Merge pull request #70 from paskal/ci/workflow-hardening

ci: harden workflows, upgrade actions, fix caching

Author: umputun

.github/workflows/ci.yml

@@ -6,15 +6,23 @@ on:
     tags:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
 
     steps:
+      - name: checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
       - name: set up go
         uses: actions/setup-go@v6
         with:
-          cache-dependency-path: backend/
+          cache-dependency-path: backend
           go-version: "1.25"
         id: go
 
@@ -23,9 +31,6 @@ jobs:
         with:
           mongoDBVersion: "5.0"
 
-      - name: checkout
-        uses: actions/checkout@v6
-
       - name: build and test
         working-directory: backend
         run: |
@@ -38,7 +43,7 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
-          version: latest
+          version: "latest"
           working-directory: backend
 
       - name: submit coverage
@@ -50,11 +55,11 @@ jobs:
           COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
 
       - name: set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: available platforms
         run: echo ${{ steps.buildx.outputs.platforms }}

backend/.golangci.yml

@@ -21,7 +21,6 @@ linters:
     - misspell
     - nakedret
     - nolintlint
-    - prealloc
     - revive
     - rowserrcheck
     - staticcheck
@@ -34,6 +33,10 @@ linters:
     goconst:
       min-len: 2
       min-occurrences: 2
+    gosec:
+      excludes:
+        - G118
+        - G120
     revive:
       enable-all-rules: true
       rules:
@@ -51,6 +54,8 @@ linters:
           disabled: true
         - name: nested-structs
           disabled: true
+        - name: use-slices-sort
+          disabled: true
     gocritic:
       disabled-checks:
         - hugeParam