go-pkgz / auth / 32195418166

86%

push

github

ci: go 1.26, golangci-lint v2.12, address new gosec findings (#300)

* ci: update to go 1.26 and golangci-lint v2.12.2, lint action to v9

* lint: address gosec findings introduced by golangci-lint v2.12

- set image/png content type on generated avatar endpoints
- suppress false positives with reasons: config-driven cookie attrs,
  oauth endpoint urls flagged as credentials, fixed-host apple redirect,
  store-generated avatar paths
- exclude gosec in test files via config

* chore: apply gofmt to avatar tests

* ci: address review findings

- mirror apple redirect nolint to v2 to keep modules in sync
- set explicit branches/tags match-all on push triggers, actionlint
  flags the empty form
- use --config= form for golangci-lint-action v9 args

* ci: update checkout to v7 and codeql-action to v4, quote GITHUB_WORKSPACE

* Update pinned lint versions in AGENTS.md

CI now runs golangci-lint-action v9 with golangci-lint v2.12.2, so the
documented local reproducer no longer matched what CI enforces.

12 of 13 new or added lines in 6 files covered. (92.31%)

3111 of 3629 relevant lines covered (85.73%)

8.64 hits per line