Harden untrusted-input handling, refactor check engine, and enforce golangci-lint

[alxxjohn]

Summary

A hardening, refactor, and quality pass over the codebase (branch scanned itself the whole way — build/vet/gofmt clean, 476 tests pass, golangci-lint 0 issues and now CI-blocking). Threat model throughout: codeguard runs in CI on untrusted PRs, so repo config and scanned content are attacker-controllable.

135 files changed, +1027/−617.

Hardening (H1–H10)

• Glob matcher can't panic the scan — MatchPattern uses regexp.Compile + a sync.Map cache and returns false (never panics) on a malformed config glob (runner/support/utils.go).
• base_ref option-injection blocked — validated by ValidateBaseRef (rejects leading -, charset allowlist, keeps the stdin sentinel) before reaching git, with --end-of-options on git diff/show/worktree.
• Git & govulncheck subprocesses now use exec.CommandContext with contained timeouts and bounded (io.LimitReader) output — no more hangs or OOM on a huge diff.
• MCP HTTP server sets ReadHeaderTimeout (+Read/Write/Idle) against Slowloris.
• Panic isolation — each check section runs through safeRun; a panic degrades that section to a warning instead of aborting the whole scan.
• Leak fixes — triage response body, http_post close, MCP ctx cancel; httpretry now drains before close; GitHub comment client threads ctx + a client timeout.
• File I/O — cache/config reads capped; dir/file perms tightened to 0750/0600.

Refactor (Q2/Q3/Q8) — behavior-preserving

• Data-driven section registry replaces the hardcoded dispatch if-ladder (runner/checks/registry.go); all 8 sections covered, ordering + panic-recovery preserved.
• warnFinding builder collapses 21 hand-written FindingInput struct literals (incl. the three per-language performance scanners and AI-quality emitters). Note: the per-language scanners use genuinely different strategies (Go AST / Python indent / TS brace-depth), so no shared line-scanner was forced.
• CLI cleanup — parseFlags helper + named exit-code constants.

Quality & tooling (Q1/Q4/Q5/Q6/Q7)

• golangci-lint wired and now enforced — CI runs the 16-linter v2 config as a blocking step (was go vet only). Fixed a latent bug: the config had been on the v1 issues.exclude-rules schema, silently ignored under golangci-lint v2.
• %w error wrapping; sha1→sha256 for cache/identity keys; removed dead code, redundant conversions, loop-var copies; prealloc where bounded.
• Production gosec findings driven to zero (justified //nolint on intentional subprocess/file/jitter sites).
• Regression tests for ValidateBaseRef and the panic-safe MatchPattern (430 → 476 tests).

Config decisions worth a look

• Revive's documentation/naming style rules (exported, package-comments, unused-parameter) are excluded — the correctness/safety linters gate CI. tests/ is excluded from gosec/errcheck/prealloc/bodyclose (intentional fixtures).
• The //nolint:contextcheck markers in the git layer are deliberate: the contained timeout is the chosen design; full caller-ctx threading is a tracked follow-up (don't remove the nolint without actually threading ctx).

Knowledge captured

.claude/knowledge/architecture-boundaries.md — the section registry + safeRun, the git/base_ref hardening contract (and why the contextcheck nolints are deliberate), and the golangci-lint enforcement + revive exclusions.

Tracked follow-ups (intentionally not in this PR)

1. Doc comments on the public pkg/codeguard API (revive exported currently excluded rather than satisfied).
2. Deeper ctx threading through the git helpers (currently contained timeouts + scoped nolint).

Verification

go build ./... ✓ · go vet ./... ✓ · gofmt -l clean · go test ./... = 476 passed · golangci-lint run = 0 issues.

🤖 Generated with Claude Code