Upgrade to upstream v1.13.4

.github/workflows/binary.yaml

@@ -53,9 +53,9 @@ jobs:
           ref: ${{ inputs.ref }}
 
       - name: Setup Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.24.11
+          go-version: 1.27.2
 
       - name: Resolve the version
         id: resolve
@@ -76,6 +76,8 @@ jobs:
           VERSION: ${{ steps.resolve.outputs.version }}
         run: |
           set -euo pipefail
+          # dist/ is gitignored, so it does not exist in a fresh checkout.
+          mkdir -p dist
           for arch in amd64 arm64; do
             GOARCH="$arch" go build \
               -o "dist/wings_linux_${arch}" \

.github/workflows/codeql.yaml

@@ -29,10 +29,10 @@ jobs:
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@0499de31b99561a6d14a36a5f662c2a54f91beee # v3.29.5
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@0499de31b99561a6d14a36a5f662c2a54f91beee # v3.29.5
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2

.github/workflows/docker.yaml

@@ -92,15 +92,15 @@ jobs:
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push
         id: build
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: ./Dockerfile

.github/workflows/lint.yaml

@@ -0,0 +1,29 @@
+name: Lint
+
+on:
+  push:
+    branches:
+      - develop
+  pull_request:
+    branches:
+      - develop
+
+jobs:
+  golangci-lint:
+    name: golangci-lint
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - name: Code checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: "1.26.9"
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
+        with:
+          version: v2.11.4

.github/workflows/push.yaml

@@ -16,7 +16,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-24.04]
-        go: ["1.24.11", "1.25.5"]
+        go: ["1.26.9", "1.27.2"]
         goos: [linux]
         goarch: [amd64, arm64]
     permissions:
@@ -26,7 +26,7 @@ jobs:
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Setup Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ matrix.go }}
 
@@ -62,15 +62,15 @@ jobs:
           go test -race $(go list ./...)
 
       - name: Upload Release Artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
-        if: ${{ (github.ref == 'refs/heads/develop' || github.event_name == 'pull_request') && matrix.go == '1.24.11' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: ${{ (github.ref == 'refs/heads/develop' || github.event_name == 'pull_request') && matrix.go == '1.27.2' }}
         with:
           name: wings_linux_${{ matrix.goarch }}
           path: dist/wings
 
       - name: Upload Debug Artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
-        if: ${{ (github.ref == 'refs/heads/develop' || github.event_name == 'pull_request') && matrix.go == '1.24.11' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: ${{ (github.ref == 'refs/heads/develop' || github.event_name == 'pull_request') && matrix.go == '1.27.2' }}
         with:
           name: wings_linux_${{ matrix.goarch }}_debug
           path: dist/wings_debug

.github/workflows/release.yaml

@@ -240,7 +240,7 @@ jobs:
       packages: write
     steps:
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.gitignore

@@ -56,3 +56,7 @@ pprof.*
 .claude-flow/
 .hive-mind/
 CLAUDE.md
+
+# Local build artifacts (fork): never commit binaries
+/wings-*
+/dist/

.golangci.yml

@@ -0,0 +1,36 @@
+version: "2"
+
+# Wings only builds for Linux; run with GOOS=linux (see `make lint`) so the
+# _linux/_unix files are type-checked and linted.
+
+linters:
+  # errcheck, govet, ineffassign, staticcheck, unused
+  default: standard
+  enable:
+    - gosec
+  settings:
+    gosec:
+      excludes:
+        - G104 # unhandled errors, already reported by errcheck
+        - G115 # integer overflow on conversion, too noisy for stat/syscall code
+  exclusions:
+    generated: lax
+    presets:
+      - std-error-handling
+    rules:
+      - path: _test\.go
+        linters:
+          - gosec
+      # Explicit embedded-field selectors (e.g. f.File.Seek in a wrapper type)
+      # are kept on purpose.
+      - linters:
+          - staticcheck
+        text: "QF1008:"
+
+formatters:
+  enable:
+    - gofmt
+
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0

BACKUP_PROGRESS_EVENTS.md

@@ -7,13 +7,14 @@ This document describes the new real-time backup progress events available via W
 ### Event Name
 - **Event**: `backup progress`
 - **Type**: Real-time progress updates
-- **Frequency**: ~2 updates per second maximum (intelligent throttling)
+- **Frequency**: up to 4 updates per second (250 ms throttle)
 
 ## Event Structure
 
 ```json
 {
-  "type": "create|restore",
+  "backup_id": "47363ce7-d70a-430e-8e75-6dc87c8d016d",
+  "type": "create|restore|download",
   "percentage": 0-100,
   "bytes_written": 1234567,
   "bytes_total": 10000000
@@ -24,10 +25,11 @@ This document describes the new real-time backup progress events available via W
 
 | Field | Type | Description |
 |-------|------|-------------|
-| `type` | string | Type of operation: `"create"` for backup creation, `"restore"` for backup restoration |
+| `backup_id` | string | UUID of the backup the update belongs to |
+| `type` | string | Type of operation: `"create"` for backup creation, `"restore"` for backup restoration, `"download"` while an S3 backup is downloaded for a restore (sent unthrottled from the download reader) |
 | `percentage` | int | Progress percentage (0-100). For restore operations, this is typically `0` |
-| `bytes_written` | int64 | Number of bytes processed so far |
-| `bytes_total` | int64 | Total bytes to process (for create operations) |
+| `bytes_written` | int64 | Number of bytes processed so far (omitted when 0) |
+| `bytes_total` | int64 | Total bytes to process (omitted when unknown or 0) |
 
 **Special Values:**
 - `percentage: 100` = Operation completed successfully
@@ -200,7 +202,7 @@ function BackupProgressComponent({ websocket }) {
 
 ## Performance Characteristics
 
-- **Update Frequency**: Maximum ~2 updates per second per operation
+- **Update Frequency**: Maximum 4 updates per second per operation (250 ms throttle)
 - **Bandwidth Usage**: ~100 bytes per update
 - **CPU Overhead**: <0.00001% of backup operation time
 - **Memory Usage**: ~80 bytes per active backup operation
@@ -210,7 +212,7 @@ function BackupProgressComponent({ websocket }) {
 ### Throttling Behavior
 - Progress updates are throttled to prevent WebSocket spam
 - Updates only sent when percentage increases by ≥1%
-- Minimum 500ms interval between updates
+- Minimum 250 ms interval between updates
 - No throttling for initial (0%) and final (100%/-1%) updates
 
 ### Reliability