Modernize: Go 1.26, dependency bumps, CI/CD

[jbpratt]

Brings modbot up to current Go and current GitHub Actions, and fixes a handful of bugs found while reading the code. Three commits, each independently buildable.

Rebased onto master after #64 and the PM-reply/delcommand work landed — see "Rebase notes" at the bottom for how the overlapping changes were merged.

Behavior changes worth knowing about

!drop was always reporting failure. banATuser unmarshalled the response into the *http.Response instead of its error struct, so the call always errored. The ban itself went through — only the reply was broken. Mods will now get a success reply where they previously saw an error. Worth a heads-up so it doesn't read as a regression.

Also:

• !check no longer proceeds on zero-valued data when angelthump returns an empty result
• !roll 2d2 + 100 now applies the modifier — Atoi can't parse "+ 100", so a spaced modifier was silently dropped
• Static commands match longest-prefix-first; previously !foo vs !foobar resolved arbitrarily depending on map iteration order
• SIGTERM exits 0 instead of 1

Fixes

• Six response bodies were never closed, leaking a connection on every !check, !stream, !imdb, !modify and !rename
• renameUser built its JSON body with Sprintf; usernames are now marshalled and path-escaped
• The static command map was read without a lock on every chat message

Modernization

• Drop io/ioutil, math/rand → math/rand/v2, range-over-int, min/max, slices.Backward/Concat, strings.CutPrefix
• One shared http.Client with NewRequestWithContext, replacing a client built per call. A shutdown context is plumbed from main through the parser signature, so in-flight API calls are cancelled on SIGTERM rather than holding up shutdown.
• main split into main/run so log.Fatal no longer skips deferred cleanup; signal.NotifyContext for INT/TERM, SIGHUP still rotates the log
• Static commands moved behind an RWMutex in store.go with temp-file-and-rename writes
• Stream modifiers are *bool with omitempty instead of strings string-replaced back into booleans. Same wire format, now covered by a test.
• New -version flag reporting the commit via debug.ReadBuildInfo

Deps

dggchat 2020 snapshot → 2023-12-06, gorilla/websocket 1.4.2 → 1.5.3. No API changes needed. Prometheus from #64 is untouched.

CI/CD

• CI adds vet, -race + coverage, golangci-lint (pinned v2.12.2), gofmt and go mod tidy -diff checks, and a Dockerfile build so a broken image fails here rather than on deploy. Go version now comes from go.mod instead of being hardcoded in two places. Adds permissions: contents: read and concurrency cancellation.
• CD moves to buildx with GHA layer caching and pushes a sha- tag alongside latest, so a bad deploy can be rolled back to a known image. latest still points where the deploy hook expects. Token scoped to packages: write, deploys grouped so two can't race, and the ssh-action pin moved off a commit from February 2020 to v1.2.5.
• Dockerfile pins its base, uses BuildKit cache mounts, and cross-compiles via TARGETOS/TARGETARCH instead of emulating under qemu. With -trimpath -ldflags="-s -w" the image is ~7MB. EXPOSE 9090 and the HEALTHCHECK from Expose metrics and a health check #64 are preserved.
• Dependabot now weekly and grouped, covering github-actions and docker in addition to gomod

Adds a justfile (just check mirrors CI) and a README section for flags and dev workflow.

Rebase notes

Master and this branch both changed the parser signature. They were merged rather than either side winning:

• Parser signature is now func(ctx context.Context, m message, s *dggchat.Session) — master's message/isPM reply routing plus this branch's context. sendMessageDedupe/sendPublicDedupe and the !m.isPM guard in rename are kept as-is.
• !delcommand and normalizeCommandName are kept as master wrote them, re-pointed at the new store instead of the commands map + mutex.
• Persistence diagnostics from b439eac (absolute path, entry count) moved into store.go, and commandPersistFailures.Inc() now fires from a single place covering both add and delete.
• Three lint findings in the new metrics code are fixed rather than suppressed, since this PR is what introduces the linter: checkHealth and the metrics test now use NewRequestWithContext (noctx), and the test's poll loop closes its response body (bodyclose).
• README had two lines that went stale on master: !addcommand still documented the _ deletion sentinel that b439eac replaced, and the footer still said PM replies come back in public chat. Both corrected, and !delcommand documented.

Verification

go build, go vet, golangci-lint run, go test -race, and go mod tidy -diff all clean on the rebased tree. Container image builds and -version reports the commit. I also ran the pinned golangci-lint release binary against the repo to confirm the CI lint job won't trip over Go 1.26.

Deliberately not done

• log → log/slog: chatlog.log is the production chat log and modbot-rotate keys off it. Changing that output format is a separate decision.
• Non-root container user: worth doing, but hooks/modbot.sh lives outside this repo and I couldn't check what owns the mounted chatlog dir. A wrong guess breaks the deploy silently.

🤖 Generated with Claude Code