Publishes an additional floating vX.Y tag alongside the immutable vX.Y.Z
so `docker pull ...:vX.Y` fetches the newest patch. Skipped on --rebuild
of an older version so the float never rolls backward. Deploys still pin
vX.Y.Z; the cleanup reaper only targets three-part semver, so the float
is never eligible for deletion.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Addresses errcheck, gosec, revive, staticcheck, and unused findings
across the codebase (unchecked error returns, unsafe file inclusion
warnings on operator/test-controlled paths, missing package comments,
unused parameters, deprecated API usage). Also fixes two suppression
comments that were silently no-ops due to wrong syntax (#nosec needs
a leading '#', nolint reasons need '//' not '--').
With the backlog clear, drop continue-on-error from the CI lint job
per the plan left in b4b4806.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The official install.sh tarball download hit sha256 checksum mismatches
on the self-hosted runner; the module proxy path is verifiable and
reproducible.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
actions/checkout and actions/setup-go are JavaScript actions and fail on
the runner's node-less job containers (Cannot find: node in PATH). All
jobs now run plain shell steps in a golang:1.25-alpine container: fetch
by sha, apk deps, pinned protoc plugins, then lint/test/govulncheck.
The generate-proto composite action is inlined and removed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Push to main mints the next vX.Y.Z patch tag, builds and pushes a
multi-arch image to the registry, and tags the repo. A manual
bump-version workflow handles minor/major bumps.
This workflow deliberately holds no deployment-repo credentials: the
repo is public, so the GitOps side polls the registry and pulls new
tags itself rather than being pushed to from here.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- .gitea/workflows/ci.yml: lint, race tests (e2e excluded), and
govulncheck on push to main and PRs; shared composite action installs
protoc + pinned protoc-gen-go/protoc-gen-go-grpc and generates the
(gitignored) protobuf code before each Go job.
- .golangci.yml (v2 schema): govet, staticcheck, errcheck, ineffassign,
unused, misspell, gosec, revive; generated api/grpc/pb excluded.
- Makefile: vuln target (govulncheck) added and chained into qa.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
igodwin