Project optimization

[MR5356]

What this PR does / why we need it:
Project optimization
Special notes for your reviewer:

If applicable:

• this PR contains user facing changes (the docs needed label should be applied if so)
• this PR contains unit tests
• this PR has been tested for backwards compatibility

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[gemini-code-assist]

Code Review

This pull request introduces significant security enhancements and infrastructure improvements, including a SafeExecutor to prevent command injection, robust path traversal checks, and URL validation with SSRF protection. The HTTP client was updated with retry logic and resource cleanup, and language-specific environment variable handling was centralized. Feedback focuses on correcting a .gitignore syntax error that broke the bin ignore rule, removing a committed backup file, updating an outdated linter version, and refining logic for Python path construction, error handling in directory creation, and HTTP retry strategies.

[gemini-code-assist]

The PYTHONPATH is constructed with a hardcoded Python version "3.11". This will cause an incorrect environment setup for any other Python version (e.g., 3.9, 3.10, 3.12), as the library path will be wrong. The version should be derived dynamically from the installPath.

	// Extract version from path for PYTHONPATH, e.g. /path/to/3.11.0 -> 3.11
	version := filepath.Base(installPath)
	parts := strings.Split(version, ".")
	majorMinor := "python3" // A sensible fallback
	if len(parts) >= 2 {
		majorMinor = "python" + parts[0] + "." + parts[1]
	}
	libPath := filepath.Join(installPath, "lib", majorMinor, "site-packages")

[gemini-code-assist]

The bin directory is no longer being ignored because the comment was accidentally added to the same line. Each ignore pattern should be on its own line to be effective.

bin
# Ignore docs directory - local design documents only

[gemini-code-assist]

The version of golangci-lint being installed (v2.9.0) is from 2018 and is extremely outdated. The latest version is v1.59.1 as of late 2024. Using such an old version means the project is missing out on years of improvements, new linters, and bug fixes, potentially leaving code quality and correctness issues undetected. Please update to a recent version, or use @latest.

	@command -v golangci-lint >/dev/null 2>&1 || go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest

[gemini-code-assist]

The test-coverage target writes coverage.out and coverage.html to the project root, while the test target writes them to $(OUTPUT_DIR). For consistency and to keep the root directory clean, it's better to use $(OUTPUT_DIR) in this target as well.

test-coverage:
	@echo "===========> Running tests with coverage"
	@$(GO) test -v -race -coverprofile=$(OUTPUT_DIR)/coverage.out -covermode=atomic ./...
	@$(GO) tool cover -html=$(OUTPUT_DIR)/coverage.out -o $(OUTPUT_DIR)/coverage.html

[gemini-code-assist]

Backup files like go.mod.bak should not be committed to version control. Please remove this file from the pull request and add *.bak to your .gitignore file to prevent this from happening in the future.

[gemini-code-assist]

The error returned by ensureDir(path) is being ignored. If creating the directory in the temporary location fails (e.g., due to permissions), the function will still return the path to a non-existent directory, which will likely cause failures in subsequent operations. The error should be handled.

			if err := ensureDir(path); err != nil {
				// If creating the temp dir fails, we are out of options. Return the original fallback.
				return fallback
			}
			return path

[gemini-code-assist]

This path traversal check using strings.Contains(path, "..") is overly restrictive and can lead to false positives. It will reject valid relative paths like foo/../bar, which resolves to bar and does not traverse outside its base. The subsequent check using filepath.Clean is more reliable for detecting actual traversal attempts. Consider removing this initial, broader check to avoid blocking valid paths.

[gemini-code-assist]

The retry logic uses a linear backoff strategy (time.Sleep(time.Duration(i+1) * time.Second)). For handling transient server-side issues and avoiding thundering herd problems, an exponential backoff with jitter is generally a more robust and effective approach. Consider switching to a strategy like time.Sleep(time.Duration(1<<i) * time.Second).

[gemini-code-assist]

The Temporary() method on network errors has been deprecated since Go 1.18. The modern approach is to use errors.Is to check for specific timeout errors (like context.DeadlineExceeded) or to check if an error implements the Timeout() bool method, which you are already doing. You should remove the check for the deprecated Temporary() method.