Modernisation plus a defensive pass on the CBOR decoder

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 5
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 5

.github/workflows/generated-pr.yml

@@ -0,0 +1,14 @@
+name: Close Generated PRs
+
+on:
+  schedule:
+    - cron: '0 0 * * *'
+  workflow_dispatch:
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    uses: ipdxco/unified-github-workflows/.github/workflows/reusable-generated-pr.yml@v1

.github/workflows/go-check.yml

@@ -0,0 +1,18 @@
+name: Go Checks
+
+on:
+  pull_request:
+  push:
+    branches: ["master"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event_name == 'push' && github.sha || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  go-check:
+    uses: ipdxco/unified-github-workflows/.github/workflows/go-check.yml@v1.0

.github/workflows/go-fuzz.yml

@@ -0,0 +1,44 @@
+on: [ push, pull_request ]
+name: Go Fuzz
+
+jobs:
+  cbor:
+    strategy:
+      fail-fast: true
+      matrix:
+        target: [ "CborDecode", "CborUnmarshalInterface", "CborRoundtrip" ]
+    runs-on: ubuntu-latest
+    name: Fuzz cbor ${{ matrix.target }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+      - uses: actions/setup-go@v6
+        with:
+          go-version: 1.25.x
+      - name: Go information
+        run: |
+          go version
+          go env
+      - name: Run Fuzzing for 1m
+        run: go test -v -run=^$ -fuzz=Fuzz${{ matrix.target }} -fuzztime=1m -timeout=2m ./cbor/
+  json:
+    strategy:
+      fail-fast: true
+      matrix:
+        target: [ "JSONDecode", "JSONUnmarshalInterface" ]
+    runs-on: ubuntu-latest
+    name: Fuzz json ${{ matrix.target }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+      - uses: actions/setup-go@v6
+        with:
+          go-version: 1.25.x
+      - name: Go information
+        run: |
+          go version
+          go env
+      - name: Run Fuzzing for 1m
+        run: go test -v -run=^$ -fuzz=Fuzz${{ matrix.target }} -fuzztime=1m -timeout=2m ./json/

.github/workflows/go-test.yml

@@ -0,0 +1,20 @@
+name: Go Test
+
+on:
+  pull_request:
+  push:
+    branches: ["master"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event_name == 'push' && github.sha || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  go-test:
+    uses: ipdxco/unified-github-workflows/.github/workflows/go-test.yml@v1.0
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/release-check.yml

@@ -0,0 +1,19 @@
+name: Release Checker
+
+on:
+  pull_request_target:
+    paths: [ 'version.json' ]
+    types: [ opened, synchronize, reopened, labeled, unlabeled ]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  release-check:
+    uses: ipdxco/unified-github-workflows/.github/workflows/release-check.yml@v1.0

.github/workflows/releaser.yml

@@ -0,0 +1,17 @@
+name: Releaser
+
+on:
+  push:
+    paths: [ 'version.json' ]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  releaser:
+    uses: ipdxco/unified-github-workflows/.github/workflows/releaser.yml@v1.0

.github/workflows/stale.yml

@@ -0,0 +1,14 @@
+name: Close Stale Issues
+
+on:
+  schedule:
+    - cron: '0 0 * * *'
+  workflow_dispatch:
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    uses: ipdxco/unified-github-workflows/.github/workflows/reusable-stale-issue.yml@v1

.github/workflows/tagpush.yml

@@ -0,0 +1,18 @@
+name: Tag Push Checker
+
+on:
+  push:
+    tags:
+      - v*
+
+permissions:
+  contents: read
+  issues: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  releaser:
+    uses: ipdxco/unified-github-workflows/.github/workflows/tagpush.yml@v1.0

.gitignore

@@ -1,2 +1,5 @@
 .gopath/pkg
 .gopath/tmp
+
+# Binary built from cmd/refmt when running `go build` at repo root.
+/refmt

bench/framework_test.go

@@ -6,9 +6,8 @@ import (
 	"fmt"
 	"testing"
 
-	wish "github.com/warpfork/go-wish"
-
 	"github.com/polydawn/refmt"
+	wish "github.com/polydawn/refmt/testutil"
 )
 
 func exerciseMarshaller(

cbor/cborCommon.go

@@ -8,13 +8,13 @@ package cbor
 // used for packing either length info or other specific enumerated meanings).
 const (
 	cborMajorUint   byte = 0x00
-	cborMajorNegInt      = 0x20
-	cborMajorBytes       = 0x40
-	cborMajorString      = 0x60
-	cborMajorArray       = 0x80
-	cborMajorMap         = 0xa0
-	cborMajorTag         = 0xc0
-	cborMajorSimple      = 0xe0 // Floating point, "simple" types like bool, etc, are above.
+	cborMajorNegInt byte = 0x20
+	cborMajorBytes  byte = 0x40
+	cborMajorString byte = 0x60
+	cborMajorArray  byte = 0x80
+	cborMajorMap    byte = 0xa0
+	cborMajorTag    byte = 0xc0
+	cborMajorSimple byte = 0xe0 // Floating point, "simple" types like bool, etc, are above.
 )
 
 // Enumeration of some values with single fixed-byte representations.
@@ -23,12 +23,12 @@ const (
 // The prefix indicating a float is also packed into the simple space.
 const (
 	cborSigilFalse     byte = 0xf4
-	cborSigilTrue           = 0xf5
-	cborSigilNil            = 0xf6
-	cborSigilUndefined      = 0xf7
-	cborSigilFloat16        = 0xf9
-	cborSigilFloat32        = 0xfA
-	cborSigilFloat64        = 0xfB
+	cborSigilTrue      byte = 0xf5
+	cborSigilNil       byte = 0xf6
+	cborSigilUndefined byte = 0xf7
+	cborSigilFloat16   byte = 0xf9
+	cborSigilFloat32   byte = 0xfA
+	cborSigilFloat64   byte = 0xfB
 )
 
 // The highest value in the range for bytes, text, arrays, and maps all indicate
@@ -37,8 +37,8 @@ const (
 // indicates termination of stream for all four kinds major types in this mode.
 const (
 	cborSigilIndefiniteBytes  byte = 0x5f
-	cborSigilIndefiniteString      = 0x7f
-	cborSigilIndefiniteArray       = 0x9f
-	cborSigilIndefiniteMap         = 0xbf
-	cborSigilBreak                 = 0xff
+	cborSigilIndefiniteString byte = 0x7f
+	cborSigilIndefiniteArray  byte = 0x9f
+	cborSigilIndefiniteMap    byte = 0xbf
+	cborSigilBreak            byte = 0xff
 )

cbor/cborDecoder.go

@@ -46,8 +46,6 @@ func (d *Decoder) Reset() {
 	d.left = d.left[0:0]
 }
 
-type decoderStep func(tokenSlot *Token) (done bool, err error)
-
 func (d *Decoder) Step(tokenSlot *Token) (done bool, err error) {
 	switch d.phase {
 	case decoderPhase_acceptValue:
@@ -225,23 +223,38 @@ func (d *Decoder) stepHelper_acceptValue(majorByte byte, tokenSlot *Token) (done
 		tokenSlot.Bool = true
 		return true, nil
 	case cborSigilFloat16, cborSigilFloat32, cborSigilFloat64:
+		if d.cfg.RejectNarrowFloat && majorByte != cborSigilFloat64 {
+			return true, ErrNarrowFloat
+		}
 		tokenSlot.Type = TFloat64
 		tokenSlot.Float64, err = d.decodeFloat(majorByte)
 		return true, err
 	case cborSigilIndefiniteBytes:
+		if d.cfg.RejectIndefinite {
+			return true, ErrIndefiniteLength
+		}
 		tokenSlot.Type = TBytes
 		tokenSlot.Bytes, err = d.decodeBytesIndefinite(nil)
 		return true, err
 	case cborSigilIndefiniteString:
+		if d.cfg.RejectIndefinite {
+			return true, ErrIndefiniteLength
+		}
 		tokenSlot.Type = TString
 		tokenSlot.Str, err = d.decodeStringIndefinite()
 		return true, err
 	case cborSigilIndefiniteArray:
+		if d.cfg.RejectIndefinite {
+			return true, ErrIndefiniteLength
+		}
 		tokenSlot.Type = TArrOpen
 		tokenSlot.Length = -1
 		d.pushPhase(decoderPhase_acceptArrValueOrBreak)
 		return false, nil
 	case cborSigilIndefiniteMap:
+		if d.cfg.RejectIndefinite {
+			return true, ErrIndefiniteLength
+		}
 		tokenSlot.Type = TMapOpen
 		tokenSlot.Length = -1
 		d.pushPhase(decoderPhase_acceptMapIndefKey)
@@ -303,7 +316,7 @@ func (d *Decoder) stepHelper_acceptValue(majorByte byte, tokenSlot *Token) (done
 			}
 			return d.stepHelper_acceptValue(majorByte, tokenSlot)
 		default:
-			return true, fmt.Errorf("Invalid majorByte: 0x%x", majorByte)
+			return true, fmt.Errorf("invalid majorByte: 0x%x", majorByte)
 		}
 	}
 }