ci+docs: staticcheck gate; Go 1.26.4+; document anon-admin + multi-group limits; 3.4.2 changelog

Author: Zakkaus

.github/workflows/ci.yml

@@ -21,6 +21,8 @@ jobs:
           fi
       - name: go vet
         run: go vet ./...
+      - name: staticcheck
+        run: go run honnef.co/go/tools/cmd/staticcheck@latest ./...
       - name: build
         run: go build ./...
       - name: test

CHANGELOG.md

@@ -4,6 +4,30 @@ All notable changes to this project are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/), and this project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [3.4.2] - 2026-06-21
+
+Hardening from a fourth external review (no P0/P1 found; all prior fixes re-verified). P3 polish:
+
+### Fixed
+- **Honest moderation feedback** when a Telegram call fails: `/bc` no longer claims a channel
+  was banned if `BanChatSenderChat` failed (says deleted-but-ban-failed); `/warn`'s limit-kick
+  reports "ban succeeded but unban failed" instead of "re-joinable" when the unban errors.
+- **`/ban` applies the ban before deleting** the replied message (like `/mute`) — a permission
+  failure no longer deletes the offending message while leaving the user un-banned.
+- **`/unmute`** restores the **group's default permissions** (via GetChat) instead of a blanket
+  allow, so a restrictive group isn't over-granted.
+- The fail-open admin alert now states the current mode (fail-open vs fail-closed).
+
+### Hardened
+- Quiz pick/shuffle use **crypto/rand** (Fisher–Yates) instead of `math/rand` — it's an
+  anti-automation control, and this closes the `gosec` G404 finding.
+- A **global outbound HTTP semaphore** (24 concurrent) bounds worst-case network/goroutine
+  pressure under group spam, **without** per-user group rate-limiting (keeps "群里不限次").
+
+### Internal
+- CI now runs **staticcheck**. Docs say **Go 1.26.4+** (was 1.25+, drifted after the toolchain
+  bump). Documented the anonymous-admin and multi-group-different-channel limitations.
+
 ## [3.4.1] - 2026-06-21
 
 ### Changed
@@ -517,6 +541,7 @@ First stable release.
   long polling, no inbound port; ships a hardened `systemd` unit (`DynamicUser` +
   sandboxing) and reads its token from the environment.
 
+[3.4.2]: https://github.com/Zakkaus/gentoo-zh-verify-bot/releases/tag/v3.4.2
 [3.4.1]: https://github.com/Zakkaus/gentoo-zh-verify-bot/releases/tag/v3.4.1
 [3.4.0]: https://github.com/Zakkaus/gentoo-zh-verify-bot/releases/tag/v3.4.0
 [3.3.0]: https://github.com/Zakkaus/gentoo-zh-verify-bot/releases/tag/v3.3.0

CONTRIBUTING.md

@@ -5,7 +5,7 @@ requests are welcome.
 
 ## Building
 
-Requires **Go 1.25+** (the only dependency is [telego](https://github.com/mymmrac/telego)).
+Requires **Go 1.26.4+** (per `go.mod`). The only dependency is [telego](https://github.com/mymmrac/telego).
 
 ```sh
 go build ./...

README.md

@@ -20,6 +20,7 @@ Built for open-source community groups that get flooded with spam-bot join reque
   - **`/ban`** = 封禁 (ban) — **removes** the user; deletes only the replied message; banned for `/bantime` (default permanent, or timed so they can rejoin after).
   - **`/sb`** = 举报并封禁 (report + ban) — like `/ban` but also **deletes all of the user's messages** (spam cleanup).
   - **`/warn`** = strike a user (auto-kick after `warn_limit`, default 3 — counts persist across restarts); **`/clearwarn`** = clear a user's strikes.
+  > **Notes:** admin commands must be sent **non-anonymously** — an anonymous-admin post appears as the group itself, not a user, so it can't pass the admin check. And if a user applies to several guarded groups with **different** required channels, the DM follow-prompt covers the first pending group's channel; sharing one required channel across groups gives the smoothest flow.
 - **Configurable ban duration** (`/bantime`, admins): `/bantime 0` = permanent (default), `/bantime 7d` / `12h` / `30m` / `3600` (seconds). Sets the duration used by `/ban`, `/sb` and the verification auto-ban. Seeded from `ban_seconds`; a runtime change resets to the config value on restart.
 - **Verification anti-spam.** A failed verification (wrong answer / timeout) **declines** the request (never an immediate permanent ban) and the applicant must wait `verify_retry_seconds` (default 180) before re-applying; after `verify_max_fails` failures (default 3) **within a few hours** they are **auto-banned** for the configured duration. Strikes persist across restarts, reset on a successful verification, and **age out** (so a genuine user's isolated mistakes don't accumulate). The auto-ban is only cleared if it actually succeeds — where the bot lacks ban rights, strikes are kept and admins keep getting alerted.
 - **Control / info:** `/start` `/stop` (toggle verification), `/rich` (toggle rich output), `/autodel` (toggle/adjust auto-deletion of lookup answers; default 3 min), `/ping`, `/stats` (today's approved/declined), `/help`.
@@ -121,7 +122,7 @@ The optional **`feed`** object — or **`feeds`**, an array of these objects for
 
 ## Build & run
 
-Requires **Go 1.25+** (required by the telego library).
+Requires **Go 1.26.4+** (matches `go.mod`; the 1.26.4 toolchain carries security fixes).
 
 ```sh
 CGO_ENABLED=0 go build -o /usr/local/bin/gentoo-zh-verify-bot .

README.zh-CN.md

@@ -20,6 +20,7 @@
   - **`/ban`** = 封禁——把人**踢出群**;仅删被回复的那条消息;封禁时长见 `/bantime`(默认永久,或限时则到期可重新加入)。
   - **`/sb`** = 举报并封禁——同 `/ban`,但额外**清除该用户的全部消息**(清理刷屏)。
   - **`/warn`** 警告用户(满 `warn_limit` 次自动踢出,默认 3 次,计数重启不丢)、**`/clearwarn`** 清除某用户的警告。
+  > **注意**:管理指令需**以个人身份**发送 —— 匿名管理员发言会显示为「群」而非用户,过不了管理员校验。另外,若用户同时申请多个守护群且**必关频道不同**,私聊里的关注引导只覆盖第一个待处理群的频道;多个群共用一个必关频道体验最顺。
 - **封禁时长可配**(`/bantime`,管理员):`/bantime 0` 永久(默认)、`/bantime 7d` / `12h` / `30m` / `3600`(秒)。`/ban`、`/sb` 和验证自动封禁都用它;由 `ban_seconds` 初始化,运行时改动重启后回到配置值。
 - **验证防滥用**:验证失败(答错/超时)只**拒绝**该次申请(绝不立即永久封禁),申请人需等 `verify_retry_seconds`(默认 180 秒)才能重新申请;**数小时内**连续失败 `verify_max_fails` 次(默认 3)后**自动封禁**(时长同上)。strike 计数重启不丢、验证成功后清零、且**会随时间衰减**(隔很久的偶发失误不累计)。自动封禁只有真正成功才清零;bot 无封禁权限时保留 strike 并持续告警管理员。
 - **控制 / 信息**:`/start` `/stop`(开关验证)、`/rich`(开关富文本输出)、`/autodel`(开关/调节查询结果自动删除,默认 3 分钟)、`/ping`、`/stats`(今日通过 / 拒绝数)、`/help`。
@@ -105,7 +106,7 @@ GITHUB_TOKEN=ghp_xxx
 | `silent_bugs` | `true` 强制所有 bug 静默。不设时:**未确认(UNCONFIRMED)bug 静默推送**(可能误报),已确认 bug 带通知 |
 
 ### 4. 构建运行
-需要 **Go 1.25+**(telego 要求)。
+需要 **Go 1.26.4+**(与 `go.mod` 一致;1.26.4 含安全修复)。
 
 ```sh
 CGO_ENABLED=0 go build -o /usr/local/bin/gentoo-zh-verify-bot .