mirror of
https://github.com/tiennm99/miti99bot.git
synced 2026-09-12 20:18:33 +00:00
tiennm99
939c5fedab
Phase 1+2 of the 2026-05-09 review remediation plan: - Go-version alignment (Dockerfile/go.mod) + 4 nil-deref guards + CI docker-build step (Phase 1, 63482c4 carried over). - Env allowlist: secretEnvKeys denylist replaced; modules opt-in via RequiredEnv. Future API keys do not auto-leak. - Visibility enforcement: dispatcher gates Private/Protected commands via BOT_OWNER_ID / ADMIN_USER_IDS; non-permitted callers are silently denied. - Panic recovery in webhook handler; logs runtime/debug.Stack and returns 200 to prevent Telegram retry storm. - Cron timeout reduced 5m -> 60s. - MaxBytesError handled separately from generic decode errors so 413 from MaxBytesReader is not shadowed by a 400. - Emoji clue HTML-escaped defensively in loldle-emoji renderer. - Tests added for dispatcher Auth.Permits + webhook panic recovery.
37 lines
592 B
YAML
37 lines
592 B
YAML
name: ci
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
go:
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix:
|
|
go: ['1.25']
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: ${{ matrix.go }}
|
|
cache: true
|
|
|
|
- name: go vet
|
|
run: go vet ./...
|
|
|
|
- name: go test
|
|
run: go test -race -count=1 ./...
|
|
|
|
- name: go build
|
|
run: go build ./...
|
|
|
|
- name: docker build
|
|
run: docker build -t miti99bot-go .
|