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference | rg -n -A8 -B8 'applies-to|security-updates' | head -80

Length of output: 50344

🏁 Script executed (no clone):

#!/bin/bash
set -eu
log=/tmp/coderabbit-shell-logs/shell-output-MxsXMD
printf '%s\n' '--- Relevant documentation excerpts ---'
rg -o '.{0,500}(applies-to|security-updates|groups).{0,1200}' "$log" | head -20

Length of output: 30166

Configure the archive group for security updates.

The group applies only to version updates because applies-to is omitted. Add a separate group with applies-to: security-updates and the same patterns.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/dependabot.yml around lines 9 - 17, Update the Dependabot
configuration by adding a separate archive decoder group configured with
applies-to: security-updates and the same patterns as archive-decoders. Keep the
existing version-update group unchanged and give the security group a distinct
name.

archive-decoders-security:
applies-to: security-updates
patterns:
- github.com/bodgit/*
- github.com/nwaples/rardecode/*
- github.com/dsnet/compress
- github.com/ulikunitz/xz
- github.com/klauspost/compress
aws:
patterns:
- github.com/aws/*
otel:
patterns:
- go.opentelemetry.io/*

- package-ecosystem: github-actions
directory: /
schedule:
interval: monthly
30 changes: 22 additions & 8 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,18 +14,29 @@ jobs:
os: [ubuntu-latest]
runs-on: ${{ matrix.os }}
steps:
- name: Checkout code
uses: actions/checkout@v5
Comment on lines +17 to +18

@coderabbitai coderabbitai Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

rg -n -C 3 'actions/checkout@|persist-credentials|repo-checkout' .github/workflows/test.yml

curl -fsSL \
  https://raw.githubusercontent.com/golang/govulncheck-action/v1/action.yml |
  rg -n -C 3 'repo-checkout|actions/checkout|persist-credentials'

Repository: gameap/daemon

Length of output: 1103

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- workflow ---'
cat -n .github/workflows/test.yml

printf '%s\n' '--- all checkout-related configuration in workflows ---'
rg -n -C 4 'uses:\s*([^ ]*/)?actions/checkout@|persist-credentials|repo-checkout|permissions:' .github/workflows

Repository: gameap/daemon

Length of output: 4816

Disable GitHub credential persistence for all checkouts used by this workflow.

Set persist-credentials: false on both actions/checkout@v5 steps. Set repo-checkout: false on golang/govulncheck-action@v1 to disable its default checkout.

🧰 Tools
🪛 zizmor (1.28.0)

[warning] 17-18: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 1 file
  • .github/workflows/test.yml#L17-L18 (this comment)
  • .github/workflows/test.yml#L28-L31
  • .github/workflows/test.yml#L60-L61
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test.yml around lines 17 - 18, Update all affected
workflow sites in .github/workflows/test.yml: add persist-credentials: false to
the checkout steps at lines 17-18 and 28-31, and set repo-checkout: false for
golang/govulncheck-action@v1 at lines 60-61.

Source: Linters/SAST tools

with:
# Nothing here pushes back, so the job has no use for the token
# checkout would otherwise leave in .git/config for every later step.
persist-credentials: false

- name: Install Go
uses: actions/setup-go@v2
uses: actions/setup-go@v6
with:
stable: false
go-version: ${{ matrix.go-version }}

- name: Checkout code
uses: actions/checkout@v2

- name: Set up dependencies
run: go mod download

- name: Run govulncheck
uses: golang/govulncheck-action@v1
with:
go-version-input: ${{ matrix.go-version }}
# The code is already checked out above; the action's own checkout
# would only redo it and re-persist the credentials.
repo-checkout: false

- name: Run golangci-lint
uses: golangci/golangci-lint-action@v8
with:
Expand Down Expand Up @@ -53,13 +64,16 @@ jobs:
test-cache:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
persist-credentials: false

- name: Install Go
uses: actions/setup-go@v2
uses: actions/setup-go@v6
with:
go-version: 1.26.x

- name: Checkout code
uses: actions/checkout@v2
- uses: actions/cache@v4
with:
# In order:
Expand Down
77 changes: 46 additions & 31 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,29 +1,38 @@
module github.com/gameap/daemon

go 1.26
// 1.26.5 is a security floor, not a language requirement: it carries the fixes
// for GO-2026-4970 and GO-2026-4864 (os.Root escapes) and GO-2026-4869
// (unbounded allocation in archive/tar). The daemon resolves every
// caller-supplied path through os.Root, so those are load-bearing.
go 1.26.5

require (
github.com/bodgit/sevenzip v1.6.5
github.com/containerd/errdefs v1.0.0
github.com/dgraph-io/ristretto/v2 v2.4.0
github.com/dsnet/compress v0.0.1
github.com/emirpasic/gods v1.18.1
github.com/gameap/gameap v0.0.0-20260514194917-d291e6dbd609
github.com/gameap/gameap v0.0.0-20260729224522-5d77d14698ba
github.com/gameap/gameapctl v0.25.0
github.com/goccy/go-yaml v1.19.2
github.com/google/uuid v1.6.0
github.com/gopherclass/go-shellquote v0.0.0-20200814145606-fab22d094485
github.com/hashicorp/go-getter v1.8.6
github.com/klauspost/compress v1.19.1
github.com/moby/moby/api v1.54.1
github.com/moby/moby/client v0.4.0
github.com/nwaples/rardecode/v2 v2.3.0
github.com/pkg/errors v0.9.1
github.com/rs/xid v1.6.0
github.com/shirou/gopsutil/v3 v3.24.5
github.com/sirupsen/logrus v1.9.4
github.com/stretchr/testify v1.11.1
github.com/ulikunitz/xz v0.5.16
github.com/urfave/cli/v2 v2.27.7
go.uber.org/mock v0.6.0
golang.org/x/sync v0.20.0
golang.org/x/sys v0.43.0
google.golang.org/grpc v1.80.0
golang.org/x/sync v0.22.0
golang.org/x/sys v0.46.0
google.golang.org/grpc v1.82.1
google.golang.org/protobuf v1.36.11
)

Expand All @@ -36,41 +45,44 @@ require (
cloud.google.com/go/iam v1.5.3 // indirect
cloud.google.com/go/monitoring v1.24.3 // indirect
cloud.google.com/go/storage v1.61.3 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
github.com/Microsoft/go-winio v0.6.2 // indirect
github.com/aws/aws-sdk-go-v2 v1.41.4 // indirect
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.7 // indirect
github.com/andybalholm/brotli v1.2.2 // indirect
github.com/aws/aws-sdk-go-v2 v1.41.5 // indirect
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
github.com/aws/aws-sdk-go-v2/config v1.32.12 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.19.12 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.21 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.12 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.20 // indirect
github.com/aws/aws-sdk-go-v2/service/s3 v1.97.1 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect
github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 // indirect
github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 // indirect
github.com/aws/smithy-go v1.24.2 // indirect
github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
github.com/bodgit/plumbing v1.3.0 // indirect
github.com/bodgit/windows v1.0.1 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect
github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect
github.com/containerd/errdefs/pkg v0.3.0 // indirect
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/distribution/reference v0.6.0 // indirect
github.com/docker/go-connections v0.6.0 // indirect
github.com/docker/go-units v0.5.0 // indirect
github.com/dustin/go-humanize v1.0.1 // indirect
github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
github.com/envoyproxy/go-control-plane/envoy v1.37.0 // indirect
github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/go-jose/go-jose/v4 v4.1.4 // indirect
github.com/go-logr/logr v1.4.3 // indirect
Expand All @@ -82,40 +94,43 @@ require (
github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.72 // indirect
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
github.com/hashicorp/go-version v1.8.0 // indirect
github.com/klauspost/compress v1.18.5 // indirect
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
github.com/mitchellh/go-homedir v1.1.0 // indirect
github.com/moby/docker-image-spec v1.3.1 // indirect
github.com/opencontainers/go-digest v1.0.0 // indirect
github.com/opencontainers/image-spec v1.1.1 // indirect
github.com/pierrec/lz4/v4 v4.1.27 // indirect
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect
github.com/shoenig/go-m1cpu v0.1.6 // indirect
github.com/spf13/afero v1.15.0 // indirect
github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
github.com/stangelandcl/ppmd v0.1.1 // indirect
github.com/tklauser/go-sysconf v0.3.12 // indirect
github.com/tklauser/numcpus v0.6.1 // indirect
github.com/ulikunitz/xz v0.5.15 // indirect
github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
github.com/yusufpapurcu/wmi v1.2.4 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/detectors/gcp v1.39.0 // indirect
go.opentelemetry.io/contrib/detectors/gcp v1.43.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
go.opentelemetry.io/otel v1.42.0 // indirect
go.opentelemetry.io/otel/metric v1.42.0 // indirect
go.opentelemetry.io/otel/sdk v1.42.0 // indirect
go.opentelemetry.io/otel/sdk/metric v1.42.0 // indirect
go.opentelemetry.io/otel/trace v1.42.0 // indirect
golang.org/x/crypto v0.50.0 // indirect
golang.org/x/net v0.53.0 // indirect
go.opentelemetry.io/otel v1.43.0 // indirect
go.opentelemetry.io/otel/metric v1.43.0 // indirect
go.opentelemetry.io/otel/sdk v1.43.0 // indirect
go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
go.opentelemetry.io/otel/trace v1.43.0 // indirect
go4.org v0.0.0-20260112195520-a5071408f32f // indirect
golang.org/x/crypto v0.53.0 // indirect
golang.org/x/net v0.56.0 // indirect
golang.org/x/oauth2 v0.36.0 // indirect
golang.org/x/text v0.36.0 // indirect
golang.org/x/text v0.40.0 // indirect
golang.org/x/time v0.15.0 // indirect
google.golang.org/api v0.271.0 // indirect
google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
)
Loading
Loading