feat: update Makefile and README for linting support; add SECURITY.md for vulnerability reporting#2
Merged
trevorphillipscoding merged 6 commits intomainfrom Mar 9, 2026
Merged
Conversation
…ecksum handling; implement tool version parsing and tests
… for vulnerability reporting
There was a problem hiding this comment.
Pull request overview
Adds repository/CI hygiene (linting + dependency automation) and security documentation, while refactoring some CLI parsing and checksum resolution into shared helpers.
Changes:
- Add golangci-lint support via
make lintand a dedicated CI lint job. - Introduce
SECURITY.md, expand README docs (including contributing/security sections), and add Dependabot + EditorConfig. - Refactor checksum resolution into
internal/fetchand extractparseToolVersionintocmd/parse.gowith new tests.
Reviewed changes
Copilot reviewed 11 out of 12 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
internal/state/state_test.go |
Formatting-only adjustment in shim unregister test. |
internal/fetch/checksum.go |
New shared checksum resolution + SHASUMS-style parsing helper. |
internal/fetch/checksum_test.go |
Unit tests for checksum resolution/parsing behaviors. |
cmd/parse.go |
New shared arg parser for <tool> <version> vs <tool>@<version>. |
cmd/parse_test.go |
Unit tests for parseToolVersion. |
cmd/install.go |
Switch install flow to use fetch.ResolveChecksum helper. |
SECURITY.md |
Add vulnerability reporting + security model documentation. |
README.md |
Add CI badge, expand usage/docs, link to security policy and contributing. |
Makefile |
Add lint target and keep coverage helpers documented. |
.github/workflows/ci.yml |
Add lint job to CI workflow. |
.github/dependabot.yml |
Enable Dependabot for Go modules and GitHub Actions. |
.editorconfig |
Add consistent editor defaults (Go tabs, YAML/MD spacing, etc.). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
- Rename FetchBytes to Bytes for consistency in naming. - Update error handling in Download and Bytes functions to use deferred closure for closing response bodies. - Introduce verutil package for version string utilities, replacing the deprecated version package. - Implement resolveToInstalled function to map partial version strings to installed versions. - Update plugins (Go, Node, Python) to utilize verutil for version normalization and comparison. - Modify tests to reflect changes in function names and error handling. - Remove unused ResolvedVersion field from DownloadSpec. - Improve error messages and ensure proper handling of HTTP responses in tests.
- Removed verutil package and replaced its functionality with semver package for version handling. - Updated ResolveVersion function to utilize semver for resolving installed versions. - Modified plugin interfaces to replace LatestVersion with AvailableVersions for better semantic version management. - Adjusted tests to reflect changes in version resolution logic and ensure compatibility with new semver implementation. - Enhanced error handling for version fetching in plugins.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Type of Change
Related Issues
Testing
make test)Checklist
make lintand addressed any issues