Security:
- Enforce client_max_body_size in HTTP/2 and HTTP/3 adapters before buffering
- Use trusted-proxy-aware client IP extraction for access control and rate limiting
- Include Host and Vary headers in proxy cache key to prevent cache poisoning
- Harden static file path traversal check with filepath.Clean + prefix validation
- Honor proxy_ssl config for WebSocket upstream TLS
Proxy/handler bugs:
- Decrement WebSocket connection count immediately on return (not deferred in retry loop)
- Remove ineffective headersPool
- Coalesce concurrent background cache refreshes with singleflight
Dev/build:
- Fix Makefile run and test-config targets
- Remove broken wget healthcheck from docker-compose
- Add missing integration build tags
- Fix go vet warnings in tests
CI:
- Run golangci-lint and integration tests in Gitea Actions
Refs: docs/superpowers/plans/2026-06-17-fix-review-issues.md
GITHUB_PATH does not reliably update PATH for subsequent steps in
Gitea Actions. Put Go install + all checks in one step with explicit
PATH export. Simplify to 2 jobs: test + build.
golangci-lint v2 install via 'go install' is too heavy for CI
(compiles from source, needs lots of memory and time).
Use go vet as lightweight alternative for now.
actions/setup-go@v5 was failing silently (0s steps) likely due to
network issues downloading Go from GitHub. Install Go directly from
go.dev which is more accessible.
Also remove Docker job (not needed yet) and simplify to 3 jobs.
The curl-based install script downloads from raw.githubusercontent.com
which is unreliable in some network environments. go install is more
reliable and uses the Go module proxy.
Mirror of .github/workflows/ci.yml adapted for Gitea Actions:
- Replace golangci-lint-action with direct install script
- Remove upload-artifact (not needed on Gitea)
- Same 4-job structure: lint → test → build → docker
