diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 7374736..2e43ffd 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -11,7 +11,8 @@ on: pull_request_review: types: [submitted] -permissions: read-all +permissions: + contents: read jobs: claude: @@ -46,14 +47,13 @@ jobs: actions: read # Required for Claude to read CI results on PRs steps: - name: Checkout repository - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 1 - name: Run Claude Code id: claude - # kics-scan ignore-line - uses: anthropics/claude-code-action@beta + uses: anthropics/claude-code-action@f64219702d7454cf29fe32a74104be6ed43dc637 # v1.0.34 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 56fd522..7a6d286 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -10,7 +10,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true -permissions: read-all +permissions: + contents: read jobs: lint: @@ -20,30 +21,27 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Node.js - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0 + uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 with: node-version: 24.x - name: Set up Go - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0 + uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0 with: go-version-file: go.mod cache: true cache-dependency-path: go.sum - name: Set up Python - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: "3.x" - - name: Install tools required by pre-commit - shell: bash - run: make dev-setup - - - name: Run pre-commit - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1 + - name: golangci-lint + uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0 with: - extra_args: --all-files + version: v2.7.2 + install-mode: goinstall diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml index 7248ddb..45d86c0 100644 --- a/.github/workflows/pr-lint.yml +++ b/.github/workflows/pr-lint.yml @@ -10,7 +10,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true -permissions: read-all +permissions: + contents: read jobs: Linter: @@ -26,39 +27,30 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Node.js - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0 + uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 with: node-version: 24.x - name: Set up Go - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0 + uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0 with: go-version-file: go.mod cache: true cache-dependency-path: go.sum - name: Set up Python - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: "3.x" - - name: Cache pre-commit - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1 + - name: golangci-lint + uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0 with: - path: ~/.cache/pre-commit - key: ${{ runner.os }}-precommit-${{ hashFiles('.pre-commit-config.yaml') }} - - - name: Install pre-commit requirements - run: | - go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest - - - name: Run pre-commit - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1 - with: - extra_args: --all-files + version: v2.7.2 + install-mode: goinstall - name: Run integration tests and collect coverage run: | @@ -74,4 +66,4 @@ jobs: - name: Run PR Lint # Custom PR linting action that performs additional PR-specific checks # https://github.com/ivuorinen/actions - uses: ivuorinen/actions/pr-lint@5cc7373a22402ee8985376bc713f00e09b5b2edb # v2025.11.23 + uses: ivuorinen/actions/pr-lint@f98ae7cd7d0feb1f9d6b01de0addbb11414cfc73 # v2026.01.21 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 01c2abf..d9ad608 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,12 +18,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 # Required for changelog generation - name: Set up Go - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0 + uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0 with: go-version-file: go.mod cache: true diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 82a5f51..ea96501 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -23,4 +23,4 @@ jobs: issues: write pull-requests: write steps: - - uses: ivuorinen/actions/stale@5cc7373a22402ee8985376bc713f00e09b5b2edb # v2025.11.23 + - uses: ivuorinen/actions/stale@f98ae7cd7d0feb1f9d6b01de0addbb11414cfc73 # v2026.01.21 diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index 8e0c608..a93e84b 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -13,12 +13,14 @@ on: workflow_call: workflow_dispatch: -permissions: read-all +permissions: + contents: read jobs: sync-labels: runs-on: ubuntu-latest permissions: + contents: read issues: write steps: - - uses: ivuorinen/actions/sync-labels@5cc7373a22402ee8985376bc713f00e09b5b2edb # v2025.11.23 + - uses: ivuorinen/actions/sync-labels@f98ae7cd7d0feb1f9d6b01de0addbb11414cfc73 # v2026.01.21 diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index bbc3373..0c6c69e 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -21,10 +21,14 @@ repos: hooks: - id: sync-pre-commit-deps - - repo: https://github.com/dnephin/pre-commit-golang - rev: v0.5.1 + - repo: local hooks: - id: golangci-lint + name: golangci-lint + entry: golangci-lint run + language: system + types: [go] + pass_filenames: false - repo: https://github.com/google/yamlfmt rev: v0.20.0 @@ -32,7 +36,7 @@ repos: - id: yamlfmt - repo: https://github.com/igorshubovych/markdownlint-cli - rev: v0.45.0 + rev: v0.47.0 hooks: - id: markdownlint args: [-c, .markdownlint.json, --fix] diff --git a/Makefile b/Makefile index af33bb0..8cce56a 100644 --- a/Makefile +++ b/Makefile @@ -30,8 +30,13 @@ dev-deps: ## Install development dependencies @echo "Installing goreleaser..." @go install github.com/goreleaser/goreleaser/v2@v2.12.0; # renovate: datasource=go depName=github.com/goreleaser/goreleaser/v2 - @echo "Installing golangci-lint..."; - @go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.4.0; + @GOLANGCI_VERSION=$$(golangci-lint version 2>/dev/null \ + | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || echo "0.0.0"); \ + EXPECTED_VERSION="2.7.2"; \ + if [ "$$GOLANGCI_VERSION" != "$$EXPECTED_VERSION" ]; then \ + echo "Installing golangci-lint v$$EXPECTED_VERSION (current: v$$GOLANGCI_VERSION)..."; \ + go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v$$EXPECTED_VERSION; \ + fi # renovate: datasource=go depName=github.com/golangci/golangci-lint/v2/cmd/golangci-lint @command -v markdownlint-cli2 >/dev/null 2>&1 || { \ echo "Installing markdownlint-cli2..."; \ diff --git a/docs/api.md b/docs/api.md index 741e9bf..696fb62 100644 --- a/docs/api.md +++ b/docs/api.md @@ -240,7 +240,7 @@ const ( The configuration system supports the following environment variables: | Variable | Description | Default | -|----------|-------------|---------| +| -------- | ----------- | ------- | | `F2B_LOG_DIR` | Log directory path | `/var/log` | | `F2B_FILTER_DIR` | Filter directory path | `/etc/fail2ban/filter.d` | | `F2B_LOG_LEVEL` | Log level | `info` | diff --git a/shared/constants.go b/shared/constants.go index aa8e246..0ad4314 100644 --- a/shared/constants.go +++ b/shared/constants.go @@ -1,5 +1,7 @@ // Package shared provides constants used across all packages in the f2b project. // This file consolidates all constants to ensure consistency and maintainability. +// +//nolint:revive // Package name 'shared' is intentional for project-wide constants package shared import "time"