fix: harden Cloudflare deploy pipeline (+ Go modernization & test coverage) - #36
Merged
Conversation
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Apply go fix modernizers (Go 1.26): slices.Contains, maps.Copy, strings.Cut/CutPrefix, strings.SplitSeq, range-over-int, min/max, fmt.Appendf. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The any modernizer's gofmt realignment and signature edits dragged
pre-existing lint debt (revive exported-comment, var-naming Id->ID,
gocognit complexity, gosec) into golangci-lint's only-new-issues set.
Revert the interface{}->any change on exactly those lines/files so they
leave the diff; keep all structural wins (slices/maps/strings/Appendf)
and the rest of the any conversion. Fix the one genuinely-new hit
(octal literal 0600 -> 0o600).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Addresses correctness and security findings from a full review of the Cloudflare deploy path (compile stage, Worker runtime, provisioning, deploy orchestration). Secrets: - Abort instead of silently stripping live Worker secrets when local secrets fail to load or an upload would drop live names (CF uploads are replace-not-merge); add cloudflare.allow_secret_wipe escape hatch. - Doppler allowlist failure no longer harvests the whole shell environment. Worker runtime: - Fix image-optimizer SSRF (protocol-relative / whitespace URLs bypassed the remotePatterns allowlist; also block loopback/link-local/metadata hosts). - Close the /route.html guard bypass for prerendered SSG/ISR pages. - Cap multipart Server Action bodies (413) so they can't exhaust the isolate. - Fail the rate limiter closed when its KV binding is missing. - Require a session-cookie exp; time-box revalidate markers so they self-heal. Deploy orchestration: - Two-phase R2 upload (immutable chunks before mutable HTML) to remove the ChunkLoadError window; rollback restores the active version and purges cache; --verify gates on the smoke check; SIGINT/SIGTERM cancel cleanly. Provisioning: - Atomic D1 migration apply+record; DNS FQDN + multi-record correctness; partial-provision state persisted; reachable R2 parent-key tier; duplicate binding-name detection. Compile stage: - Action-loader dist-dir prefix; dedup root layout; keep user "chunks" routes; deterministic ContentHash; surface manifest read errors; version fallback climbs to repo root; detect after(). Adds Go and node --test coverage for the above. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ru3K1fyNRnyTXQ95Gmv6Su
Flushes uncommitted working-tree work that predates the Cloudflare pipeline review: daemon command/process/secrets handler changes, a testable collectPaths refactor in cmd/revalidator, and new unit tests across config, nextbuild, secrets, updater, daemon, and revalidator. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ru3K1fyNRnyTXQ95Gmv6Su
aynaash
changed the title
golangci-lint (gocritic rangeValCopy) flagged the new DNS reconciliation loops copying the 736-byte dns.RecordResponse per iteration. Index instead. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ru3K1fyNRnyTXQ95Gmv6Su
Resolve all new-vs-main lint issues so CI's only-new-issues gate passes: - nextcompile/compiler.go: pass Manifest by pointer (hugeParam) and name hashBundle's results (unnamedResult). - revalidator: index SQS records to avoid a per-iteration copy (rangeValCopy). - daemon/nextbuild/updater: nolint/nosec on deploy-time exec (short-lived, no context needed) and on test fakes that must stay executable; tighten test dir perms to 0750. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ru3K1fyNRnyTXQ95Gmv6Su
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Runs Go 1.26's rewritten
go fixmodernizers across the repo. Split into two commits so the boring rename is easy to skim and the structural changes are easy to read.Commit 1 —
interface{}→any(32 files)Pure rename, zero behavior change.
Commit 2 — structural modernizers (50 files)
strings.CutPrefix/Cut--flag=arg parsing +Index+slicingslices.Containscontains()loops removedmaps.Copystrings.SplitSeq[]stringallocfor range Nmin/maxfmt.Appendf[]byte(fmt.Sprintf(...))Net −40 lines.
Skipped (intentionally)
omitempty→omitzero— the tool refuses it as a marshalling behavior change.Verification
go build ./...✅go vet ./...✅go test ./...✅ (suite stays green)go fixpass found nothing new (fixed point)🤖 Generated with Claude Code