CI: add security worflow to check for vulnerabilities

.github/workflows/lint.yml

@@ -0,0 +1,36 @@
+name: lint
+
+on:
+  push:
+    branches: [ "main", "master" ]
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: read
+  statuses: write
+
+jobs:
+  golangci:
+    name: Run golangci-lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: 'go.mod'
+          cache: true
+
+      - name: Install golangci-lint
+        run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
+
+      - name: Run golangci-lint (root)
+        run: $(go env GOPATH)/bin/golangci-lint run ./...
+
+      - name: Run golangci-lint (integration)
+        run: |
+          cd integration
+          $(go env GOPATH)/bin/golangci-lint run ./...

.github/workflows/security.yml

@@ -0,0 +1,23 @@
+name: security
+
+on:
+  push:
+    branches: [ "main", "master" ]
+  pull_request:
+
+jobs:
+  govulncheck:
+    name: Run govulncheck
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: 'go.mod'
+          cache: true
+
+      - name: Run govulncheck
+        uses: golang/govulncheck-action@v1

.github/workflows/validate.yml

@@ -25,6 +25,12 @@ jobs:
         cache: true
         cache-dependency-path: '**/go.sum'
 
+    - name: Run Formatter Check
+      run: make fmt-check
+
+    - name: Run Tidy Check
+      run: make tidy-check
+
     - name: Vet packages
       run: make vet
 

.github/workflows/verify.yml

@@ -34,6 +34,12 @@ jobs:
         cache: true
         cache-dependency-path: '**/go.sum'
 
+    - name: Run Formatter Check
+      run: make fmt-check
+
+    - name: Run Tidy Check
+      run: make tidy-check
+
     - name: Vet packages
       run: make vet
 
@@ -48,7 +54,7 @@ jobs:
         make integration-gen
         cd integration
         ../bin/valk migrate -u "file:dev.db" init_sqlite
-        go test -tags sqlite -v ./...
+        go test -race -tags sqlite -v ./...
         mv schema.prisma.bak schema.prisma
 
     - name: Run Postgres Integration Tests
@@ -65,5 +71,5 @@ jobs:
         make integration-gen
         cd integration
         ../bin/valk migrate -u "$PG_URL" init_pg
-        PG_DATABASE_URL="$PG_URL" go test -v ./...
+        PG_DATABASE_URL="$PG_URL" go test -race -v ./...
         mv schema.prisma.bak schema.prisma

.golangci.yml

@@ -0,0 +1,9 @@
+run:
+  timeout: 5m
+
+issues:
+  exclude-dirs:
+    - integration/valk
+    - valk
+  exclude-files:
+    - integration/main.go

cli/getConfig.go

@@ -48,9 +48,6 @@ func GetConfig() *Config {
 	}
 	// hasAll := false
 	for _, l := range config.Log {
-		if l == "all" {
-			// hasAll = true
-		}
 		if !slices.Contains(LogLevels, l) && l != "all" {
 			log.Fatalf("invalid log level in valk.json: %q (must be one of: query, info, warn, error, all)", l)
 			return nil

cli/handleGenerate.go

@@ -2,11 +2,11 @@ package cli
 
 import (
 	"fmt"
+	"github.com/voidclancy/valk/generator"
+	"github.com/voidclancy/valk/schema"
 	"os"
 	"path/filepath"
 	"strings"
-	"github.com/voidclancy/valk/generator"
-	"github.com/voidclancy/valk/schema"
 )
 
 func handleGenerate() {

cli/handleInit.go

@@ -6,7 +6,11 @@ import (
 )
 
 func handleInit() {
-	os.WriteFile("valk.json", []byte(configFileContent), 0644)
+	err := os.WriteFile("valk.json", []byte(configFileContent), 0644)
+	if err != nil {
+		fmt.Printf("Error writing valk.json: %v\n", err)
+		os.Exit(1)
+	}
 	fmt.Println("creating valk.json ....")
 }
 

cli/handleMigrate.go

@@ -64,7 +64,10 @@ func handleMigrate(args []string) {
 	}
 	defer db.Close()
 
-	goose.SetDialect(string(schemaDef.Datasource.Provider))
+	if err := goose.SetDialect(string(schemaDef.Datasource.Provider)); err != nil {
+		fmt.Printf("Error setting database dialect: %v\n", err)
+		os.Exit(1)
+	}
 	if !opts.Verbose {
 		goose.SetLogger(goose.NopLogger())
 	}

go.mod

@@ -1,6 +1,6 @@
 module github.com/voidclancy/valk
 
-go 1.26.4
+go 1.26.5
 
 require (
 	ariga.io/atlas v1.2.3
@@ -31,7 +31,7 @@ require (
 	github.com/zclconf/go-cty-yaml v1.1.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
 	golang.org/x/text v0.37.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	modernc.org/libc v1.72.1 // indirect

go.sum

@@ -69,8 +69,8 @@ golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 h1:v+OssWQX+hTHEmOBgwxdZxK4zHq3yOs8F9J7mk0PY8E=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=

integration/.golangci.yml

@@ -0,0 +1,8 @@
+run:
+  timeout: 5m
+
+issues:
+  exclude-dirs:
+    - valk
+  exclude-files:
+    - main.go

integration/create_many_test.go

@@ -96,7 +96,9 @@ func TestCreateMany_Hooks(t *testing.T) {
 		}
 
 		var count int
-		client.Raw().QueryRowContext(ctx, `SELECT count(*) FROM "User"`).Scan(&count)
+		if err := client.Raw().QueryRowContext(ctx, `SELECT count(*) FROM "User"`).Scan(&count); err != nil {
+			t.Fatalf("failed to scan user count: %v", err)
+		}
 		if count != 0 {
 			t.Fatalf("expected 0 rows after aborted CreateMany, got %d", count)
 		}
@@ -143,7 +145,9 @@ func TestCreateMany_Hooks(t *testing.T) {
 		})
 
 		var count int
-		client.Raw().QueryRowContext(ctx, `SELECT count(*) FROM "User"`).Scan(&count)
+		if err := client.Raw().QueryRowContext(ctx, `SELECT count(*) FROM "User"`).Scan(&count); err != nil {
+			t.Fatalf("failed to scan user count: %v", err)
+		}
 		prevCount := count
 
 		_, err := client.User.CreateManyAndReturn(
@@ -157,7 +161,9 @@ func TestCreateMany_Hooks(t *testing.T) {
 			t.Errorf("expected 'after hook rejected' in error, got %v", err)
 		}
 
-		client.Raw().QueryRowContext(ctx, `SELECT count(*) FROM "User"`).Scan(&count)
+		if err := client.Raw().QueryRowContext(ctx, `SELECT count(*) FROM "User"`).Scan(&count); err != nil {
+			t.Fatalf("failed to scan user count: %v", err)
+		}
 		if count != prevCount+1 {
 			t.Fatalf("expected %d rows (insert still committed), got %d", prevCount+1, count)
 		}
@@ -220,10 +226,12 @@ func TestCreateMany_Hooks(t *testing.T) {
 		}
 
 		var count int
-		client.Raw().QueryRowContext(ctx, query(
+		if err := client.Raw().QueryRowContext(ctx, query(
 			`SELECT count(*) FROM "User" WHERE email = 'ghost@example.com'`,
 			`SELECT count(*) FROM "User" WHERE email = 'ghost@example.com'`,
-		)).Scan(&count)
+		)).Scan(&count); err != nil {
+			t.Fatalf("failed to scan user count: %v", err)
+		}
 		if count != 1 {
 			t.Fatalf("expected row to still exist (insert committed before hook), got %d", count)
 		}

integration/go.mod

@@ -1,6 +1,6 @@
 module integration
 
-go 1.26.4
+go 1.26.5
 
 replace github.com/voidclancy/valk => ../
 

integration/postgres_defaults_test.go

@@ -607,8 +607,12 @@ func TestNativeDefaults_JsonTypes(t *testing.T) {
 			t.Fatalf("json/jsonb create: %v", err)
 		}
 		var got, want any
-		json.Unmarshal(rec.JsonReq, &got)
-		json.Unmarshal([]byte(`{"x":1}`), &want)
+		if err := json.Unmarshal(rec.JsonReq, &got); err != nil {
+			t.Fatalf("failed to unmarshal rec.JsonReq: %v", err)
+		}
+		if err := json.Unmarshal([]byte(`{"x":1}`), &want); err != nil {
+			t.Fatalf("failed to unmarshal comparison JSON: %v", err)
+		}
 		gotJSON, _ := json.Marshal(got)
 		wantJSON, _ := json.Marshal(want)
 		if string(gotJSON) != string(wantJSON) {

integration/transaction_test.go

@@ -137,7 +137,7 @@ func TestManualTransactionCommitAndRollback(t *testing.T) {
 		"u4", "user4@example.com", "444444444", "student",
 	)
 	if err != nil {
-		tx1.Rollback()
+		_ = tx1.Rollback()
 		t.Fatalf("insert failed: %v", err)
 	}
 	if err := tx1.Commit(); err != nil {
@@ -165,7 +165,7 @@ func TestManualTransactionCommitAndRollback(t *testing.T) {
 		"u5", "user5@example.com", "555555555", "student",
 	)
 	if err != nil {
-		tx2.Rollback()
+		_ = tx2.Rollback()
 		t.Fatalf("insert failed: %v", err)
 	}
 	if err := tx2.Rollback(); err != nil {

makefile

@@ -1,4 +1,4 @@
-.PHONY:  build build-prod run test install db-up db-down db-clean bi fmt fmt-check vet integration-gen integration-test bench race lint test-sqlite test-pg test-dbs
+.PHONY:  build build-prod run test install db-up db-down db-clean bi fmt fmt-check tidy tidy-check vulncheck vet integration-gen integration-test bench race lint test-sqlite test-pg test-dbs ci-local
 
 bi: build install
 
@@ -24,7 +24,7 @@ run:
 	go build -o bin/valk && ./bin/valk
 
 test:
-	go test -v ./...
+	go test -race -v ./...
 
 fmt:
 	gofmt -w .
@@ -36,13 +36,26 @@ fmt-check:
 		exit 1; \
 	fi
 
+tidy:
+	go mod tidy
+	cd integration && go mod tidy
+
+tidy-check:
+	go mod tidy
+	cd integration && go mod tidy
+	@git diff --exit-code go.mod go.sum integration/go.mod integration/go.sum || (echo "go.mod or go.sum is not tidy. Run: make tidy"; exit 1)
+
 vet:
 	go vet ./...
 	cd integration && go vet ./...
 
 lint:
-	-$(shell go env GOPATH)/bin/staticcheck ./...
-	-$(shell go env GOPATH)/bin/gocritic check ./...
+	$(shell go env GOPATH)/bin/golangci-lint run ./...
+	cd integration && $(shell go env GOPATH)/bin/golangci-lint run ./...
+
+vulncheck:
+	govulncheck ./...
+	cd integration && govulncheck ./...
 
 integration-gen: build
 	cd integration && ../bin/valk generate
@@ -68,13 +81,15 @@ test-sqlite: bi test
 	rm -f integration/valk/migrations/*.sql
 	rm -f integration/dev.db
 	cd integration && DATABASE_URL="file:./dev.db" DATABASE_DIRECT_URL="file:./dev.db" ../bin/valk -m init
-	cd integration && go test -tags sqlite -v ./...
+	cd integration && go test -race -tags sqlite -v ./...
 
 test-pg: bi db-reset test
 	node integration/prepareSchema.js postgres
 	cd integration && ../bin/valk -g
 	rm -f integration/valk/migrations/*.sql
 	cd integration && DATABASE_URL="postgres://postgres:postgres@localhost:5432/postgres?sslmode=disable" DATABASE_DIRECT_URL="postgres://postgres:postgres@localhost:5432/postgres?sslmode=disable" ../bin/valk -m init
-	cd integration && go test -v ./...
+	cd integration && go test -race -v ./...
+
+test-dbs: test-sqlite test-pg
 
-test-dbs: test-sqlite test-pg
+ci: fmt fmt-check tidy-check vet lint test vulncheck test-dbs

migration/convertToAtlasSchema.go

@@ -2,9 +2,9 @@ package migration
 
 import (
 	"fmt"
-	"strings"
 	providers "github.com/voidclancy/valk/dbProviders"
 	vs "github.com/voidclancy/valk/schema"
+	"strings"
 
 	"ariga.io/atlas/sql/postgres"
 	"ariga.io/atlas/sql/schema"

migration/dialect.go

@@ -2,9 +2,9 @@ package migration
 
 import (
 	"database/sql"
-	"strings"
 	providers "github.com/voidclancy/valk/dbProviders"
 	"github.com/voidclancy/valk/schema"
+	"strings"
 
 	"ariga.io/atlas/sql/migrate"
 )

migration/diff.go

@@ -147,8 +147,8 @@ func injectRequiredExtensions(upSQL string, targetSchema *vs.Schema) string {
 	for _, model := range targetSchema.Models {
 		for _, sf := range model.ScalarFields {
 			for _, spec := range vs.NativeTypes {
-				if (sf.NativeType != nil && strings.EqualFold(sf.NativeType.Name, spec.PrismaName)) || 
-				   strings.EqualFold(sf.SQLType, spec.SQLType) {
+				if (sf.NativeType != nil && strings.EqualFold(sf.NativeType.Name, spec.PrismaName)) ||
+					strings.EqualFold(sf.SQLType, spec.SQLType) {
 					if spec.Extension != "" {
 						needed[spec.Extension] = spec.Extension
 					}