feat-cleanup: protocol split, build-tag gating, lifecycle hardening, CI matrix

.github/workflows/pr-ci.yml

@@ -31,6 +31,76 @@ jobs:
         shell: bash
         run: bash scripts/ci/test.sh
 
+  quality:
+    name: Quality (vet + race + lint + vuln)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Install libpcap headers
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libpcap-dev
+
+      - name: go vet
+        run: go vet ./...
+
+      - name: Race-enabled tests
+        run: go test -tags all -race -count=1 ./...
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v8
+        with:
+          version: latest
+          args: --build-tags=all
+
+      - name: govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck -tags all ./...
+
+      - name: gosec (untrusted-input paths)
+        run: |
+          go install github.com/securego/gosec/v2/cmd/gosec@latest
+          gosec -tags all ./service/macip/... ./service/macgarden/... ./service/afpfs/macgarden/...
+
+  build-tags:
+    name: Build-tag matrix
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        tags:
+          - ""
+          - "afp"
+          - "afp macgarden"
+          - "afp macip"
+          - "afp macgarden macip"
+          - "afp sqlite_cnid"
+          - "all"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Install libpcap headers
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libpcap-dev
+
+      - name: Build with tags="${{ matrix.tags }}"
+        run: go build -tags "${{ matrix.tags }}" ./...
+
   build:
     name: Build (${{ matrix.os }})
     runs-on: ${{ matrix.os }}

.github/workflows/release-main.yml

@@ -39,34 +39,67 @@ jobs:
           done < <(bash scripts/ci/compute-release-metadata.sh)
 
   build:
-    name: Build And Package (${{ matrix.os }})
+    name: Build And Package (${{ matrix.os }} / ${{ matrix.variant }})
     needs: version
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
         include:
+          # Linux - all
           - os: ubuntu-latest
+            variant: all
             artifact_name: omnitalk-linux
             archive_name: omnitalk-${{ needs.version.outputs.release_tag }}-linux-amd64.tar.gz
             build_script: bash scripts/ci/build.sh
             package_script: bash scripts/ci/package-release.sh
             target_os: linux
             output: out/omnitalk
+          # Linux - router
+          - os: ubuntu-latest
+            variant: router
+            artifact_name: omnitalk-router-linux
+            archive_name: omnitalk-router-${{ needs.version.outputs.release_tag }}-linux-amd64.tar.gz
+            build_script: bash scripts/ci/build.sh
+            package_script: bash scripts/ci/package-release.sh
+            target_os: linux
+            output: out/omnitalk-router
+          # macOS - all
           - os: macos-latest
+            variant: all
             artifact_name: omnitalk-macos
             archive_name: omnitalk-${{ needs.version.outputs.release_tag }}-macos-amd64.zip
             build_script: bash scripts/ci/build.sh
             package_script: bash scripts/ci/package-release.sh
             target_os: macos
             output: out/omnitalk
+          # macOS - router
+          - os: macos-latest
+            variant: router
+            artifact_name: omnitalk-router-macos
+            archive_name: omnitalk-router-${{ needs.version.outputs.release_tag }}-macos-amd64.zip
+            build_script: bash scripts/ci/build.sh
+            package_script: bash scripts/ci/package-release.sh
+            target_os: macos
+            output: out/omnitalk-router
+          # Windows - all
           - os: windows-latest
+            variant: all
             artifact_name: omnitalk-windows
             archive_name: omnitalk-${{ needs.version.outputs.release_tag }}-windows-amd64.zip
             build_script: ./scripts/ci/build.ps1
             package_script: ./scripts/ci/package-release.ps1
             target_os: windows
             output: out/omnitalk.exe
+          # Windows - router
+          - os: windows-latest
+            variant: router
+            artifact_name: omnitalk-router-windows
+            archive_name: omnitalk-router-${{ needs.version.outputs.release_tag }}-windows-amd64.zip
+            build_script: ./scripts/ci/build.ps1
+            package_script: ./scripts/ci/package-release.ps1
+            target_os: windows
+            output: out/omnitalk-router.exe
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -89,6 +122,7 @@ jobs:
           BUILD_VERSION: ${{ needs.version.outputs.build_version }}
           BUILD_COMMIT: ${{ needs.version.outputs.commit_sha }}
           BUILD_DATE: ${{ needs.version.outputs.build_date }}
+          BUILD_VARIANT: ${{ matrix.variant }}
           OUTPUT: ${{ matrix.output }}
         run: ${{ matrix.build_script }}
 
@@ -99,6 +133,7 @@ jobs:
           BUILD_VERSION: ${{ needs.version.outputs.build_version }}
           BUILD_COMMIT: ${{ needs.version.outputs.commit_sha }}
           BUILD_DATE: ${{ needs.version.outputs.build_date }}
+          BUILD_VARIANT: ${{ matrix.variant }}
           OUTPUT: ${{ matrix.output }}
         run: ${{ matrix.build_script }}
 
@@ -109,6 +144,7 @@ jobs:
           TARGET_OS: ${{ matrix.target_os }}
           RELEASE_TAG: ${{ needs.version.outputs.release_tag }}
           BUILD_VERSION: ${{ needs.version.outputs.build_version }}
+          BUILD_VARIANT: ${{ matrix.variant }}
         run: ${{ matrix.package_script }}
 
       - name: Package release (Windows)
@@ -118,6 +154,7 @@ jobs:
           TARGET_OS: ${{ matrix.target_os }}
           RELEASE_TAG: ${{ needs.version.outputs.release_tag }}
           BUILD_VERSION: ${{ needs.version.outputs.build_version }}
+          BUILD_VARIANT: ${{ matrix.variant }}
         run: ${{ matrix.package_script }}
 
       - name: Upload build artifact

.gitignore

@@ -37,3 +37,6 @@ go.work.sum
 # Generated by scripts/ci/build.ps1
 /cmd/omnitalk/resource.syso
 /cmd/omnitalk/versioninfo.json
+
+._htmlcache/
+.macgarden/

.golangci.yml

@@ -0,0 +1,42 @@
+version: "2"
+
+run:
+  timeout: 5m
+  build-tags:
+    - all
+
+linters:
+  default: none
+  enable:
+    - errcheck
+    - errorlint
+    - gocritic
+    - govet
+    - ineffassign
+    - misspell
+    - revive
+    - staticcheck
+    - unused
+
+linters-settings:
+  errorlint:
+    errorf: true
+    asserts: true
+    comparison: true
+  revive:
+    rules:
+      - name: var-naming
+      - name: package-comments
+      - name: exported
+        disabled: true
+  gocritic:
+    disabled-checks:
+      - ifElseChain
+      - singleCaseSwitch
+
+issues:
+  exclude-rules:
+    - path: _test\.go$
+      linters:
+        - errcheck
+        - revive