Unify the test workflow and pin action digests

[davidnewhall]

Summary

• Replace floating action tags with the SHA-pinned xtractr test workflow and codespell.
• Ignore Medias, which is the gortsplib field name, and fix the other codespell hits.
• Match Renovate to the xtractr config.

The branch is cut from main, not from an in-progress feature branch.

Test plan

• go test ./... and codespell pass

Made with Cursor

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical codespell failures and a moderate file-validation issue remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 3 · 1

Open (4)

• Fix existing misspellings before enabling codespell · New
• Fix misspelled assertion text: wiuth · New
• Fix misspelled assertion text: unmarhsalled · New
• Correct unreachable filename validation condition · New

What changed in this PR

This PR standardizes CI with SHA-pinned actions and codespell, aligns Renovate and lint configuration, and refactors Go error handling and tests.

Changes:

• Adds pinned test, lint, and codespell workflow actions.
• Updates golangci-lint and Renovate settings.
• Refactors error handling, file validation, test fixtures, and spelling.

File	Summary
settings.go	Refactors settings error handling.
server/​server.go	Refactors XML error handling and comments.
server/​server_test.go	Renames assertion helper.
securityspy.go	Fixes documentation and error handling.
securityspy_test.go	Renames assertion helper; unresolved codespell findings remain: wiuth (critical, 3 votes) and unmarhsalled on lines 121 and 157 (critical, 3 votes).
schedules.go	Refactors schedule error handling.
schedules_test.go	Renames assertion helper.
ptz.go	Reorders helper and refactors decoding.
internal/​rtspclip/​clip.go	Refactors capture and muxer error handling.
internal/​rtspclip/​clip_test.go	Simplifies AAC test fixtures.
files.go	Refactors file parsing and errors; a moderate (2 votes) file-validation issue remains.
events.go	Refactors event parsing errors.
cameras.go	Refactors camera operation errors.
cameras_types.go	Refactors XML decoding.
cameras_test.go	Renames assertion helper.
.golangci.yml	Updates lint configuration.
.github/​workflows/​codetests.yml	Adds codespell and pins actions; unresolved critical (1 vote) codespell failures remain.
.github/​renovate.json	Aligns Renovate policies.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[qwen-pr-bot]

This second check can never fire: the check above already returns unless len == fileParts. It was dead before this PR too, but you've restructured the block anyway, so might as well drop it.

[qwen-pr-bot]

Approved. Reviewed head 7d1be56 against base 1fd4b32: four commits containing three bundled changes — the unified test workflow with digest-pinned actions (ported from xtractr), the Renovate preset switch, and a tightened lint config with the resulting findings fixed.

Executed validation at 7d1be56 (pod-local, Go 1.26.6, golangci-lint v2.13.0, codespell 2.4.3):

• go test -race -covermode=atomic ./...: all packages pass.
• golangci-lint run with the new .golangci.yml: 0 issues on GOOS linux, darwin, freebsd, windows.
• codespell --skip .git,go.sum --ignore-words-list Medias: clean at head; the same run at base reports 60 hits, the asert/retreived/performes family, all fixed by this PR.
• All four action pins resolve to the advertised tags: checkout v7.0.1, setup-go v7.0.0, actions-codespell v2.4.3, golangci-lint-action v9.3.0 (checking the annotated tag's target commit). The workflow and renovate config are byte-identical to xtractr's except the justified Medias ignore word, and the helpers:pinGitHubActionDigestsToSemver preset exists in renovate.
• Public CI on the head commit: all 9 check runs green.

The code rewrites are all semantics-preserving: the noinlineerr restructures are the auto-fix shape, and the GetFile else-if split behaves identically. Two small notes:

1. The workflow no longer runs on push to main, only on pull requests. Fine if everything goes through PRs, just flagging the coverage delta.
2. securityspy_test.go still carries two pre-existing typos that codespell 2.4.3 doesn't catch: "wiuth" in TestGetServer's message and "unmarhsalled" in TestGetSounds/TestGetScripts.

Also checked while in there: there are no bare type assertions anywhere in the tree, so dropping the explicit check-type-assertions: true from errcheck costs nothing.