feat(mcp): mask credentials by default, add file handoff #12
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| go: ["1.22", "1.23", "1.24"] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ matrix.go }} | |
| cache: true | |
| - run: go vet ./... | |
| - run: go build ./... | |
| - run: go test -race -count=1 ./... | |
| lint: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # Lint each target so build-tagged files (cookie_darwin.go, | |
| # cookie_linux.go, cookie_windows.go, dpapi_windows.go) are all | |
| # exercised. golangci-lint only sees files that match the build | |
| # constraints of the current GOOS. | |
| goos: [linux, darwin, windows] | |
| runs-on: ubuntu-latest | |
| env: | |
| GOOS: ${{ matrix.goos }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: stable | |
| cache: true | |
| - uses: golangci/golangci-lint-action@v7 | |
| with: | |
| version: v2.11.3 | |
| vuln: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| # govulncheck uses the toolchain's stdlib version when scanning; | |
| # pin to the latest patched Go so stdlib vulns (net, net/url, | |
| # database/sql, etc.) don't false-fail on dependency-reachable code. | |
| go-version: stable | |
| cache: true | |
| - name: govulncheck | |
| run: | | |
| go install golang.org/x/vuln/cmd/govulncheck@latest | |
| govulncheck ./... | |
| gosec: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: gosec | |
| uses: securego/gosec@master | |
| with: | |
| # G505 (crypto/sha1): Chromium's PBKDF2 mandates SHA-1; this is | |
| # interop, not our crypto choice. The decrypt path uses a fixed | |
| # IV (G407) by Chromium specification; the encrypt-with-fixed-IV | |
| # helper lives only in _test.go and gosec doesn't scan tests. | |
| args: -exclude=G505 ./... |