Security and quality hardening pass

.dockerignore

@@ -11,3 +11,7 @@ coverage.out
 coverage.html
 go.work
 go.work.sum
+.env
+.envrc
+*.pem
+*.key

.github/actions/checkout-eyrie/action.yml

@@ -12,6 +12,10 @@ runs:
   steps:
     - name: Clone ecosystem repos
       shell: bash
+      env:
+        # Passed via env (not ${{ }} interpolation into the script) so an
+        # attacker-controlled ref (e.g. a fork branch name) cannot inject shell.
+        INPUT_REF: ${{ inputs.ref }}
       run: |
         set -euo pipefail
         mkdir -p "${GITHUB_WORKSPACE}/external"
@@ -31,7 +35,7 @@ runs:
             git clone "https://github.com/GrayCodeAI/${repo}.git" "$dest"
             if ! (cd "$dest" && git checkout --quiet "$commit" 2>/dev/null); then
               echo "Submodule commit $commit not reachable, falling back to ref"
-              ref="${{ inputs.ref }}"
+              ref="$INPUT_REF"
               if [ "$ref" = "main" ]; then
                 rm -rf "$dest"
                 git clone --depth=1 --branch main \
@@ -41,7 +45,7 @@ runs:
               fi
             fi
           else
-            ref="${{ inputs.ref }}"
+            ref="$INPUT_REF"
             # Fall back to main if the branch doesn't exist on the dependency repo.
             if ! git ls-remote --heads "https://github.com/GrayCodeAI/${repo}.git" "$ref" | grep -q .; then
               echo "Branch '$ref' not found on $repo, falling back to main"

.github/workflows/ci.yml

@@ -232,11 +232,13 @@ jobs:
         run: |
           go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
           govulncheck ./...
-      - name: gosec (report only)
-        continue-on-error: true
+      - name: gosec
         run: |
           go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4
-          gosec -exclude=G104,G703,G704,G101,G107,G112,G114,G115,G201,G202,G203,G204,G301,G302,G304,G305,G306,G307,G401,G402,G403,G404,G501,G502,G503,G504,G505,G601,G602 -confidence=medium -severity=high ./...
+          # Full-strength scan: no rule exclusions. The repo reached a
+          # 0-findings baseline (2026-07 full-repo audit); keep it that way.
+          # Suppressions must be inline `#nosec <rule> -- <justification>`.
+          gosec -quiet ./...
 
   # -------------------------------------------------------------------------
   # 7. Secret scan — detect leaked API keys, tokens, credentials.

.github/workflows/compatibility-matrix.yml

@@ -0,0 +1,33 @@
+# Cross-repo compatibility matrix check.
+# Source of truth: .shared-templates/workflows/compatibility-test.yml.tmpl
+# See docs/compatibility.md for what this validates and why.
+
+name: compatibility-matrix
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "testdata/compatibility-matrix.json"
+      - "testdata/compatibility-matrix.schema.json"
+  schedule:
+    - cron: "0 6 * * *" # nightly
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: validate compatibility matrix
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: "1.26.4"
+          cache: true
+      - name: Structural validation (schema + version pins)
+        run: make compat-check
+      - name: Report 'next' matrix
+        run: make compat-test

.github/workflows/docker.yml

@@ -56,14 +56,16 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=sha,prefix=sha-,format=long
 
-      - name: Build and push
+      # Build a single-platform image locally first so Trivy can gate the push:
+      # CRITICAL/HIGH findings fail this job before anything reaches GHCR.
+      - name: Build image for scan
         uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
-          platforms: linux/amd64,linux/arm64
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          platforms: linux/amd64
+          push: false
+          load: true
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:scan
           cache-from: type=gha
           cache-to: type=gha,mode=max
           build-args: |
@@ -72,14 +74,29 @@ jobs:
             BUILD_DATE=${{ github.event.head_commit.timestamp }}
 
       - name: Scan image with Trivy
-        if: github.event_name != 'pull_request'
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
-          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ github.sha }}
+          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:scan
           format: sarif
           output: trivy-image.sarif
           severity: CRITICAL,HIGH
-          exit-code: '0'
+          ignore-unfixed: true
+          exit-code: '1'
+
+      - name: Build and push
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          build-args: |
+            VERSION=${{ github.ref_name }}
+            COMMIT=${{ github.sha }}
+            BUILD_DATE=${{ github.event.head_commit.timestamp }}
 
       - name: Upload Trivy image scan results
         if: github.event_name != 'pull_request' && always()

.gitignore

@@ -1,5 +1,6 @@
 # Binaries
 hawk
+hawk_bin
 *.exe
 *.dll
 *.so
@@ -27,7 +28,15 @@ hawk
 
 # Test artifacts
 coverage.out
+coverage.html
+CODE_REVIEW_REPORT.md
+review_report.md
+
+# Workspace checksum file — regenerated by `make setup` / `go work sync`;
+# deleted and regenerated by the Dockerfile and flake.nix builds.
+go.work.sum
 
 # Lefthook-generated git hook wrappers
 .githooks/
 __pycache__/
+hawk_bin

.golangci.yml

@@ -13,10 +13,39 @@ linters:
     - bodyclose
     - unconvert
     - whitespace
+    - gosec
   settings:
     errcheck:
       check-type-assertions: true
       check-blank: false
+    gosec:
+      # Scoped to high-signal rules (2026-07 baseline: 0 findings in
+      # production code with this set). Deliberately excluded floods:
+      #   G104 — unhandled errors, already covered by errcheck
+      #   G301/G306 — 0755/0644 perms are intentional for user-visible files
+      #   G304 — hawk reads user-supplied file paths by design (CLI agent)
+      includes:
+        - G101 # hardcoded credentials
+        - G102 # bind to all interfaces
+        - G106 # ssh InsecureIgnoreHostKey
+        - G107 # url from variable in http request
+        - G110 # decompression bomb
+        - G111 # http dir traversal
+        - G112 # slowloris (missing ReadHeaderTimeout)
+        - G201 # sql format string
+        - G202 # sql string concat
+        - G203 # unescaped template data
+        - G204 # subprocess with variable
+        - G401 # weak crypto (md5/sha1/des/rc4)
+        - G402 # bad TLS settings
+        - G403 # weak RSA key
+        - G404 # weak random for security use
+        - G501 # crypto/md5 import
+        - G502 # crypto/des import
+        - G503 # crypto/rc4 import
+        - G504 # net/http/cgi import
+        - G505 # crypto/sha1 import
+        - G601 # implicit memory aliasing in range
     govet:
       enable-all: true
       disable:
@@ -57,6 +86,7 @@ linters:
           - bodyclose
           - errcheck
           - unused
+          - gosec
       - path: cmd/
         linters:
           - noctx

.shared-templates/.goreleaser.yml.tmpl

@@ -0,0 +1,142 @@
+# Canonical GrayCodeAI goreleaser config for Go binary repos.
+# Source of truth: .shared-templates/.goreleaser.yml.tmpl
+#
+# Placeholders rendered per repo (ALL-CAPS, distinct from goreleaser's own
+# `{{.Version}}`-style Go template fields, which are left as-is below):
+#   {{NAME}}        — short repo name (e.g. hawk, yaad, trace)
+#   {{MAIN_PKG}}    — main package path (e.g. ./ or ./cmd/yaad)
+#   {{DESCRIPTION}} — short single-line description for brew/nfpms
+#   {{VERSION_PKG}} — Go package path holding Version vars
+#                     (e.g. main or github.com/GrayCodeAI/hawk/internal/version)
+#
+# Repos with PRO/special features (e.g. trace's macOS notarization, tok's
+# nfpms) extend this template with extra sections instead of replacing it.
+
+version: 2
+project_name: {{NAME}}
+
+# ---------------------------------------------------------------------------
+# Pre-build hooks — keep go.mod tidy and verified.
+# ---------------------------------------------------------------------------
+before:
+  hooks:
+    - go mod verify
+
+# ---------------------------------------------------------------------------
+# Builds — three OS × two arch (no Windows/arm64).
+# Reproducible: `mod_timestamp` ties the binary timestamp to the commit time
+# rather than the build host's clock.
+# ---------------------------------------------------------------------------
+builds:
+  - id: {{NAME}}
+    main: {{MAIN_PKG}}
+    binary: {{NAME}}
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm64
+    ignore:
+      - goos: windows
+        goarch: arm64
+    ldflags:
+      - -s -w
+      - -X {{VERSION_PKG}}.Version={{.Version}}
+      - -X {{VERSION_PKG}}.Commit={{.ShortCommit}}
+      - -X {{VERSION_PKG}}.BuildDate={{.Date}}
+    mod_timestamp: "{{ .CommitTimestamp }}"
+
+# ---------------------------------------------------------------------------
+# Archives — tar.gz on Unix, zip on Windows. Includes README + LICENSE.
+# ---------------------------------------------------------------------------
+archives:
+  - id: default
+    formats: [tar.gz]
+    format_overrides:
+      - goos: windows
+        formats: [zip]
+    name_template: >-
+      {{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}
+    files:
+      - README.md
+      - LICENSE
+      - CHANGELOG.md
+
+# ---------------------------------------------------------------------------
+# Source archive — published alongside binaries for downstream packagers.
+# ---------------------------------------------------------------------------
+source:
+  enabled: true
+  name_template: "{{ .ProjectName }}_{{ .Version }}_source"
+
+# ---------------------------------------------------------------------------
+# Checksums — SHA-256, single file per release.
+# ---------------------------------------------------------------------------
+checksum:
+  name_template: checksums.txt
+  algorithm: sha256
+
+# ---------------------------------------------------------------------------
+# Snapshot — unreleased dev builds get a clear synthetic version.
+# ---------------------------------------------------------------------------
+snapshot:
+  version_template: "{{ incpatch .Version }}-next"
+
+# ---------------------------------------------------------------------------
+# Changelog — Conventional-Commit grouped, hidden noise.
+# ---------------------------------------------------------------------------
+changelog:
+  sort: asc
+  use: github
+  filters:
+    exclude:
+      - "^chore:"
+      - "^ci:"
+      - "^test:"
+      - "^style:"
+      - "^build:"
+      - "Merge pull request"
+      - "Merge branch"
+  groups:
+    - title: "Features"
+      regexp: '^.*?feat(\([[:word:]]+\))??!?:.+$'
+      order: 0
+    - title: "Bug Fixes"
+      regexp: '^.*?fix(\([[:word:]]+\))??!?:.+$'
+      order: 1
+    - title: "Performance"
+      regexp: '^.*?perf(\([[:word:]]+\))??!?:.+$'
+      order: 2
+    - title: "Refactoring"
+      regexp: '^.*?refactor(\([[:word:]]+\))??!?:.+$'
+      order: 3
+    - title: "Documentation"
+      regexp: '^.*?docs(\([[:word:]]+\))??!?:.+$'
+      order: 4
+    - title: "Other"
+      order: 999
+
+# ---------------------------------------------------------------------------
+# SBOM + release — auto-detect prereleases (rc/beta tags). Created on the
+# repo itself (not a separate release repo).
+# ---------------------------------------------------------------------------
+sboms:
+  - artifacts: archive
+    documents:
+      - "${artifact}.spdx.sbom.json"
+
+release:
+  draft: false
+  prerelease: auto
+  name_template: "v{{ .Version }}"
+  header: |
+    ## {{NAME}} v{{.Version}}
+
+    {{DESCRIPTION}}
+  footer: |
+
+    **Full changelog:** https://github.com/GrayCodeAI/{{NAME}}/compare/{{.PreviousTag}}...{{.Tag}}