Upgrade deps, fix CI toolchain, and clear all lint/security findings

[arumes31]

Summary

Upgrades Go module dependencies to latest, fixes the failing CI, and resolves all 119 golangci-lint/gosec findings (which CI never enforced because it was erroring at config load).

Dependencies & toolchain

• go get -u ./... + go mod tidy.
• Workflows now read the Go version from go.mod (go-version-file) instead of pinned 1.22 — fixes the golangci-lint: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.26.4) error.
• GitHub Actions bumped to current majors (supersedes the 6 open Dependabot PRs build(deps): bump actions/upload-artifact from 4 to 7 #1–build(deps): bump actions/setup-go from 5 to 6 #6): checkout v6, setup-go v6, upload-artifact v7, golangci-lint-action v9, metadata-action v6, build-push-action v7, goreleaser-action v6. Clears the Node 20 deprecation warning.
• Install Fyne's cgo/OpenGL/X11 build deps in the Linux CI job.

Linting (golangci-lint v2)

• .golangci.yml migrated to the v2 schema. gosec runs only as its dedicated CI step (it honours //#nosec; golangci-lint's embedded gosec does not), avoiding double-reporting.
• All errcheck / bodyclose / unused / staticcheck findings fixed.

Security (gosec) — all fixed or audited

• context.Context threaded through the SQLite Store (*Context APIs), plus net.ListenConfig and exec.CommandContext (noctx).
• http.Server ReadHeaderTimeout set in the struct literal (G112).
• Audited //#nosec with justifications for the unavoidable cases: Win32 syscall unsafe.Pointer (G103), file-path opens in a sync tool (G304/G703), subprocess launches (G204/G702), encrypted-token marshalling (G117), bounded int conversions (G115).

Verified locally

go build ./..., golangci-lint run (0), gosec ./... (0), govulncheck ./... (clean), go test ./... — all pass.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores

  • Removed Docker container support and automated release workflow.
  • Updated CI/CD pipelines with newer GitHub Actions versions and improved security scanning (gosec, govulncheck, Gitleaks).
  • Upgraded build tooling to golangci-lint v2.
  • Updated Go module dependencies.

• Refactor

  • Enhanced internal code quality with improved context handling and safer system calls on Windows.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

All Store CRUD methods gain a context.Context parameter and use *Context SQL variants; the sync engine and service layer pass e.ctx or context.Background() to these methods. Across the codebase, exec.Command is replaced with exec.CommandContext. Windows syscall sites receive unsafe.Pointer wrapping and #nosec annotations; gosec suppression comments are added to file-I/O calls throughout. CI switches to golangci-lint v2, adds a Gitleaks secret-scan job, and removes GoReleaser/Docker configuration.

Changes

Context propagation, gosec suppressions, and CI tooling overhaul

Layer / File(s)	Summary
CI/tooling configuration overhaul .gitattributes, .golangci.yml, .github/workflows/ci.yml, .github/workflows/codeql.yml, go.mod	golangci-lint updated to v2 with default: standard and gofmt moved to a formatters section; CI workflow moves lint-and-test to windows-latest with CGO_ENABLED=1, adds a standalone Gitleaks secret-scan job, bumps all action versions, and switches gosec/govulncheck to go install execution; .gitattributes adds LF normalization and binary image markers; go.mod updates indirect dependencies; .goreleaser.yaml, Dockerfile, and .dockerignore content removed.
Store API: add context.Context to all methods internal/drive/store.go	All twelve public Store CRUD methods gain a leading ctx context.Context parameter; NewStore, migrateV1ToV2, and openStore create background contexts for startup work; every internal Query/Exec call is replaced with its *Context variant.
Sync engine and service: wire engine ctx into Store calls internal/sync/engine.go, internal/service/appcontroller.go	engine.go passes e.ctx to every store call across scan, event processing, upload, download, delete, conflict resolution, poll, and reconcile paths; deferred file close in uploadFile is wrapped to discard the error; appcontroller.go passes context.Background() to UpsertSyncRoot in StartSync.
Replace exec.Command with exec.CommandContext tools/gccwrap/main.go, internal/drive/auth.go, internal/service/fyneui.go, internal/service/fyneui_settings.go, cmd/gcrypt/opengl_windows.go	All exec.Command(...) call sites are replaced with exec.CommandContext(context.Background(), ...) with #nosec annotations; context import added to each affected file.
auth.go: ListenConfig, ReadHeaderTimeout, and nosec annotations internal/drive/auth.go	GetTokenFromWebBrowser creates the loopback listener via net.ListenConfig.Listen and sets ReadHeaderTimeout inline in the http.Server literal; SaveToken and LoadToken gain #nosec annotations for token marshaling and file-read sites.
Windows unsafe-pointer hardening and resource cleanup internal/service/dialogs_windows.go, internal/service/dpapi_windows.go, internal/crypto/crypto.go, internal/sync/metered_windows.go, internal/sync/watcher.go, cmd/gcrypt/opengl_windows.go, cmd/gcrypt/console_windows.go, cmd/gcrypt/singleinstance_windows.go	All Win32 proc arguments receive unsafe.Pointer wrapping and #nosec G103 annotations; dpapi_windows.go defers LocalFree inline; opengl_windows.go defers DestroyWindow/ReleaseDC for cleanup on early returns and defers source-file close in copyFile; metered_windows.go removes unused nlmConnectivity* constants; watcher.go rewrites parseNotifyBuffer loop to a condition-based form with #nosec annotations.
Scattered #nosec/nolint suppressions across service, config, sync, and crypto internal/config/config.go, internal/config/config_test.go, internal/crypto/filename.go, internal/service/backup.go, internal/service/logger.go, internal/service/logger_test.go, internal/service/setup.go, internal/sync/ignore.go, internal/sync/manager.go, internal/sync/scanner.go, internal/drive/client.go	Gosec suppression comments (G304, G703, G101, G115, G118) added to file I/O calls throughout; minor cosmetic whitespace/alignment changes in config constants and struct fields.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related PRs

• arumes31/gcrypt#7: Modifies GetTokenFromWebBrowser in internal/drive/auth.go at the same function where this PR adds net.ListenConfig and ReadHeaderTimeout, making the changes directly overlapping.

Poem

🐇 Hop, hop! Context flows through every call,
No exec.Command left to stand tall.
#nosec here, #nosec there,
The linter's happy beyond compare!
GoReleaser gone, Gitleaks in—
A cleaner pipeline, let CI begin! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the three main objectives: upgrading dependencies, fixing CI/toolchain issues, and resolving all lint/security findings found throughout the changeset.
Docstring Coverage	✅ Passed	Docstring coverage is 84.21% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch v0.1.3

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}