Merge origin/main into belay_main

Brings forward 16 commits from main while preserving the Belay-specific
EPSS fetching changes that keep the deploy-time validation working.

Adopted from main:
- Migrate justfile/Makefile -> Taskfile.yml (commit f7832d0). Daily
  command is now `task build` instead of `just build`. Same lddflags,
  same outputs. Task additionally tracks sources/generates so rebuilds
  skip when nothing changed.
- Bump go.mod from 1.22.1 -> 1.23.0 (toolchain go1.23.3). Side benefit:
  fixes the macOS Tahoe LC_UUID issue. No more GOTOOLCHAIN override
  needed when building locally on Darwin 25.
- EPSS dataModel + modelDateLayout fixes (commit 3206bd1). Both branches
  independently arrived at v2025.03.14 / "2006-01-02T15:04:05Z", so
  the auto-merge handled these cleanly.
- New CI workflows: test + lint (run-test.yaml, .golangci.yaml).
- Bundle/lcov/validate package improvements.
- New docs: cli-reference.md, examples.md, library-usage.md.
  cli-refactor.md removed.

Preserved from belay_main (Belay webhook integration depends on these):
- defaultEPSSBaseURL = empiricalsecurity.com (NOT main's cyentia.com).
  Cyentia is the old host that returns 403 without a User-Agent.
  Belay_main's commits c6c756a (URL migration) and 85263ec (User-Agent
  header) + 5c690ee (retry logic for today/yesterday fallback) are all
  kept. Dropped main's unused defaultEPSSURL constant.
- .custom-gatecheck.yml with CVE metadata tag examples (eb0f811).
- portage_user permission grants in Dockerfile (3eb6cd3).
- "more intuitive" webhook auth env var name (a630025).

Built and tested locally with `task build` + `task test`. Binary loads
cleanly on macOS Tahoe with no toolchain override.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: Relu808

.github/workflows/run-test.yaml

@@ -1,44 +1,46 @@
-name: CICD
+name: Test and Lint
+
 on:
   pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
 jobs:
-  Describe:
+  lint:
     runs-on: ubuntu-latest
     steps:
-      - run: echo "🎉 The job was automatically triggered by a ${{ github.event_name }} event."
-      - run: echo "🐧 This job is now running on a ${{ runner.os }} server hosted by GitHub!"
-      - run: echo "🔎 The name of your branch is ${{ github.ref }} and your repository is ${{ github.repository }}."
-      - name: Check out repository code
-        uses: actions/checkout@v3
-      - run: echo "💡 The ${{ github.repository }} repository has been cloned to the runner."
-      - run: echo "🖥️ The workflow is now ready to test your code on the runner."
-      - name: List files in the repository
-        run: |
-          ls ${{ github.workspace }}
-      - run: echo "🍏 This job's status is ${{ job.status }}."
-  test-unix:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.23"
+          cache: true
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v8
+      - name: Install Task
+        uses: arduino/setup-task@v2
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Run lint
+        run: task lint
+
+  test:
     strategy:
       fail-fast: false
       matrix:
-        platform:
-          - ubuntu
-          - macOS
-        go:
-          - 21
-    name: '${{ matrix.platform }} | 1.${{ matrix.go }}.x'
-    runs-on: ${{ matrix.platform }}-latest
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        go: ["1.23"]
+    name: "${{ matrix.os }} | ${{ matrix.go }}"
+    runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
         with:
-          go-version: 1.${{ matrix.go }}.x
+          go-version: ${{ matrix.go }}
           cache: true
-      - run: |
-          export GOBIN=$HOME/go/bin
-          case "${{ matrix.go }}" in
-            14|15) _version='';;
-            *) _version='@latest';;
-          esac
-          go install github.com/kyoh86/richgo"${_version}"
-          go install github.com/mitchellh/gox"${_version}"
-      - run: RICHGO_FORCE_COLOR=1 PATH=$HOME/go/bin/:$PATH make test
+      - name: Install Task
+        uses: arduino/setup-task@v2
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Run tests
+        run: task test

.gitignore

@@ -4,3 +4,4 @@ book/
 cover.cov
 artifacts/
 .env.local
+.task/

.golangci.yaml

@@ -1,7 +1 @@
-linters:
-  enable:
-    - tagalign
-    - gofumpt
-    - gosimple
-    - govet
-    - ineffassign
+version: "2"

CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [UNRELEASED]
 
+## [0.9.3] - 2026-03-21
+
+ * Merged upstream main
+ * Minor build task fix
+
+## [0.9.2] - 2025-03-29
+
+ * Enabled portage code scan
+ * Switch to just recording the default (origin) remote URL, instead of 'owner'
+ * added the owner or user of the submission so it can be validated against the jwt git info on the belay side
+ * added logging for git context.  Added config files for running portage on gatecheck.
+
 ## [0.9.1] - 2025-02-14
 
 * portage config cleanup
@@ -18,11 +30,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * added logging for git context. Added config files for running portage on gatecheck. (#5)
 * Improved Bundle Management (#4)
 
+## [0.8.1] - 2025-04-09
+
+### Fixed
+
+- Updated EPSS schema to work with 3.14.2025
+
 ## [0.8.0] - 2024-10-23
 
 * Fixed a bug where validation failures were not resulting in a non-zero exit code
 * Renamed the --file / -f CLI argument to --config / -f for consistency with other tools
-* improvements to validate output  
+* improvements to validate output
    These "improvements" are short term hacks. There is a need for a fundamental
    overhaul of how output is generated to improve usability
 * Implemented code coverage support.

Makefile

@@ -3,7 +3,6 @@
 [![Go Reference](https://pkg.go.dev/badge/github.com/gatecheckdev/gatecheck.svg)](https://pkg.go.dev/github.com/gatecheckdev/gatecheck)
 [![Go Report Card](https://goreportcard.com/badge/github.com/gatecheckdev/gatecheck)](https://goreportcard.com/report/github.com/gatecheckdev/gatecheck)
 
-
 ![Gatecheck Logo](https://static.gatecheck.dev/gatecheck-logo-splash-dark.png)
 
 Gatecheck automates report validation in a CI/CD Pipeline by comparing security findings to pre-determined thresholds.

README.md

@@ -4,12 +4,11 @@ Releasing is done by maintainers with permissions to bypass the PR only rule.
 By pushing a tag to the main repository, the release action is triggered which
 packages the app and releases it to the GitHub UI.
 
-1. Run `just upgrade` to update dependencies and tidy modules
-1. Run `just test` to make sure unit testing still passes after upgrading
+1. Run `task upgrade` to update dependencies and tidy modules
+1. Run `task test` to make sure unit testing still passes after upgrading
 1. Commit the changes `git commit -am "chore: upgrade dependencies"`
 1. Update CHANGELOG.md
-1. Release commit (optional) `git commit -m "release: vx.x.x" && git push`
-1. Wait for unit testing action to pass `gh run watch`
+1. Release commit (optional) `git commit -m "release: vx.x.x && git push`
 1. Release tag `git tag -s -a vX.X.X -m "Release version X.X.X"`
 1. git push tag `git push vX.X.X`
 

RELEASE.md

@@ -0,0 +1,118 @@
+version: "3"
+
+env:
+  INSTALL_DIR:
+    sh: "echo ${INSTALL_DIR:-/usr/local/bin}"
+  IMAGE_TAG: "gatecheck:latest"
+
+tasks:
+  build:
+    desc: "Build the gatecheck binary"
+    vars:
+      BUILD_DATE: '{{dateInZone "2006-01-02T15:04:05Z" now "UTC"}}'
+      CLI_VERSION:
+        sh: git describe --tags || git rev-parse --short HEAD || "v0.0.0-unknown"
+      GIT_COMMIT:
+        sh: git rev-parse HEAD
+      GIT_DESCRIPTION:
+        sh: git log -1 --pretty=%B | sed "s/'//g"
+    cmds:
+      - mkdir -p bin
+      - go build -ldflags="-X 'main.cliVersion={{.CLI_VERSION}}' -X 'main.gitCommit={{.GIT_COMMIT}}' -X 'main.buildDate={{.BUILD_DATE}}' -X 'main.gitDescription={{.GIT_DESCRIPTION}}'" -o ./bin ./cmd/gatecheck
+    sources:
+      - cmd/**/*
+      - pkg/**/*
+      - go.*
+    generates:
+      - bin/gatecheck
+
+  install:
+    desc: "Install the gatecheck binary"
+    prompt: 'Install gatecheck binary to {{joinPath .INSTALL_DIR "gatecheck"}} ...Continue?'
+    deps:
+      - build
+    cmds:
+      - cp ./bin/gatecheck {{joinPath .INSTALL_DIR "gatecheck"}}
+    sources:
+      - ./bin/gatecheck
+    generates:
+      - '{{joinPath .INSTALL_DIR "gatecheck"}}'
+
+  uninstall:
+    desc: "Uninstall the gatecheck binary"
+    prompt: 'Will remove binary {{joinPath .INSTALL_DIR "gatecheck"}}'
+    cmds:
+      - rm '{{joinPath .INSTALL_DIR "gatecheck"}}'
+
+  test:
+    desc: "Run unit tests with coverage"
+    cmds:
+      - go test -cover ./...
+
+  lint:
+    desc: "Run golangci-lint in view-only mode"
+    cmds:
+      - golangci-lint run 
+
+  fix:
+    desc: "Fix linting errors and format code"
+    cmds:
+      - golangci-lint run --fix
+
+  format:
+    desc: "Check code formatting"
+    cmds:
+      - |
+        if [ -n "$(gofmt -l .)" ]; then
+          gofmt -d .
+          exit 1
+        fi
+
+  coverage:
+    desc: "Generate test coverage"
+    cmds:
+      - go test -coverprofile=coverage.out ./...
+
+  open-coverage:
+    desc: "Open coverage report in browser"
+    deps: [coverage]
+    cmds:
+      - go tool cover -html=coverage.out
+
+  dependencies:
+    desc: "Download dependencies"
+    cmds:
+      - go mod download
+
+  upgrade:
+    desc: "Upgrade package dependencies"
+    preconditions:
+      - sh: git diff --quiet && git diff --cached --quiet
+        msg: "Repository is dirty, commit changes before upgrading."
+    cmds:
+      - go get -u ./...
+      - go mod tidy
+
+  serve-docs:
+    desc: "Serve documentation locally"
+    cmds:
+      - mdbook serve
+
+  all:
+    desc: "Run format, test, and build"
+    deps: [format, test, build]
+
+  release-snapshot:
+    desc: "Create a snapshot release"
+    cmds:
+      - goreleaser release --snapshot --rm-dist
+
+  release:
+    desc: "Create a release"
+    cmds:
+      - goreleaser release --rm-dist
+
+  clean:
+    desc: "Clean up build artifacts"
+    cmds:
+      - rm -rf ./bin coverage.out

Taskfile.yml

@@ -13,32 +13,32 @@ import (
 var (
 	metadataFlagUsage       = "flag_usage"
 	metadataFieldType       = "field_type"
-	metadataRequired        = "required"
 	metadataActionInputName = "action_input_name"
+	// metadataRequired        = "required"
 )
 
 type metaConfig struct {
-	BundleTag          configkit.MetaField
-	EPSSURL            configkit.MetaField
-	KEVURL             configkit.MetaField
-	EPSSFilename       configkit.MetaField
-	KEVFilename        configkit.MetaField
-	Verbose            configkit.MetaField
-	Silent             configkit.MetaField
-	ConfigFilename     configkit.MetaField
-	Audit              configkit.MetaField
-	BundleTagValue     []string
-	bundleFile         *os.File
-	targetFile         *os.File
-	epssFile           *os.File
-	kevFile            *os.File
-	listSrcReader      io.Reader
-	listSrcName        string
-	listFormat         string
-	listAll            bool
-	configOutputWriter io.Writer
-	configOutputFormat string
-	gatecheckConfig    *gatecheck.Config
+	BundleTag       configkit.MetaField
+	EPSSURL         configkit.MetaField
+	KEVURL          configkit.MetaField
+	EPSSFilename    configkit.MetaField
+	KEVFilename     configkit.MetaField
+	Verbose         configkit.MetaField
+	Silent          configkit.MetaField
+	ConfigFilename  configkit.MetaField
+	Audit           configkit.MetaField
+	BundleTagValue  []string
+	bundleFile      *os.File
+	targetFile      *os.File
+	epssFile        *os.File
+	kevFile         *os.File
+	listSrcReader   io.Reader
+	listSrcName     string
+	listFormat      string
+	gatecheckConfig *gatecheck.Config
+	// listAll            bool
+	// configOutputWriter io.Writer
+	// configOutputFormat string
 }
 
 var RuntimeConfig = metaConfig{

cmd/cli-config.go

@@ -17,9 +17,9 @@ import (
 
 const (
 	exitSystemFail     int = -1
-	exitOk                 = 0
-	exitValidationFail     = 1
-	exitFileAccessFail     = 2
+	exitOk             int = 0
+	exitValidationFail int = 1
+	exitFileAccessFail int = 2
 )
 
 // GatecheckVersion see CHANGELOG.md
@@ -55,7 +55,7 @@ func run() int {
 	command := cmd.NewGatecheckCommand()
 
 	err := command.Execute()
-	if errors.Is(gatecheck.ErrValidationFailure, err) {
+	if errors.Is(err, gatecheck.ErrValidationFailure) {
 		return exitValidationFail
 	}
 	if err != nil {