unkin-agent
df07085ecb
The initial scaffold left three holes the review caught. CI only checked gofmt and go vet, so golangci-lint and the pre-commit hooks were advisory rather than enforced. The HTTP server bounded only the header read, so a slow or stalled peer could hold a connection indefinitely. And the browser got no content-security policy at all, leaving the SPA's same-origin assumption unenforced. Add golangci-lint and pre-commit hook steps to the existing pre-commit workflow, mirroring the estate's images so the required context name stays ci/woodpecker/pr/pre-commit. Bound the server with ReadTimeout, WriteTimeout, and IdleTimeout, keeping the write budget generous enough for the poster proxy's streamed responses. Stamp Content-Security-Policy, X-Content-Type-Options, and Referrer-Policy onto every response from a single middleware wrapping the root handler. Assert the headers across the API, UI, assets, probes, and rejections. Guard the CSP's no-unsafe-inline assumption with a ui test that fails if a shipped asset grows an inline script, style block, or event handler. Extend the make pre-commit target to match the widened CI checks.
50 lines
1.0 KiB
YAML
50 lines
1.0 KiB
YAML
when:
|
|
- event: pull_request
|
|
|
|
steps:
|
|
- name: pre-commit
|
|
image: golang:1.25
|
|
commands:
|
|
- test -z "$(gofmt -l .)"
|
|
- go vet ./...
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: mediamark-ci
|
|
resources:
|
|
requests:
|
|
memory: 512Mi
|
|
cpu: 1
|
|
limits:
|
|
memory: 2Gi
|
|
cpu: 2
|
|
|
|
- name: lint
|
|
image: golangci/golangci-lint:latest
|
|
commands:
|
|
- golangci-lint run ./...
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: mediamark-ci
|
|
resources:
|
|
requests:
|
|
memory: 512Mi
|
|
cpu: 1
|
|
limits:
|
|
memory: 2Gi
|
|
cpu: 2
|
|
|
|
- name: hooks
|
|
image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
|
|
commands:
|
|
- uvx pre-commit run --all-files
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: mediamark-ci
|
|
resources:
|
|
requests:
|
|
memory: 512Mi
|
|
cpu: 1
|
|
limits:
|
|
memory: 2Gi
|
|
cpu: 2
|