🔒 Fix security vulnerabilities and restore Coveralls integration

.github/workflows/go.yml

@@ -40,9 +40,17 @@ jobs:
     - name: Tests
       run: go test -tags test ./...
 
-    - name: Update coverage
-      run: |
-        go test -tags test -covermode=atomic -coverprofile=coverage.out ./...
+    - name: Generate coverage report
+      run: go test -tags test -covermode=atomic -coverprofile=coverage.out ./...
+      if: ${{ runner.os == 'Linux' && matrix.go-version == '1.23' }}
+
+    - name: Upload coverage to Coveralls
+      uses: coverallsapp/github-action@v2.3.0
+      with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        file: coverage.out
+        format: golang
+        fail-on-error: false
       if: ${{ runner.os == 'Linux' && matrix.go-version == '1.23' }}
 
 

COVERALLS_INTEGRATION_FIX.md

@@ -0,0 +1,147 @@
+# Coveralls Integration Issues and Fix
+
+## Current Issues Identified
+
+### 1. **Missing Upload Step**
+The GitHub Actions workflow generates coverage data (`coverage.out`) but never uploads it to Coveralls.io. The workflow stops after generating the coverage file.
+
+### 2. **Incomplete Integration**
+The current workflow has:
+```yaml
+- name: Update coverage
+  run: |
+    go test -tags test -covermode=atomic -coverprofile=coverage.out ./...
+  if: ${{ runner.os == 'Linux' && matrix.go-version == '1.23' }}
+```
+But there's no step to send this data to Coveralls.
+
+### 3. **Repository Not Enabled on Coveralls**
+The Coveralls page (https://coveralls.io/github/mariow/nicmanager-export?branch=master) appears empty, suggesting the repository hasn't been properly added to Coveralls.io.
+
+### 4. **Outdated Integration Method**
+The integration appears to be from an older era when Go coverage required conversion to LCOV format. Modern Coveralls supports Go coverage natively.
+
+## Modern Solution (2024/2025)
+
+### Step 1: Add Repository to Coveralls.io
+
+1. Go to [Coveralls.io](https://coveralls.io/)
+2. Sign in with GitHub account
+3. Go to [ADD REPOS](https://coveralls.io/repos/new)
+4. Find `mariow/nicmanager-export` and toggle it ON
+5. Note the repo token (if needed for private repos)
+
+### Step 2: Update GitHub Actions Workflow
+
+Replace the current coverage step with a complete Coveralls integration:
+
+```yaml
+- name: Generate coverage report
+  run: go test -tags test -covermode=atomic -coverprofile=coverage.out ./...
+  if: ${{ runner.os == 'Linux' && matrix.go-version == '1.23' }}
+
+- name: Upload coverage to Coveralls
+  uses: coverallsapp/github-action@v2.3.0
+  with:
+    github-token: ${{ secrets.GITHUB_TOKEN }}
+    file: coverage.out
+    format: golang
+  if: ${{ runner.os == 'Linux' && matrix.go-version == '1.23' }}
+```
+
+### Step 3: Add Repository Secret (If Needed)
+
+For public repositories, the `GITHUB_TOKEN` is usually sufficient. For private repositories:
+
+1. Go to repository Settings → Secrets and variables → Actions
+2. Add a new repository secret named `COVERALLS_REPO_TOKEN`
+3. Use the token from Coveralls.io
+4. Update the workflow to use: `github-token: ${{ secrets.COVERALLS_REPO_TOKEN }}`
+
+### Step 4: Complete Updated Workflow
+
+Here's the complete updated workflow section:
+
+```yaml
+- name: Generate coverage report
+  run: go test -tags test -covermode=atomic -coverprofile=coverage.out ./...
+  if: ${{ runner.os == 'Linux' && matrix.go-version == '1.23' }}
+
+- name: Upload coverage to Coveralls
+  uses: coverallsapp/github-action@v2.3.0
+  with:
+    github-token: ${{ secrets.GITHUB_TOKEN }}
+    file: coverage.out
+    format: golang
+    fail-on-error: false
+  if: ${{ runner.os == 'Linux' && matrix.go-version == '1.23' }}
+```
+
+## Key Improvements
+
+### 1. **Native Go Support**
+Modern Coveralls supports Go coverage format directly - no conversion needed.
+
+### 2. **Simplified Configuration**
+- Uses official `coverallsapp/github-action@v2.3.0`
+- Specifies `format: golang` for native Go coverage support
+- Uses built-in `GITHUB_TOKEN` for public repos
+
+### 3. **Error Handling**
+- Added `fail-on-error: false` to prevent CI failures if Coveralls is temporarily unavailable
+
+### 4. **Proper Conditions**
+- Only runs on Linux with Go 1.23 to avoid duplicate uploads
+- Maintains existing conditional logic
+
+## Expected Results After Fix
+
+1. **Coverage Badge**: The badge in README.md will show actual coverage percentage
+2. **PR Comments**: Coveralls will add comments to pull requests showing coverage changes
+3. **Coverage Tracking**: Historical coverage data will be tracked over time
+4. **Notifications**: Optional notifications for coverage changes
+
+## Testing the Fix
+
+1. Apply the workflow changes
+2. Push to master branch
+3. Check GitHub Actions logs for successful Coveralls upload
+4. Verify coverage appears on Coveralls.io
+5. Test with a pull request to see PR comments
+
+## Alternative: Modern Coverage Solutions
+
+If Coveralls continues to have issues, consider modern alternatives:
+
+### Codecov
+```yaml
+- name: Upload coverage to Codecov
+  uses: codecov/codecov-action@v4
+  with:
+    file: coverage.out
+    fail_ci_if_error: false
+```
+
+### GitHub's Built-in Coverage
+Use GitHub's native coverage reporting with PR comments.
+
+## Troubleshooting
+
+### Common Issues:
+1. **"Repository not found"**: Ensure repo is added to Coveralls.io
+2. **"Invalid token"**: Check GITHUB_TOKEN permissions or use COVERALLS_REPO_TOKEN
+3. **"No coverage data"**: Verify coverage.out file is generated correctly
+4. **Badge not updating**: May take a few minutes after successful upload
+
+### Debug Steps:
+1. Check GitHub Actions logs for Coveralls step
+2. Verify coverage.out file exists and contains data
+3. Check Coveralls.io repository page for recent builds
+4. Test with a simple PR to verify integration
+
+## Migration Benefits
+
+- **Simplified maintenance**: No custom scripts or conversions
+- **Better reliability**: Official action with regular updates  
+- **Enhanced features**: PR comments, coverage trends, notifications
+- **Future-proof**: Supported by Coveralls team directly

setup-coveralls.md

@@ -0,0 +1,56 @@
+# Coveralls Setup Instructions
+
+## Quick Setup Steps
+
+### 1. Enable Repository on Coveralls.io
+
+1. **Visit Coveralls**: Go to https://coveralls.io/
+2. **Sign In**: Click "Sign In" and authorize with your GitHub account
+3. **Add Repository**: 
+   - Go to https://coveralls.io/repos/new
+   - Find `mariow/nicmanager-export` in the list
+   - Toggle the switch to **ON** to enable coverage tracking
+4. **Get Token** (if needed):
+   - Click "START UPLOADING COVERAGE" next to your repo
+   - Note the repo token (usually not needed for public repos)
+
+### 2. Verify Integration
+
+The GitHub Actions workflow has been updated to automatically upload coverage data. After the next push to master:
+
+1. **Check Actions**: Go to https://github.com/mariow/nicmanager-export/actions
+2. **Verify Upload**: Look for "Upload coverage to Coveralls" step in the workflow
+3. **Check Coveralls**: Visit https://coveralls.io/github/mariow/nicmanager-export
+4. **Badge Update**: The README badge should show actual coverage percentage
+
+### 3. Test with Pull Request
+
+Create a test PR to verify:
+- Coverage data is uploaded
+- Coveralls adds a comment showing coverage changes
+- Badge reflects current coverage
+
+## Troubleshooting
+
+### If the badge still shows "unknown":
+1. Ensure the repository is enabled on Coveralls.io
+2. Check that at least one successful workflow run has completed
+3. Wait a few minutes for Coveralls to process the data
+
+### If you get "Repository not found" errors:
+1. Double-check the repository is toggled ON at https://coveralls.io/repos/new
+2. Verify the repository name matches exactly: `mariow/nicmanager-export`
+
+### For private repositories:
+1. Get the repo token from Coveralls.io
+2. Add it as a GitHub secret named `COVERALLS_REPO_TOKEN`
+3. Update the workflow to use the token instead of `GITHUB_TOKEN`
+
+## Current Status
+
+✅ **GitHub Actions workflow updated** with proper Coveralls integration  
+✅ **Documentation created** with setup instructions  
+⏳ **Repository needs to be enabled** on Coveralls.io (manual step)  
+⏳ **First coverage upload** will happen on next push to master  
+
+The technical integration is complete - only the Coveralls.io repository enablement remains.