From 7b4c790d0517c400189cdc123b09bfc4532eb3fd Mon Sep 17 00:00:00 2001
From: cotta-dev <kobatatsu0514@gmail.com>
Date: Fri, 3 Apr 2026 00:17:07 +0900
Subject: [PATCH 1/3] chore: add gosec linter and CodeQL workflow for security
 scanning

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/codeql.yml | 22 ++++++++++++++++++++++
 .golangci.yml                | 15 +++++++++++++++
 2 files changed, 37 insertions(+)
 create mode 100644 .github/workflows/codeql.yml
 create mode 100644 .golangci.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..893a48a
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,22 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 3 * * 1'  # weekly Monday 03:00 UTC
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - uses: actions/checkout@v6
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: go
+      - uses: github/codeql-action/autobuild@v3
+      - uses: github/codeql-action/analyze@v3
diff --git a/.golangci.yml b/.golangci.yml
new file mode 100644
index 0000000..9a43eaf
--- /dev/null
+++ b/.golangci.yml
@@ -0,0 +1,15 @@
+linters:
+  enable:
+    - errcheck
+    - staticcheck
+    - gosec      # Security vulnerability scanner
+    - gosimple
+    - govet
+
+linters-settings:
+  gosec:
+    excludes:
+      # G204: subprocess launched with variable — intentional (ssh command)
+      - G204
+      # G306: file permission 0644 for config — acceptable
+      - G306

From 1df7bc3c4fac624329db86a1c2bd2143cbca6c7a Mon Sep 17 00:00:00 2001
From: cotta-dev <kobatatsu0514@gmail.com>
Date: Fri, 3 Apr 2026 00:22:45 +0900
Subject: [PATCH 2/3] fix: update golangci-lint config for v2 format and
 suppress intentional gosec findings

---
 .golangci.yml | 32 ++++++++++++++++++++++----------
 1 file changed, 22 insertions(+), 10 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index 9a43eaf..6135e35 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,15 +1,27 @@
+version: "2"
+
 linters:
   enable:
     - errcheck
     - staticcheck
-    - gosec      # Security vulnerability scanner
-    - gosimple
+    - gosec
     - govet
-
-linters-settings:
-  gosec:
-    excludes:
-      # G204: subprocess launched with variable — intentional (ssh command)
-      - G204
-      # G306: file permission 0644 for config — acceptable
-      - G306
+  settings:
+    gosec:
+      excludes:
+        # G204: subprocess via variable — intentional (ssh, shell commands)
+        - G204
+        # G301: dir permission 0755 — acceptable for user config dirs (~/.config/retri)
+        - G301
+        # G304: file inclusion via variable — intentional (user-specified config/log paths)
+        - G304
+        # G306: file permission 0644 — acceptable for config files
+        - G306
+        # G107: HTTP request with variable URL — intentional (GitHub API download URL)
+        - G107
+        # G115: uintptr->int conversion — standard pattern for terminal fd (os.Stdin.Fd())
+        - G115
+        # G602: slice bounds false positive — result is [3]int array, always valid
+        - G602
+        # G702: command injection via taint — intentional use of $SHELL env var
+        - G702

From feb8de21e75b71b1f9d98a4b69a3c7b865d6f4c8 Mon Sep 17 00:00:00 2001
From: cotta-dev <kobatatsu0514@gmail.com>
Date: Fri, 3 Apr 2026 00:25:14 +0900
Subject: [PATCH 3/3] ci: upgrade codeql-action to v4 (Node.js 24)

---
 .github/workflows/codeql.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 893a48a..37edb7e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -15,8 +15,8 @@ jobs:
       security-events: write
     steps:
       - uses: actions/checkout@v6
-      - uses: github/codeql-action/init@v3
+      - uses: github/codeql-action/init@v4
         with:
           languages: go
-      - uses: github/codeql-action/autobuild@v3
-      - uses: github/codeql-action/analyze@v3
+      - uses: github/codeql-action/autobuild@v4
+      - uses: github/codeql-action/analyze@v4