Codacy security and code quality findings

[mason-sharp]

• Update Go 1.23.0 to 1.25.8 and pgx/v5 5.5.0 to 5.9.1, resolving
  multiple CVEs in stdlib, x/crypto, and pgx
• Pin third-party GitHub Actions (codecov, goreleaser) to commit SHAs

Test plan

• All existing unit tests pass (make test)
• Linter passes (make lint)
• Build succeeds (make build)
• Verify Codacy re-scan shows resolved findings

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

_{TIP This summary will be updated as you push new changes. Give us feedback}

[coderabbitai]

📝 Walkthrough

Walkthrough

This pull request updates Go tooling and dependencies across build configuration and source code. The workflow configurations pin two GitHub Actions to specific commit SHAs instead of floating version tags. The Go version matrix in the CI workflow is reduced to test against a single Go runtime version. The project's Go toolchain requirement is bumped from version 1.23.0 to 1.25.8, and direct and indirect dependencies are updated, including PostgreSQL-related packages and standard library extensions.

🚥 Pre-merge checks | ✅ 1 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 70.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title 'Codacy security and code quality findings' is vague and does not clearly convey the main changes: Go/dependency updates and GitHub Actions pinning for security.	Consider a more specific title like 'Update Go to 1.25.8 and pgx to 5.9.1, pin GitHub Actions for security' to clearly communicate the primary changes.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly relates to the changeset, detailing Go and pgx version updates to resolve CVEs, GitHub Actions pinning, and a comprehensive test plan.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/SPOC-472/codacy-202604

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/ci.yml (1)

40-41: Good SHA pinning; optional cleanup: remove now-redundant if.

Pinning codecov/codecov-action to a commit SHA is a solid security improvement. Since the matrix only has '1.25', the condition on Line 40 is always true and can be removed for clarity.

Optional simplification

-            - name: Upload coverage
-              if: matrix.go-version == '1.25'
+            - name: Upload coverage
               uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml around lines 40 - 41, The workflow contains a
redundant conditional "if: matrix.go-version == '1.25'" guarding the "uses:
codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238" step; remove
that "if" line so the codecov action runs unconditionally in this job and keep
the SHA-pinned action reference as-is (locate the lines containing the "if:
matrix.go-version" and "uses: codecov/codecov-action@b9fd7d16..." entries to
make the edit).

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 40-41: The workflow contains a redundant conditional "if:
matrix.go-version == '1.25'" guarding the "uses:
codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238" step; remove
that "if" line so the codecov action runs unconditionally in this job and keep
the SHA-pinned action reference as-is (locate the lines containing the "if:
matrix.go-version" and "uses: codecov/codecov-action@b9fd7d16..." entries to
make the edit).

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: edcfb9de-af4f-4827-8987-762c2aa2f5bd

📥 Commits

Reviewing files that changed from the base of the PR and between de3d5b1 and 6fef84e.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

[mason-sharp]

I reverted the code complexity related changes.