mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
J3vbandClaude Fable 5
6afa9e974c
Fixes all 109 golangci-lint findings (106 contextcheck, 1 gocritic,
2 gosec) that accumulated after D2 wired dbgen (whose queries take ctx)
under ctx-less db.DB wrappers while CI lint was quota-dead. No nolint
comments added; every finding fixed by genuinely threading context.
- db: all 138 hand-written db.DB methods take ctx first; the dbCtx()
Background shim is deleted; raw Query/QueryRow/Exec/Begin use their
Context variants; the four redundant ctx-less passthroughs removed.
db.Auditor/WriteAudit gain ctx.
- Seams: permissions.Checker (DB iface, HasChannelPerm,
RequireChannelAccess) and the service.Store interface mirror the new
signatures (ws.EventStore and plugin.PluginStore already did).
- Callers: api/admin handlers use r.Context(); ws per-message paths use
the connection ctx via DispatchV2; hub loops and startup wiring use
context.Background(); service methods thread ctx where they have one
and Background where no ctx exists. Public service surface reached by
ctx-holding chains (PermissionService.HasChannelPerm/GetRoleForUser/
RequireChannelAccess, message/dm/block/invite/profile methods) is now
ctx-first.
- Detached (context.WithoutCancel) where cancellation would break an
invariant, found by a 3-lens adversarial review of the diff:
* voice-leave background retries (a dead webhook/connection ctx killed
retry 2 before it ran, leaving ghost capacity-holding voice rows)
* rollbackVoiceJoin's compensating delete (its trigger IS the cancel)
* post-2FA-change DeleteOtherSessions and logout DeleteSession (the
security tail of a committed change must not die with the request)
* all api/ws audit writes (a banned user could suppress their own
login_blocked_banned row by aborting the request mid-bcrypt)
* admin backup VACUUM INTO (an interrupt left a truncated .db that
the backup list presented as restorable)
* post-commit message/edit refetches (a committed message must still
fan out when the sender disconnects)
* hub settings-cache refresh (one dead connection could pin stale
values for the 30s TTL)
- gocritic rangeValCopy fixed (index iteration); gosec G306 excluded in
config with justification (generated source must stay world-readable)
instead of flipping genprotocol output to 0o600.
Verified: gofmt/vet, all four build-tag variants, full suite, deadlock
pass, full -race pass, golangci-lint 0 issues uncapped.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
44 lines
1.7 KiB
YAML
44 lines
1.7 KiB
YAML
version: "2"
|
|
|
|
linters:
|
|
enable:
|
|
- gocritic # opinionated checks for bugs, performance, style
|
|
- gosec # security-focused static analysis (SQL injection, hardcoded creds, weak crypto)
|
|
- errcheck # ensures all errors are checked
|
|
- bodyclose # detects unclosed HTTP response bodies
|
|
- contextcheck # verifies context.Context propagation
|
|
- nilerr # detects returning nil when err is not nil
|
|
- prealloc # suggests pre-allocating slices for performance
|
|
- unconvert # removes unnecessary type conversions
|
|
- unparam # finds unused function parameters
|
|
- wastedassign # finds wasted assignments
|
|
- staticcheck # advanced static analysis (correctness, performance, deprecation)
|
|
|
|
settings:
|
|
staticcheck:
|
|
checks:
|
|
- "all"
|
|
- "-SA1019" # suppress deprecated usage warnings (websocket library migration tracked separately)
|
|
gocritic:
|
|
enabled-tags:
|
|
- diagnostic
|
|
- performance
|
|
disabled-checks:
|
|
- hugeParam # too noisy for struct-heavy code
|
|
gosec:
|
|
excludes:
|
|
- G104 # unhandled errors — errcheck covers this better
|
|
- G304 # file path from variable — expected in file storage code
|
|
- G306 # WriteFile perms ≤0600 — our only hits are generated source files (genprotocol), which must stay world-readable or multi-stage container builds break
|
|
- G706 # log injection — false positive with slog structured logging (values are typed key-value pairs, not interpolated)
|
|
|
|
exclusions:
|
|
# Suppress noisy linters in test files
|
|
rules:
|
|
- linters: [unparam]
|
|
path: _test\.go
|
|
- linters: [gosec]
|
|
path: _test\.go
|
|
- linters: [errcheck]
|
|
path: _test\.go
|