[REVIEW] CODERABBIT REVIEW

.github/workflows/release.yml

@@ -0,0 +1,151 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+
+concurrency:
+  group: release-main
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: Build and publish release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Select next version
+        id: version
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          git fetch --force --tags
+
+          latest_tag="$(git tag --list 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | head -n 1 || true)"
+          if [[ -z "${latest_tag}" ]]; then
+            latest_tag="v0.0.0"
+          fi
+
+          bump="patch"
+          if [[ -f ".release-bump" ]]; then
+            bump="$(tr '[:upper:]' '[:lower:]' < .release-bump | tr -d '[:space:]')"
+          elif [[ "${latest_tag}" == "v0.0.0" ]]; then
+            bump="minor"
+          else
+            changed_files="$(git diff --name-status "${latest_tag}"..HEAD)"
+            added_go_files="$(printf '%s\n' "${changed_files}" | awk '$1 == "A" && $2 ~ /\.go$/ { print $2 }')"
+            dependency_changes="$(printf '%s\n' "${changed_files}" | awk '$2 == "go.mod" || $2 == "go.sum" { print $2 }')"
+
+            if [[ -n "${added_go_files}" || -n "${dependency_changes}" ]]; then
+              bump="minor"
+            fi
+          fi
+
+          case "${bump}" in
+            major|minor|patch) ;;
+            *)
+              echo "::error::.release-bump must contain major, minor, or patch."
+              exit 1
+              ;;
+          esac
+
+          version="${latest_tag#v}"
+          IFS='.' read -r major minor patch <<< "${version}"
+
+          case "${bump}" in
+            major)
+              major=$((major + 1))
+              minor=0
+              patch=0
+              ;;
+            minor)
+              minor=$((minor + 1))
+              patch=0
+              ;;
+            patch)
+              patch=$((patch + 1))
+              ;;
+          esac
+
+          next_tag="v${major}.${minor}.${patch}"
+
+          if git rev-parse "${next_tag}" >/dev/null 2>&1; then
+            echo "::error::Tag ${next_tag} already exists."
+            exit 1
+          fi
+
+          {
+            echo "latest_tag=${latest_tag}"
+            echo "bump=${bump}"
+            echo "next_tag=${next_tag}"
+          } >> "${GITHUB_OUTPUT}"
+
+      - name: Create release notes
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          latest_tag="${{ steps.version.outputs.latest_tag }}"
+          next_tag="${{ steps.version.outputs.next_tag }}"
+          bump="${{ steps.version.outputs.bump }}"
+
+          mkdir -p dist
+
+          {
+            echo "## ${next_tag}"
+            echo
+            echo "Release type: ${bump}"
+            echo
+
+            echo "### Commits"
+            if [[ "${latest_tag}" == "v0.0.0" ]]; then
+              git log --oneline --no-merges
+            else
+              git log --oneline --no-merges "${latest_tag}"..HEAD
+            fi
+            echo
+
+            echo "### Changed files"
+            if [[ "${latest_tag}" == "v0.0.0" ]]; then
+              git ls-tree -r --name-only HEAD | sed 's/^/A\t/'
+            else
+              git diff --name-status "${latest_tag}"..HEAD
+            fi
+          } > dist/release-notes.md
+
+      - name: Create tag
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          next_tag="${{ steps.version.outputs.next_tag }}"
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "${next_tag}" -m "Release ${next_tag}"
+          git push origin "${next_tag}"
+
+      - name: Release
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --clean --release-notes=dist/release-notes.md
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}

.gitignore

@@ -0,0 +1 @@
+bin/*

.goreleaser.yml

@@ -0,0 +1,63 @@
+version: 2
+
+project_name: malox
+
+before:
+  hooks:
+    - go mod tidy
+
+builds:
+  - id: malox
+    main: ./cmd/malox
+    binary: malox
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - darwin
+      - linux
+      - windows
+    goarch:
+      - amd64
+      - arm64
+    ldflags:
+      - -s -w
+      - -X main.version={{ .Version }}
+      - -X main.commit={{ .Commit }}
+      - -X main.buildDate={{ .Date }}
+
+archives:
+  - id: malox
+    formats:
+      - tar.gz
+    format_overrides:
+      - goos: windows
+        formats:
+          - zip
+    name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+
+checksum:
+  name_template: checksums.txt
+
+snapshot:
+  version_template: "{{ incpatch .Version }}-next"
+
+changelog:
+  disable: true
+
+brews:
+  - name: malox
+    ids:
+      - malox
+    repository:
+      owner: darckorp
+      name: homebrew-tap
+      branch: main
+      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
+    directory: Formula
+    homepage: "https://github.com/darckorp/malox"
+    description: "Fast cross-platform terminal security scanner for open source projects"
+    license: "MIT"
+    install: |
+      bin.install "malox"
+    test: |
+      system "#{bin}/malox", "--version"

.release-bump.example

@@ -0,0 +1 @@
+patch

AGENTS.md

@@ -4,3 +4,5 @@ search internet to verify your implementation and align code with latest code pr
 use docs/go-code-guidelines.md as a reference for code style and best practices.
 always persue towards goal as stated in docs/goal.md while implementing the CLI and project foundation. Ensure that the implementation aligns with the overall vision and objectives of the Malox project.
 always play devil advocate and check if the code you are about to write is the best way to implement the feature or if there are alternative approaches that could be more efficient, maintainable, or scalable. Consider factors such as performance, readability, and ease of maintenance when evaluating different implementation options.
+always run go build, test and code verification, format commands to ensure that the code is free of syntax errors, follows the Go code style guidelines, and passes all tests before finalizing the implementation. This will help maintain code quality and ensure that the implementation is robust and reliable.
+always at the end of an edit, always give me a commit message for changes you have made. The commit message should be concise and descriptive, summarizing the changes made in the code. It should follow the standard format of a commit message, including a brief summary of the changes, followed by a more detailed description if necessary. The commit message should also include any relevant issue numbers or references to related work. This will help maintain a clear and organized commit history, making it easier for other developers to understand the changes made and the context behind them.

docs/goal.md

@@ -200,11 +200,7 @@ Project cache layout:
   project.json
   latest.json
   scans/
-    2026-06-17T12-30-00Z.json
-  indexes/
-    files.jsonl
-    packages.jsonl
-    findings.jsonl
+    2026-06-17T12-30-00Z.json.gz
   node/
     package-inventory.json
     lockfile-inventory.json
@@ -218,6 +214,10 @@ Cache rules:
 - Store every source record with the raw upstream ID and normalized PURL.
 - Never overwrite the last known-good cache until a new cache update is fully
   written and verified.
+- Store scan snapshots as compact gzip-compressed JSON and keep `latest.json` as
+  a small pointer to the latest verified scan.
+- Keep the newest 10 project snapshots by default, allow the retention count to
+  be configured, and always retain at least two snapshots for the default diff.
 - Use atomic writes: write to a temporary file, fsync when practical, then rename.
 - Apply TTLs by source type. Vulnerability and malicious package records should be
   refreshed aggressively; package metadata can be refreshed less often.
@@ -229,9 +229,9 @@ Cache rules:
   project except decoded suspicious payload fragments needed for evidence, and
   only by SHA-256 under `decoded-payloads/`.
 
-Start with content-addressed JSON and JSONL files. Add an embedded key-value store
-later only if the cache becomes too slow; avoid native database dependencies that
-make single-binary distribution harder.
+Start with content-addressed JSON and gzip-compressed project snapshots. Add an
+embedded key-value store later only if the cache becomes too slow; avoid native
+database dependencies that make single-binary distribution harder.
 
 ## Node.js V0 Scope