.github/workflows/build.yml (4)

22-22: Checkout v5: good; add least-privilege permissions.

Explicitly set minimal permissions for the job.

Example outside this range:

jobs:
  build:
    permissions:
      contents: read

(forge.tourmentine.com)

---

48-55: Codecov v5 switch is correct; set env for tags and prefer OIDC.

• env_vars OS/GO won’t populate unless you export them.
• Use OIDC to avoid secrets not available on PRs from forks.

Apply within this step:

-      - name: Code coverage with codecov
-        uses: codecov/codecov-action@v5
+      - name: Code coverage with codecov
+        uses: codecov/codecov-action@v5
         with:
           env_vars: OS,GO
-          files: ./coverage.txt
+          files: ./coverage.txt
           flags: unittests
           fail_ci_if_error: false
-          verbose: true
-          token: ${{ secrets.CODECOV_TOKEN }}
+          verbose: true
+          use_oidc: true
+        env:
+          OS: ${{ matrix.os }}
+          GO: ${{ matrix.go_version }}

And outside this range (job/workflow level):

permissions:
  id-token: write

(github.com)

---

75-79: Download artifacts: narrow and merge for determinism.

Download only coverage artifacts and merge them to one folder.

-      - name: Download code coverage results
-        uses: actions/download-artifact@v5
+      - name: Download code coverage results
+        uses: actions/download-artifact@v5
+        with:
+          pattern: code-coverage-report-*
+          merge-multiple: true

(github.blog)

---

81-86: Sonar scan v5: OK; consider wiring coverage path.

For Go coverage ingestion, pass the report path (downloads to workspace).

-      - name: Analyze with SonarCloud
-        uses: sonarsource/sonarqube-scan-action@v5
+      - name: Analyze with SonarCloud
+        uses: sonarsource/sonarqube-scan-action@v5
+        with:
+          args: >
+            -Dsonar.go.coverage.reportPaths=**/coverage.txt
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

Note: SONAR_HOST_URL is not required for SonarCloud. (github.com)

github_source.go (3)

44-65: Optional: simplify auth using Client.WithAuthToken (drop oauth2 client plumbing)

go-github v74 exposes Client.WithAuthToken, which removes the need to build a custom oauth2 client. This reduces deps and makes both public and Enterprise flows consistent.

Example refactor (illustrative only):

- hc := newHTTPClient(token)
-
- if config.EnterpriseBaseURL == ""
- {
-   // public (or private) repository on standard GitHub offering
-   client := github.NewClient(hc)
-   return &GitHubSource{ api: client }, nil
- }
+ var client *github.Client
+ if config.EnterpriseBaseURL == "" {
+   client = github.NewClient(nil)
+ } else {
+   u := config.EnterpriseUploadURL
+   if u == "" {
+     u = config.EnterpriseBaseURL
+   }
+   c, err := github.NewEnterpriseClient(config.EnterpriseBaseURL, u, nil)
+   if err != nil {
+     return nil, fmt.Errorf("cannot parse GitHub enterprise URL: %w", err)
+   }
+   client = c
+ }
+ if token != "" {
+   client = client.WithAuthToken(token)
+ }
  return &GitHubSource{
-   api: client,
+   api: client,
  }, nil

Note: if you take this path, remove the oauth2 import and the now-unused newHTTPClient helper.
(github.com)

---

67-88: “ListReleases returns all available releases” — currently only returns first page

To fulfill the comment/contract, paginate through all pages.

- rels, res, err := s.api.Repositories.ListReleases(ctx, owner, repo, nil)
+ opt := &github.ListOptions{PerPage: 100}
+ var relsAll []*github.RepositoryRelease
+ for {
+   rels, res, err := s.api.Repositories.ListReleases(ctx, owner, repo, opt)
+   if err != nil {
+     if res != nil && res.StatusCode == http.StatusNotFound {
+       log.Print("Repository or release not found")
+       return nil, nil
+     }
+     log.Printf("API returned an error response: %s", err)
+     return nil, err
+   }
+   relsAll = append(relsAll, rels...)
+   if res.NextPage == 0 {
+     break
+   }
+   opt.Page = res.NextPage
+ }
- if err != nil {
-   if res != nil && res.StatusCode == http.StatusNotFound {
-     // repository not found or release not found. It's not an error here.
-     log.Print("Repository or release not found")
-     return nil, nil
-   }
-   log.Printf("API returned an error response: %s", err)
-   return nil, err
- }
- releases := make([]SourceRelease, len(rels))
- for i, rel := range rels {
+ releases := make([]SourceRelease, len(relsAll))
+ for i, rel := range relsAll {
   releases[i] = NewGitHubRelease(rel)
 }
 return releases, nil

Pagination approach per upstream docs (ListOptions + NextPage). (github.com)

---

100-107: Add an HTTP timeout when following asset redirects

Using http.DefaultClient risks hanging downloads. Set a bounded timeout.

- client := http.DefaultClient
+ client := &http.Client{Timeout: 60 * time.Second}

Add to imports:

import "time"

gitlab_source.go (2)

88-114: Harden asset download: add timeout and status check

Default client has no timeouts, and non-2xx responses currently flow to callers.

- client := http.DefaultClient
+ client := &http.Client{Timeout: 60 * time.Second}
@@
- response, err := client.Do(req)
+ response, err := client.Do(req)
  if err != nil {
    log.Print(err)
    return nil, err
  }
-
- return response.Body, nil
+ if response.StatusCode < 200 || response.StatusCode >= 300 {
+   // ensure body is closed on error paths
+   _ = response.Body.Close()
+   return nil, fmt.Errorf("download failed: status %d for %s", response.StatusCode, downloadUrl)
+ }
+ return response.Body, nil

Add to imports:

import "time"

---

96-105: Note on GitLab tokened downloads for release links

Some release “links” resolve to uploads URLs that historically didn’t accept PRIVATE-TOKEN for direct download (redirects to sign-in). If you hit 302/404 on private assets, consider storing artifacts in Generic Packages and linking those, which do support token headers reliably.

References: discussion of uploads behavior and a working Packages approach. (gitlab.com, stackoverflow.com, docs.gitlab.com)

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.