CI: gofmt/lint/tidy/vulncheck gates, enable -race

.github/workflows/ci.yml

@@ -5,6 +5,13 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   check:
     runs-on: ubuntu-latest
@@ -15,8 +22,50 @@ jobs:
         with:
           go-version-file: go.mod
 
+      - name: Gofmt
+        run: |
+          fmt_out="$(gofmt -l .)"
+          if [ -n "$fmt_out" ]; then
+            echo "The following files are not gofmt'd:"
+            echo "$fmt_out"
+            exit 1
+          fi
+
+      - name: Build
+        run: go build ./...
+
       - name: Vet
         run: go vet ./...
 
+      - name: Tidy
+        run: |
+          go mod tidy
+          git diff --exit-code go.mod go.sum
+
       - name: Test
         run: go test -short -race ./...
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.13
+
+  vulncheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: govulncheck
+        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...

cli/blossom/coverage_gaps_test.go

@@ -198,7 +198,7 @@ func TestBlossomMirror_SucceededTransferButInvalidResponse(t *testing.T) {
 		t.Run(hook, func(t *testing.T) {
 			r := newRunner(t)
 			source := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-				w.Write([]byte("mirror source content"))
+				_, _ = w.Write([]byte("mirror source content"))
 			}))
 			defer source.Close()
 
@@ -234,7 +234,7 @@ func TestBlossomMirror_MultiServerFanOut(t *testing.T) {
 	}
 	r := newRunner(t)
 	source := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		w.Write([]byte("fan out mirror content"))
+		_, _ = w.Write([]byte("fan out mirror content"))
 	}))
 	defer source.Close()
 

cli/blossom/download.go

@@ -71,7 +71,7 @@ omitted, or streams to stdout with "-o -" (suppressing the summary line).`,
 			if err != nil {
 				return classifyHTTPError(cmd, hash, err)
 			}
-			defer resp.Body.Close()
+			defer func() { _ = resp.Body.Close() }()
 
 			outPath, _ := cmd.Flags().GetString("output")
 			toStdout := outPath == "-"
@@ -90,7 +90,7 @@ omitted, or streams to stdout with "-o -" (suppressing the summary line).`,
 				if err != nil {
 					return common.RuntimeError(cmd, err)
 				}
-				defer f.Close()
+				defer func() { _ = f.Close() }()
 				out = f
 				createdPath = outPath
 			}
@@ -100,7 +100,7 @@ omitted, or streams to stdout with "-o -" (suppressing the summary line).`,
 				if createdPath != "" {
 					// Best-effort cleanup: don't leave a truncated,
 					// corrupt-looking file behind after a failed transfer.
-					os.Remove(createdPath)
+					_ = os.Remove(createdPath)
 				}
 				return common.NetworkError(cmd, usedServer, err)
 			}

cli/blossom/fakeserver_test.go

@@ -144,7 +144,7 @@ func newFakeBlossomServer() *fakeBlossomServer {
 	// same goroutine, which the Go memory model does guarantee orders
 	// correctly relative to the spawned goroutine.
 	s.Server = httptest.NewUnstartedServer(mux)
-	s.Server.Start()
+	s.Start()
 	return s
 }
 
@@ -261,7 +261,7 @@ func (s *fakeBlossomServer) handleMirror(w http.ResponseWriter, r *http.Request)
 		nipB7.WriteError(w, http.StatusBadGateway, err.Error())
 		return
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 	data, err := io.ReadAll(resp.Body)
 	if err != nil {
 		nipB7.WriteError(w, http.StatusBadGateway, err.Error())
@@ -277,7 +277,7 @@ func (s *fakeBlossomServer) handleMirror(w http.ResponseWriter, r *http.Request)
 
 func (s *fakeBlossomServer) writeDescriptor(w http.ResponseWriter, hash string, size int64, contentType string, hooks fakeServerHooks) {
 	if hooks.MalformedResponseBody {
-		w.Write([]byte("not json"))
+		_, _ = w.Write([]byte("not json"))
 		return
 	}
 	d := nipB7.BlobDescriptor{
@@ -290,7 +290,7 @@ func (s *fakeBlossomServer) writeDescriptor(w http.ResponseWriter, hash string,
 	if hooks.InvalidDescriptor {
 		d.URL = "" // fails BlobDescriptor.Validate() despite a 2xx transfer
 	}
-	json.NewEncoder(w).Encode(d)
+	_ = json.NewEncoder(w).Encode(d)
 }
 
 func (s *fakeBlossomServer) handleReport(w http.ResponseWriter, r *http.Request) {
@@ -354,7 +354,7 @@ func (s *fakeBlossomServer) handleList(w http.ResponseWriter, r *http.Request) {
 	s.mu.Unlock()
 
 	nipB7.SortDescending(descriptors)
-	json.NewEncoder(w).Encode(descriptors)
+	_ = json.NewEncoder(w).Encode(descriptors)
 }
 
 func (s *fakeBlossomServer) handleBlob(w http.ResponseWriter, r *http.Request) {
@@ -393,7 +393,7 @@ func (s *fakeBlossomServer) handleBlob(w http.ResponseWriter, r *http.Request) {
 			w.WriteHeader(http.StatusOK)
 			return
 		}
-		w.Write(b.data)
+		_, _ = w.Write(b.data)
 
 	case http.MethodDelete:
 		// BUD-11: delete tokens "should be scoped to exactly this hash" --

cli/blossom/list.go

@@ -104,11 +104,11 @@ resolved pubkey when omitted.`,
 				return nil
 			}
 			w := tabwriter.NewWriter(os.Stdout, 0, 4, 2, ' ', 0)
-			fmt.Fprintln(w, "HASH\tSIZE\tTYPE\tUPLOADED\tURL")
+			_, _ = fmt.Fprintln(w, "HASH\tSIZE\tTYPE\tUPLOADED\tURL")
 			for _, d := range descriptors {
-				fmt.Fprintf(w, "%s\t%d\t%s\t%s\t%s\n", d.Sha256, d.Size, d.Type, time.Unix(d.Uploaded, 0).Format(time.RFC3339), d.URL)
+				_, _ = fmt.Fprintf(w, "%s\t%d\t%s\t%s\t%s\n", d.Sha256, d.Size, d.Type, time.Unix(d.Uploaded, 0).Format(time.RFC3339), d.URL)
 			}
-			w.Flush()
+			_ = w.Flush()
 			return nil
 		},
 	}

cli/blossom/report.go

@@ -78,9 +78,9 @@ server: --server, or the first configured default.`,
 	}
 
 	cmd.Flags().String("type", "", `Report type (e.g. "nudity", "malware", "illegal", "spam") (required)`)
-	cmd.MarkFlagRequired("type")
+	_ = cmd.MarkFlagRequired("type")
 	cmd.Flags().String("reason", "", "Human-readable reason (required)")
-	cmd.MarkFlagRequired("reason")
+	_ = cmd.MarkFlagRequired("reason")
 
 	return cmd
 }

cli/blossom/servers_publish_test.go

@@ -43,7 +43,7 @@ func mockRelayServer(t *testing.T) (wsURL string) {
 		if err != nil {
 			return
 		}
-		defer conn.Close()
+		defer func() { _ = conn.Close() }()
 
 		for {
 			_, msg, err := conn.ReadMessage()

cli/blossom/shared_test.go

@@ -25,7 +25,7 @@ func captureStdout(t *testing.T, fn func()) string {
 	}
 	os.Stdout = w
 	fn()
-	w.Close()
+	_ = w.Close()
 	os.Stdout = orig
 	out, err := io.ReadAll(r)
 	if err != nil {

cli/blossom/upload.go

@@ -122,7 +122,7 @@ func uploadOne(ctx context.Context, hc *bclient.Client, server, path, contentTyp
 		res.Error = err.Error()
 		return res
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 
 	info, err := f.Stat()
 	if err != nil {
@@ -161,7 +161,7 @@ func detectContentType(path string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 
 	buf := make([]byte, 512)
 	n, err := f.Read(buf)

cli/bunker/board.go

@@ -108,7 +108,7 @@ func (t *PendingTable) Init(ctx context.Context) *PendingTable {
 	t.table.SetFixed(1, 0).
 		SetSelectable(true, false)
 
-	tui.WireFocusBorder(t.table, t.Flex.Box)
+	tui.WireFocusBorder(t.table, t.Box)
 
 	t.table.SetSelectedStyle(tcell.Style{}.
 		Background(tui.ColorPrimary).
@@ -268,7 +268,7 @@ func (t *PendingTable) showBunkerURI() {
 	// Pending Requests. Polling for it here instead answers "did that just
 	// work, or do I need a new link?" without leaving the dialog.
 	waiting := tview.NewTextView().SetDynamicColors(true)
-	fmt.Fprint(waiting, formatWaitingStatus(deadline))
+	_, _ = fmt.Fprint(waiting, formatWaitingStatus(deadline))
 
 	status := tview.NewTextView().SetDynamicColors(true)
 
@@ -401,7 +401,7 @@ func (t *PendingTable) watchForPairing(ctx context.Context, stop <-chan struct{}
 			status := formatWaitingStatus(deadline)
 			t.app.QueueUpdateDraw(func() {
 				waiting.Clear()
-				fmt.Fprint(waiting, status)
+				_, _ = fmt.Fprint(waiting, status)
 			})
 			if time.Now().After(deadline) {
 				return
@@ -776,7 +776,7 @@ func (t *PendingTable) updateActionsBar() {
 
 	autoColor, autoText := tui.StatusText(auto)
 	t.actions.Clear()
-	fmt.Fprintf(t.actions, "[%s::b]Auto-Prompt:[%s]%s", tui.ColorPrimary, autoColor, autoText)
+	_, _ = fmt.Fprintf(t.actions, "[%s::b]Auto-Prompt:[%s]%s", tui.ColorPrimary, autoColor, autoText)
 }
 
 // appLabel resolves pubkey to labelFor(session) against the cache
@@ -1042,7 +1042,7 @@ func (t *PendingTable) openSignEventApprovalDialog(p Pending, title, text string
 		SetWordWrap(true).
 		SetScrollable(true)
 	jsonView.SetBorderPadding(0, 0, 0, 0)
-	fmt.Fprint(jsonView, tui.ColorizeEventJSON(p.Event))
+	_, _ = fmt.Fprint(jsonView, tui.ColorizeEventJSON(p.Event))
 	jsonView.ScrollToBeginning()
 
 	form := tview.NewForm().
@@ -1073,7 +1073,7 @@ func (t *PendingTable) openSignEventApprovalDialog(p Pending, title, text string
 	wireScrollCapture(form, jsonView)
 
 	header := tview.NewTextView().SetDynamicColors(true)
-	fmt.Fprintf(header, "[::b]%s[-:-:-]\n%s", tview.Escape(title), tview.Escape(text))
+	_, _ = fmt.Fprintf(header, "[::b]%s[-:-:-]\n%s", tview.Escape(title), tview.Escape(text))
 
 	view := tview.NewFlex().SetDirection(tview.FlexRow).
 		AddItem(header, 2, 0, false).
@@ -1208,7 +1208,7 @@ func (t *SessionsTable) Init(ctx context.Context) *SessionsTable {
 		SetBorder(true).
 		SetBorderPadding(0, 1, 1, 1)
 
-	tui.WireFocusBorder(t.Table, t.Table.Box)
+	tui.WireFocusBorder(t.Table, t.Box)
 
 	t.SetSelectedStyle(tcell.Style{}.
 		Background(tui.ColorPrimary).
@@ -1381,7 +1381,7 @@ func (t *SessionsTable) openGrantsOverlay(s Session) {
 	}
 
 	hint := tview.NewTextView().SetDynamicColors(true).SetTextAlign(tview.AlignCenter)
-	fmt.Fprint(hint, strings.Join([]string{
+	_, _ = fmt.Fprint(hint, strings.Join([]string{
 		hintTag("<x>", "Revoke"),
 		hintTag("<e>", "Extend"),
 		hintTag("<Esc>", "Close"),
@@ -1657,7 +1657,7 @@ func (t *HistoryTable) Init(ctx context.Context) *HistoryTable {
 		SetBorder(true).
 		SetBorderPadding(0, 1, 1, 1)
 
-	tui.WireFocusBorder(t.Table, t.Table.Box)
+	tui.WireFocusBorder(t.Table, t.Box)
 
 	t.SetSelectedStyle(tcell.Style{}.
 		Background(tui.ColorPrimary).
@@ -1837,7 +1837,7 @@ func (t *HistoryTable) showEventDetail(h HistoryEntry) {
 		SetWordWrap(true).
 		SetScrollable(true)
 	jsonView.SetBorderPadding(0, 0, 0, 0)
-	fmt.Fprint(jsonView, tui.ColorizeEventJSON(h.Event))
+	_, _ = fmt.Fprint(jsonView, tui.ColorizeEventJSON(h.Event))
 	jsonView.ScrollToBeginning()
 
 	form := tview.NewForm().
@@ -2208,8 +2208,8 @@ func (b *IdentityBar) Update() {
 		return
 	}
 	b.Clear()
-	fmt.Fprintf(b, " [%s::b]Signing as:[-:-:-] %s\n", tui.ColorPrimary, formatIdentity(st))
-	fmt.Fprintf(b, " [%s::b]Relays:[-:-:-] %s", tui.ColorPrimary, formatRelayStatuses(st.RelayStatuses))
+	_, _ = fmt.Fprintf(b, " [%s::b]Signing as:[-:-:-] %s\n", tui.ColorPrimary, formatIdentity(st))
+	_, _ = fmt.Fprintf(b, " [%s::b]Relays:[-:-:-] %s", tui.ColorPrimary, formatRelayStatuses(st.RelayStatuses))
 }
 
 func (b *IdentityBar) render(ctx context.Context) {
@@ -2346,7 +2346,7 @@ func (b *AlertBar) Update() {
 	active := !anyRelayConnected(st.RelayStatuses) && !anyRelayConnecting(st.RelayStatuses)
 	b.Clear()
 	if active {
-		fmt.Fprintf(b, "[%s::b] ⚠ No relay connected -- signer can't receive requests. Check your network or relay config.[-:-:-]", tui.ColorDanger)
+		_, _ = fmt.Fprintf(b, "[%s::b] ⚠ No relay connected -- signer can't receive requests. Check your network or relay config.[-:-:-]", tui.ColorDanger)
 	}
 	if b.onAlert != nil {
 		b.onAlert(active)
@@ -2653,7 +2653,7 @@ func NewBunkerBoard(app *tui.App, ctx context.Context, client BunkerClient, flow
 	// startup or afterward, no matter how many apps end up trusted over a
 	// long-running board.
 	b.sessions.onCountChange = func(n int) {
-		b.Flex.ResizeItem(b.sessions, sessionsHeightFor(n), 0)
+		b.ResizeItem(b.sessions, sessionsHeightFor(n), 0)
 	}
 	b.sessions.Init(ctx)
 
@@ -2668,7 +2668,7 @@ func NewBunkerBoard(app *tui.App, ctx context.Context, client BunkerClient, flow
 		if active {
 			height = alertBarHeight
 		}
-		b.Flex.ResizeItem(b.alert, height, 0)
+		b.ResizeItem(b.alert, height, 0)
 	}
 	b.alert.Init(ctx)