David Gageot 93986be23d ci: broaden gosec coverage with targeted exclusions and inline silences ...

Switch gosec from a file-permission allowlist to a broader run that excludes
the systematically noisy rule families and silences the remaining legitimate
exceptions inline.

Excluded rule families (rationale in .golangci.yml):

- G101 (hardcoded credentials): false-positives on tool-name constants and
  shipped public client telemetry keys; secretsscan covers real cases.
- G104 (errors unhandled): errcheck is already enabled and matches the
  patterns we care about; gosec flags many legitimate Close-on-error-path
  callsites.
- G204 (subprocess with variable): docker-agent intentionally launches
  user-configured commands (LSP servers, hooks, agents, editors).
- G304 (file inclusion via variable): paths come from CLI flags, validated
  config, and tempdirs throughout the codebase.
- G404 (weak RNG): math/rand is used for jitter, model selection, and
  spinner animations — never for security.
- G602 (slice bounds): false-positive on dynamically-validated indices.
- G702/G703/G704 (taint analysis): paths, URLs, and commands are derived
  from validated config or user-set environment.

Real fixes uncovered by the broader run:

- pkg/mcp/server.go, pkg/server/server.go: add ReadHeaderTimeout to harden
  against Slowloris (G112).
- pkg/tui/tui.go: explicitly discard ignored Close/Remove return values via
  '_ =' (G104) — better Go style and self-documents the intent.

Inline //nolint:gosec with one-line reasons for the rules we keep enabled:

- G115 (int overflow conversions): bounded values from validated YAML
  schemas and model API constraints — frozen pre-latest config versions
  and the model providers' MaxTokens / ThinkingBudget.
- G117 (JSON 'access_token' marshaling): intentional in OAuth token storage
  and the debug command that prints (truncated) tokens.
- G118 (goroutine context detached): three deliberate fire-and-forget
  patterns — telemetry events, OTel SDK shutdown, and post-request
  StreamStoppedEvent forwarding.
- G201/G202 (SQL formatting/concatenation): rag/strategy queries embed
  internal table names; values are always bound parameters.
- G203 (template HTML auto-escape): pkg/app/export/html.go renders content
  that has already been escaped by sub-templates or is a constant SVG/CSS
  asset embedded at build time.

2026-05-09 15:41:56 +02:00

..

sqlite

ci: broaden gosec coverage with targeted exclusions and inline silences

2026-05-09 15:41:56 +02:00

database.go

Fix lint issues: paramTypeCombine, importShadow, gofumpt, testifylint

2026-03-06 15:45:34 +00:00