Update https://git.quad4.io/actions/setup-go digest to 40f1582

.gitea/workflows/build.yml

@@ -0,0 +1,108 @@
+name: Build and Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Release version (e.g., v1.0.0)'
+        required: true
+        type: string
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: https://git.quad4.io/actions/checkout@a5b3063b1edaa6ba4911c8a1b1d5e1656fba3ea5 # v4
+        with:
+          fetch-depth: 0
+
+      - name: Determine version
+        id: version
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "version=${{ github.event.inputs.version }}" >> $GITHUB_OUTPUT
+          else
+            echo "version=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Setup Node.js
+        uses: https://git.quad4.io/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Setup Task
+        uses: https://git.quad4.io/actions/setup-task@0ab1b2a65bc55236a3bc64cde78f80e20e8885c2 # v1
+        with:
+          version: '3.46.3'
+
+      - name: Setup environment
+        run: task setup
+
+      - name: Install dependencies
+        run: task install:ci
+
+      - name: Build frontend
+        run: task build:frontend
+
+      - name: Setup Go
+        uses: https://git.quad4.io/actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version: '1.25.5'
+
+      - name: Build server binaries
+        run: |
+          task build:backend
+          task build-linux-amd64
+          task build-windows-amd64
+
+      - name: Build desktop Linux
+        run: task desktop-linux
+
+      - name: Build desktop Windows
+        run: task desktop-windows
+
+      - name: Prepare release assets
+        run: |
+          mkdir -p release-assets
+          cp bin/linking-tool-linux-amd64 release-assets/
+          cp bin/linking-tool-windows-amd64.exe release-assets/
+          if [ -f desktop/build/bin/linking-tool ]; then
+            cp desktop/build/bin/linking-tool release-assets/linking-tool-desktop-linux-amd64
+          fi
+          if [ -f desktop/build/bin/linking-tool.exe ]; then
+            cp desktop/build/bin/linking-tool.exe release-assets/linking-tool-desktop-windows-amd64.exe
+          fi
+
+      - name: Download SBOM
+        run: |
+          git fetch origin master:master || true
+          git checkout master -- sbom/ || git checkout ${{ github.sha }} -- sbom/ || true
+          if [ -d sbom ]; then
+            cp sbom/*.json release-assets/ || true
+          fi
+
+      - name: Create Release
+        uses: https://git.quad4.io/actions/gitea-release-action@4875285c0950474efb7ca2df55233c51333eeb74 # v1
+        with:
+          api_url: ${{ secrets.GITEA_API_URL }}
+          gitea_token: ${{ secrets.GITEA_TOKEN }}
+          title: ${{ steps.version.outputs.version }}
+          tag: ${{ steps.version.outputs.version }}
+          body: |
+            Release ${{ steps.version.outputs.version }}
+            
+            ## Assets
+            - Server binaries (Linux AMD64, Windows AMD64)
+            - Desktop applications (Linux AMD64, Windows AMD64)
+            - SBOM files
+          files: release-assets/*
+          draft: false
+          prerelease: false
+

.gitea/workflows/docker.yml

@@ -57,7 +57,7 @@ jobs:
         uses: https://git.quad4.io/actions/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
-          file: ./Dockerfile
+          file: ./docker/Dockerfile
           platforms: linux/amd64,linux/arm64
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}

.gitea/workflows/sbom.yml

@@ -2,8 +2,8 @@ name: Generate SBOM
 
 on:
   push:
-    branches:
-      - '*'
+    tags:
+      - 'v*'
   workflow_dispatch:
 
 jobs:
@@ -14,6 +14,7 @@ jobs:
         uses: https://git.quad4.io/actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 0
+          ref: ${{ github.ref }}
 
       - name: Setup Node.js
         uses: https://git.quad4.io/actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
@@ -53,8 +54,10 @@ jobs:
           git config --global user.name "Gitea Action"
           git config --global user.email "actions@noreply.quad4.io"
           git remote set-url origin https://${{ secrets.GITEA_TOKEN }}@git.quad4.io/${{ github.repository }}.git
+          git fetch origin master
+          git checkout master
           git add sbom/
-          git diff --quiet && git diff --staged --quiet || (git commit -m "Auto-update SBOM [skip ci]" && git push)
+          git diff --quiet && git diff --staged --quiet || (git commit -m "Auto-update SBOM [skip ci]" && git push origin master)
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
 

CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 1.5.1 - 2025-12-29
+
+### Features
+
+- Added HOST environment variable support for configuring server host binding
+
+### Security
+
+- Fixed unhandled error in HTTP response writing (G104)
+- Fixed file write permissions to use more restrictive 0600 instead of 0644 (G306)
+- Fixed potential file inclusion vulnerability by adding path validation in file operations (G304)
+
+### Docker
+
+- Added HOST environment variable to Dockerfile (defaults to 0.0.0.0, make sure to set it properly in production)
+
 ## 1.5.0 - 2025-12-29
 
 ### Features

README.md

@@ -4,7 +4,7 @@ A web linking tool for mapping relationships between entities.
 
 <img src="showcase/linkingtool.png" alt="showcase image" width="900">
 
-Dekstop coming soon...
+Desktop apps for Windows, macOS, and Linux are coming soon...
 
 ## Quick Start
 
@@ -22,7 +22,7 @@ task build
 ./bin/linking-tool --port 8080
 ```
 
-3. Open your browser to `http://localhost:8080`
+3. Open your browser at `http://localhost:8080`
 
 ### Using Docker
 
@@ -30,7 +30,7 @@ task build
 docker run -p 8080:8080 git.quad4.io/quad4-software/linking-tool
 ```
 
-Then open your browser to `http://localhost:8080`
+Then open your browser at `http://localhost:8080`
 
 ## Features
 
@@ -42,7 +42,7 @@ Then open your browser to `http://localhost:8080`
 - Undo/Redo support
 - PWA support (installable, offline-capable)
 - Native desktop app support (via Wails)
-- Single binary lightweight web server
+- Single-binary lightweight web server
 - Support for 32-bit and 64-bit architectures (runs on old Raspberry Pi Zero W)
 
 ## Installation Options
@@ -85,17 +85,52 @@ cd linking-tool
 pnpm install
 ```
 
-### Taskfile
+### Task
 
-The project uses a [Taskfile](https://taskfile.dev/) for all development tasks.
+The project uses [Task](https://taskfile.dev/) for all development tasks.
 
-Common tasks:
+```
+| Task                | Description                               |
+|---------------------|-------------------------------------------|
+| default             | Show available tasks                      |
+| dev                 | Run development servers (Go & SvelteKit)  |
+| build               | Build the single binary web server        |
+| build:frontend      | Build frontend only                       |
+| build:backend       | Build backend binary only                 |
+| package             | Package the application                   |
+| release             | Build binaries for all platforms          |
+| build-linux-amd64   | Build Linux AMD64 binary                  |
+| build-linux-arm64   | Build Linux ARM64 binary                  |
+| build-linux-armv6   | Build Linux ARMv6 binary                  |
+| build-linux-armv7   | Build Linux ARMv7 binary                  |
+| build-windows-amd64 | Build Windows AMD64 binary                |
+| build-darwin-amd64  | Build Darwin AMD64 binary                 |
+| build-darwin-arm64  | Build Darwin ARM64 binary                 |
+| build-freebsd-amd64 | Build FreeBSD AMD64 binary                |
+| docker-build        | Build Docker image                        |
+| docker-run          | Run Docker container                      |
+| docker-builder      | Build and extract binaries using Docker   |
+| podman-build        | Build Podman image                        |
+| podman-run          | Run Podman container                      |
+| podman              | Build and run Podman container            |
+| desktop-build       | Build desktop application                 |
+| desktop-linux       | Build desktop application for Linux       |
+| desktop-windows     | Build desktop application for Windows     |
+| desktop-darwin      | Build desktop application for Darwin      |
+| desktop-dev         | Run desktop app in development mode       |
+| clean               | Clean build artifacts                     |
+| setup               | Setup development environment             |
+| install             | Install dependencies                      |
+| install:ci          | Install dependencies for CI (frozen lock) |
+| preview             | Preview production build                  |
+| check               | Run type checking                         |
+| lint                | Run linter                                |
+| format              | Format code                               |
+| version:minor       | Bump minor version in package.json        |
+| version:major       | Bump major version in package.json        |
 
-```sh
-task dev           # Run development servers (Go & SvelteKit)
-task build         # Build the single binary web server
-task desktop-build # Build the desktop application
-task               # List all available tasks
+example: task dev
+you might to set alias alias task=`go-task`
 ```
 
 ## Contributing

Taskfile.yml

@@ -112,18 +112,43 @@ tasks:
       - docker cp {{.BINARY_NAME}}-temp:/desktop-bin/. {{.BUILD_DIR}}/
       - docker rm {{.BINARY_NAME}}-temp
 
+  podman-build:
+    desc: Build Podman image
+    cmds:
+      - podman build -f docker/Dockerfile -t surveilled .
+
+  podman-run:
+    desc: Run Podman container
+    cmds:
+      - podman run --rm -p 3000:3000 surveilled
+
+  podman:
+    desc: Build and run Podman container
+    deps: [podman-build, podman-run]
+
   desktop-build:
     desc: Build desktop application
     deps: [build]
     cmds:
+      - mkdir -p desktop/frontend_dist
       - rm -rf desktop/frontend_dist/*
       - cp -r build/* desktop/frontend_dist/
       - cd desktop && wails build -s
 
+  desktop-linux:
+    desc: Build desktop application for Linux
+    deps: [build]
+    cmds:
+      - mkdir -p desktop/frontend_dist
+      - rm -rf desktop/frontend_dist/*
+      - cp -r build/* desktop/frontend_dist/
+      - cd desktop && wails build -s -platform linux/amd64
+
   desktop-windows:
     desc: Build desktop application for Windows
     deps: [build]
     cmds:
+      - mkdir -p desktop/frontend_dist
       - rm -rf desktop/frontend_dist/*
       - cp -r build/* desktop/frontend_dist/
       - cd desktop && wails build -s -platform windows/amd64
@@ -132,6 +157,7 @@ tasks:
     desc: Build desktop application for Darwin
     deps: [build]
     cmds:
+      - mkdir -p desktop/frontend_dist
       - rm -rf desktop/frontend_dist/*
       - cp -r build/* desktop/frontend_dist/
       - cd desktop && wails build -s -platform darwin/universal
@@ -140,6 +166,7 @@ tasks:
     desc: Run desktop application in development mode
     deps: [build]
     cmds:
+      - mkdir -p desktop/frontend_dist
       - rm -rf desktop/frontend_dist/*
       - cp -r build/* desktop/frontend_dist/
       - cd desktop && wails dev

desktop/app.go

@@ -6,6 +6,7 @@ import (
 	"net"
 	"net/http"
 	"os"
+	"path/filepath"
 	"time"
 
 	"github.com/wailsapp/wails/v2/pkg/runtime"
@@ -128,7 +129,7 @@ func (a *App) SaveFile(filename string, content string) error {
 		return nil // Cancelled
 	}
 
-	return os.WriteFile(filePath, []byte(content), 0644)
+	return os.WriteFile(filePath, []byte(content), 0600)
 }
 
 // LoadFile shows an open dialog and returns the content of the selected file
@@ -150,10 +151,15 @@ func (a *App) LoadFile() (string, error) {
 		return "", nil // Cancelled
 	}
 
-	content, err := os.ReadFile(filePath)
+	absPath, err := filepath.Abs(filePath)
+	if err != nil {
+		return "", fmt.Errorf("invalid file path: %w", err)
+	}
+	cleanPath := filepath.Clean(absPath)
+
+	content, err := os.ReadFile(cleanPath)
 	if err != nil {
 		return "", err
 	}
 	return string(content), nil
 }
-

desktop/main.go

@@ -50,4 +50,3 @@ func main() {
 		println("Error:", err.Error())
 	}
 }
-

docker/Dockerfile

@@ -26,6 +26,7 @@ RUN apk add --no-cache ca-certificates
 
 EXPOSE 8080
 ENV PORT=8080
+ENV HOST=0.0.0.0
 ENV NODE_ENV=production
 
 USER 65532

flake.lock

@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1766902085,
+        "narHash": "sha256-coBu0ONtFzlwwVBzmjacUQwj3G+lybcZ1oeNSQkgC0M=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "c0b0e0fddf73fd517c3471e546c0df87a42d53f4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,94 @@
+{
+  description = "Quad4 Linking Tool development environment";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { self, nixpkgs, flake-utils }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = import nixpkgs {
+          inherit system;
+        };
+
+        go = pkgs.go_1_25;
+
+        task = pkgs.buildGoModule rec {
+          pname = "task";
+          version = "3.46.3";
+
+          src = pkgs.fetchFromGitHub {
+            owner = "go-task";
+            repo = "task";
+            rev = "v${version}";
+            hash = "sha256-1bS8ZZAcemgRG7PTeGTFfd49T9u6U6CxxrbotwCM15A=";
+          };
+
+          vendorHash = "sha256-Tm0tqureCRwcP5KKDTa9TO1yZ3Px3ulf9/jKQDDTjDw=";
+          subPackages = [ "cmd/task" ];
+
+          doCheck = false;
+
+          meta = with pkgs.lib; {
+            description = "A task runner / simpler Make alternative written in Go";
+            homepage = "https://taskfile.dev/";
+            license = licenses.mit;
+            maintainers = with maintainers; [ ];
+          };
+        };
+
+        wailsSrc = pkgs.fetchFromGitHub {
+          owner = "wailsapp";
+          repo = "wails";
+          rev = "v2.11.0";
+          hash = "sha256-H1Nml2vhCx4IB/CT+kDro5joAw8ewpxoQjDgvqamAr8=";
+        };
+
+        wails = pkgs.buildGoModule rec {
+          pname = "wails";
+          version = "2.11.0";
+
+          src = pkgs.runCommand "${pname}-${version}-src" {} ''
+            cp -r ${wailsSrc}/v2 $out
+            chmod -R +w $out
+          '';
+
+          vendorHash = "sha256-HAIKhMKRTNI4hsm8Hvn5pUhnCTcitRxiw+WkVmxpfiU=";
+          subPackages = [ "cmd/wails" ];
+
+          doCheck = false;
+
+          meta = with pkgs.lib; {
+            description = "Build applications using Go + HTML + CSS + JS";
+            homepage = "https://wails.io/";
+            license = licenses.mit;
+            maintainers = with maintainers; [ ];
+          };
+        };
+      in
+      {
+        devShells.default = pkgs.mkShell {
+          buildInputs = with pkgs; [
+            go
+            task
+            nodejs_20
+            nodePackages.pnpm
+            wails
+            gcc
+            pkg-config
+          ];
+
+          shellHook = ''
+            echo "Quad4 Linking Tool Development Environment"
+            echo "Go version: $(go version)"
+            echo "Task version: $(task --version 2>/dev/null || echo 'installed')"
+            echo "Node version: $(node --version)"
+            echo "pnpm version: $(pnpm --version)"
+            echo "Wails version: $(wails version 2>/dev/null || echo 'installed')"
+          '';
+        };
+      });
+}
+

main.go

@@ -64,7 +64,7 @@ func corsMiddleware(allowedOrigins []string) func(http.HandlerFunc) http.Handler
 
 func main() {
 	frontendPath := flag.String("frontend", "", "Path to custom frontend build directory (overrides embedded assets)")
-	host := flag.String("host", "0.0.0.0", "Host to bind the server to")
+	host := flag.String("host", "127.0.0.1", "Host to bind the server to")
 	port := flag.String("port", "", "Port to listen on (overrides PORT env var)")
 	allowedOriginsStr := flag.String("allowed-origins", os.Getenv("ALLOWED_ORIGINS"), "Comma-separated list of allowed CORS origins")
 
@@ -78,6 +78,10 @@ func main() {
 		}
 	}
 
+	if hostEnv := os.Getenv("HOST"); hostEnv != "" {
+		*host = hostEnv
+	}
+
 	if *port == "" {
 		*port = os.Getenv("PORT")
 		if *port == "" {
@@ -90,7 +94,9 @@ func main() {
 
 	http.HandleFunc("/api/ping", cors(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
-		w.Write([]byte(`{"status":"ok"}`))
+		if _, err := w.Write([]byte(`{"status":"ok"}`)); err != nil {
+			log.Printf("Error writing response: %v", err)
+		}
 	}))
 
 	// Static Assets
@@ -138,4 +144,3 @@ func main() {
 		log.Fatal(err)
 	}
 }
-

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@quad4/linking-tool",
-	"version": "1.5.0",
+	"version": "1.5.1",
 	"license": "BSD-3-Clause",
 	"author": "Quad4",
 	"type": "module",

sbom/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:a79a4fd9-76fa-49d0-8b4c-915a7992028c",
+  "serialNumber": "urn:uuid:f1002335-7033-40d4-8772-e58b021876b5",
   "version": 1,
   "metadata": {
-    "timestamp": "2025-12-29T19:38:07+00:00",
+    "timestamp": "2025-12-30T03:41:16+00:00",
     "tools": {
       "components": [
         {
@@ -20,7 +20,7 @@
       ]
     },
     "component": {
-      "bom-ref": "b0c726c3-2a3e-48d4-8d77-691e4d56a834",
+      "bom-ref": "49c9b545-bb12-4f4f-acb4-f4daefddfb16",
       "type": "application",
       "name": ".",
       "properties": [
@@ -33,7 +33,7 @@
   },
   "components": [
     {
-      "bom-ref": "1cc2fcb0-bc2f-42c8-908b-344a7f95cdde",
+      "bom-ref": "7c9818eb-d1be-4a49-ae6f-8c9409b498f9",
       "type": "application",
       "name": "pnpm-lock.yaml",
       "properties": [
@@ -48,7 +48,7 @@
       ]
     },
     {
-      "bom-ref": "75bdd5fe-e460-45a6-8d4b-8d908c938bcc",
+      "bom-ref": "b40d466a-2d62-4def-9b70-c23b87bd3e9a",
       "type": "application",
       "name": "go.mod",
       "properties": [
@@ -7021,7 +7021,14 @@
   ],
   "dependencies": [
     {
-      "ref": "1cc2fcb0-bc2f-42c8-908b-344a7f95cdde",
+      "ref": "49c9b545-bb12-4f4f-acb4-f4daefddfb16",
+      "dependsOn": [
+        "7c9818eb-d1be-4a49-ae6f-8c9409b498f9",
+        "b40d466a-2d62-4def-9b70-c23b87bd3e9a"
+      ]
+    },
+    {
+      "ref": "7c9818eb-d1be-4a49-ae6f-8c9409b498f9",
       "dependsOn": [
         "pkg:npm/%40eslint/js@9.39.2",
         "pkg:npm/%40sveltejs/adapter-static@3.0.10",
@@ -7046,18 +7053,11 @@
       ]
     },
     {
-      "ref": "75bdd5fe-e460-45a6-8d4b-8d908c938bcc",
+      "ref": "b40d466a-2d62-4def-9b70-c23b87bd3e9a",
       "dependsOn": [
         "pkg:golang/git.quad4.io/quad4-software/linking-tool"
       ]
     },
-    {
-      "ref": "b0c726c3-2a3e-48d4-8d77-691e4d56a834",
-      "dependsOn": [
-        "1cc2fcb0-bc2f-42c8-908b-344a7f95cdde",
-        "75bdd5fe-e460-45a6-8d4b-8d908c938bcc"
-      ]
-    },
     {
       "ref": "pkg:golang/git.quad4.io/quad4-software/linking-tool",
       "dependsOn": [

static/sw.js

@@ -1,4 +1,4 @@
-const CACHE_VERSION = '1.5.0';
+const CACHE_VERSION = '1.5.1';
 const CACHE_NAME = `quad4-linking-tool-${CACHE_VERSION}`;
 const urlsToCache = ['/', '/favicon.svg', '/manifest.json'];