Refactor/move cmd to internal

.github/workflows/codeChecks.yml

@@ -5,6 +5,7 @@ on:
     paths:
       - ".github/workflows/codeChecks.yml"
       - ".goreleaser.yaml"
+      - ".golangci.yml"
       - ".testcoverage.yml"
       - "devenv.*"
       - "cmd/**"
@@ -13,108 +14,121 @@ on:
       - "*.go"
       - "go.*"
 
+permissions:
+  contents: read
+
 jobs:
-  go_tests:
+  go_lint:
+    name: Go lint
+    runs-on: ubuntu-latest
+    strategy:
+      max-parallel: 2
+      matrix:
+        go-version: ["1.25"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Setup Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: stable
+
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+        with:
+          version: latest
+
+  go_vulncheck:
+    name: Go vulnerabilities check
     runs-on: ubuntu-latest
     strategy:
-      max-parallel: 1
+      max-parallel: 2
       matrix:
         go-version: ["1.25"]
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: ${{ matrix.go-version }}
 
       - name: Install dependencies
-        run: go get .
+        run: go mod tidy
 
-      - name: Build
-        run: go build -v ./...
-
-      - name: Test with the Go CLI
-        run: go test -v ./...
-
-      - name: Check for vulnerabilities
-        uses: golang/govulncheck-action@v1
+      - name: govulncheck test
+        uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
         with:
           go-version-input: ${{ matrix.go-version }}
           go-package: ./...
           work-dir: .
 
-  # # WARN this action will install devenv 2.x.x while
-  #         # the repo still uses 1.11.1. Disabling it until devenv is upgraded
-  # devenv_test:
-  #   needs: go_tests
-  #   runs-on: ubuntu-latest
-  #
-  #   steps:
-  #     - name: Checkout
-  #       uses: actions/checkout@v5
-  #
-  #     - uses: cachix/install-nix-action@v31
-  #       with:
-  #         github_access_token: ${{ secrets.GITHUB_TOKEN }}
-  #         nix_path: nixpkgs=channel:nixos-25.11
-  #
-  #     - uses: cachix/cachix-action@v16
-  #       with:
-  #         name: devenv
-  #
-  #     - name: Install devenv.sh
-  #       run: nix profile add nixpkgs#devenv
-  #
-  #     - name: Build the devenv shell and run any pre-commit hooks
-  #       env:
-  #         JWTINFO_TEST_AUTH0: ${{ secrets.JWTINFO_TEST_AUTH0 }}
-  #       run: devenv test
-  #       timeout-minutes: 15
-  #
-  go_test_coverage_check:
-    needs: go_tests
+  go_tests:
+    name: Go tests and build
     runs-on: ubuntu-latest
+    strategy:
+      max-parallel: 2
+      matrix:
+        go-version: ["1.25"]
+
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-go@v6
+      - name: Checkout
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+
+      - name: Setup Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: ${{ matrix.go-version }}
+
+      - name: Install dependencies
+        run: go mod tidy
+
+      - name: Test with the Go CLI
+        run: go test -v ./...
+
+      - name: Build
+        run: go build -v ./...
+
+  goreleaser_test:
+    name: GoReleaser release test
+    runs-on: ubuntu-latest
+
+    strategy:
+      max-parallel: 2
+      matrix:
+        go-version: ["1.25"]
+
+    needs:
+      - go_lint
+      - go_tests
+      - go_vulncheck
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
-          go-version: "1.25"
+          fetch-depth: 0
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
+
+      - name: Install Syft
+        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
 
-      - name: generate test coverage
-        run: go test ./... -coverprofile=./cover.out -covermode=atomic -coverpkg=./...
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: ${{ matrix.go-version }}
 
-      - name: check test coverage
-        continue-on-error: ${{ github.ref_name != 'main' }}
-        uses: vladopajic/go-test-coverage@v2
+      - name: Run GoReleaser test
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
         with:
-          config: ./.testcoverage.yml
-          git-token: ${{ github.ref_name == 'main' && secrets.GITHUB_TOKEN || '' }}
-          git-branch: badges
-
-  # goreleaser_test:
-  #   needs: devenv_test
-  #   runs-on: ubuntu-latest
-  #
-  #   steps:
-  #     - name: Checkout
-  #       uses: actions/checkout@v5
-  #       with:
-  #         fetch-depth: 0
-  #
-  #     - name: Set up QEMU
-  #       uses: docker/setup-qemu-action@v3
-  #
-  #     - name: Set up Go
-  #       uses: actions/setup-go@v6
-  #       with:
-  #         go-version: "1.25"
-  #
-  #     - name: Run GoReleaser test
-  #       uses: goreleaser/goreleaser-action@v6
-  #       with:
-  #         version: "~> 2"
-  #         args: release --snapshot --clean
-  #         workdir: .
+          version: "~> 2"
+          args: release --snapshot --clean
+          workdir: .

.github/workflows/release.yml

@@ -4,47 +4,55 @@ on:
   push:
     tags:
       - "*"
+  workflow_run:
+    workflows: ["CodeChecks"]
+    types:
+      - completed
 
 permissions:
   contents: write
 
+env:
+  CGO_ENABLED: 0
+  DOCKER_CLI_EXPERIMENTAL: "enabled"
+  GO_VERSION: "1.25"
+
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        go-version: ["1.25"]
-
-    env:
-      DOCKER_CLI_EXPERIMENTAL: "enabled"
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           fetch-depth: 0
 
-      - uses: cachix/install-nix-action@v31
+      - name: Install Nix
+        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
         with:
           github_access_token: ${{ secrets.GH_GORELEASER_TOKEN }}
 
+      - name: Install Syft
+        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GH_GORELEASER_TOKEN }}
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: ${{ matrix.go-version }}
+          go-version: ${{ env.GO_VERSION }}
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
         with:
           version: "~> 2"
           args: release --clean
@@ -53,4 +61,4 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GH_GORELEASER_TOKEN }}
 
       - name: Refresh Go Report Card
-        uses: creekorful/goreportcard-action@v1.0
+        uses: creekorful/goreportcard-action@1f35ced8cdac2cba28c9a2f2288a16aacfd507f9 # v1.0

.golangci.yml

@@ -6,13 +6,17 @@ linters:
     - dupword
     - dupl
     - durationcheck
+    - errcheck
     - errorlint
     - errchkjson
     - misspell
     - nestif
     - iface
     - unconvert
     - revive
+    - gocyclo
+    - cyclop
+    - gocognit
     - wsl_v5
     - tagliatelle
     - testifylint
@@ -27,6 +31,10 @@ linters:
   settings:
     gocyclo:
       min-complexity: 15
+    cyclop:
+      max-complexity: 15
+    gocognit:
+      min-complexity: 15
 
     revive:
       enable-all-rules: true
@@ -38,7 +46,7 @@ linters:
           disabled: true
           exclude: [""]
         - name: exported
-          disabled: true
+          disabled: false
 
         - name: line-length-limit
           severity: warning
@@ -53,13 +61,17 @@ linters:
           exclude: [""]
           arguments: [15]
 
-        # https://github.com/mgechev/revive/blob/HEAD/RULES_DESCRIPTIONS.md#cyclomatic
         - name: cyclomatic
           severity: warning
           disabled: false
           exclude: [""]
           arguments: [15]
 
+        - name: unhandled-error
+          severity: warning
+          disabled: false
+          exclude: [""]
+
   exclusions:
     generated: lax
     presets:
@@ -75,3 +87,11 @@ linters:
       - third_party$
       - builtin$
       - examples$
+      - "(^|.*/|\\\\)vendor/.*"
+
+formatters:
+  enable:
+    - gci
+    - gofmt
+    - gofumpt
+    - goimports

.goreleaser.yaml

@@ -2,18 +2,24 @@
 # vim: set ts=2 sw=2 tw=0 fo=cnqoj
 ---
 version: 2
+
 project_name: https-wrench
+
 dist: ./dist/
+
 force_token: github
+
 env_files:
   gitea_token: ~/nope
   github_token: ~/nope
+
 release:
   disable: false
   skip_upload: false
   github:
     owner: xenos76
     name: https-wrench
+
 before:
   hooks:
     - go mod download
@@ -51,6 +57,15 @@ archives:
       - completions/*
       - manpages/*
 
+checksum:
+  name_template: "{{ .ProjectName }}_{{ .Version }}_checksums.txt"
+  algorithm: sha256
+
+sboms:
+  - artifacts: archive
+  - id: source
+    artifacts: source
+
 nfpms:
   - maintainer: Zeno Belli <xeno@os76.xyz>
     vendor: xenos76 on Github