Sync dev to main (#71)

* Add and improve orchestrator tests, refactor config paths

Added new tests for directory recreation and secure memory functions. Refactored config file paths in directory_recreation.go to use package-level variables for easier testing. Improved parsing logic for storage and datastore configs. Enhanced orchestrator_test.go with additional coverage for logging and stats reporting.

* Improve cron migration to preserve valid entries

Refactored migrateLegacyCronEntries to only remove legacy Bash script and outdated binary references, while preserving existing cron entries that already point to the correct Go binary. Updated CLI and installation documentation to clarify that valid cron entries are retained during upgrade.

* Use go.mod for Go version in GitHub workflows

Updated codecov.yml, release.yml, and security-ultimate.yml to use the go-version-file option with go.mod instead of hardcoding the Go version. This ensures workflows automatically use the Go version specified in go.mod for consistency and easier maintenance.

* Refactor TUI prompts for testability and add tests

Introduces indirection for TUI prompt functions in decrypt and restore workflows to enable stubbing in unit tests. Adds comprehensive tests for path selection, overwrite, abort, and bundle preparation in decrypt_tui, and for restore wizard page and prompt flows in restore_tui. Removes unused dummy symbol from embed.go and cleans up runCommand indirection in restore.go.

Author: tis24dev

.github/workflows/codecov.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.25'
+          go-version-file: 'go.mod'
 
       - name: Run tests with coverage
         run: |

.github/workflows/release.yml

@@ -47,7 +47,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25"
+          go-version-file: 'go.mod'
 
       - name: Show Go version
         run: go version

.github/workflows/security-ultimate.yml

@@ -26,10 +26,10 @@ jobs:
       ########################################
       # GO 1.25 — MAIN TOOLCHAIN
       ########################################
-      - name: Set up Go 1.25
+      - name: Set up Go (from go.mod)
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25"
+          go-version-file: 'go.mod'
 
       - name: Show Go version
         run: go version

cmd/proxsave/main.go

@@ -36,7 +36,7 @@ import (
 const (
 	defaultLegacyEnvPath    = "/opt/proxsave/env/backup.env"
 	legacyEnvFallbackPath   = "/opt/proxmox-backup/env/backup.env"
-	goRuntimeMinVersion     = "1.25.4"
+	goRuntimeMinVersion     = "1.25.5"
 	networkPreflightTimeout = 2 * time.Second
 	bytesPerMegabyte  int64 = 1024 * 1024
 	defaultDirPerm          = 0o755

cmd/proxsave/runtime_helpers.go

@@ -700,29 +700,58 @@ func migrateLegacyCronEntries(ctx context.Context, baseDir, execPath string, boo
 
 	updatedLines := make([]string, 0, len(lines)+1)
 
-	containsAny := func(line string) bool {
+	correctPaths := []string{strings.TrimSpace(newCommandToken)}
+	if execPath != "" && execPath != newCommandToken {
+		correctPaths = append(correctPaths, execPath)
+	}
+
+	containsLegacy := func(line string) bool {
 		if strings.Contains(line, "proxmox-backup.sh") {
 			return true
 		}
-		if strings.Contains(line, "proxmox-backup") || strings.Contains(line, "proxsave") {
-			return true
-		}
 		for _, p := range legacyPaths {
-			if strings.Contains(line, p) {
+			if p != "" && strings.Contains(line, p) {
+				return true
+			}
+		}
+		return false
+	}
+
+	containsCorrectPath := func(line string) bool {
+		for _, p := range correctPaths {
+			if p != "" && strings.Contains(line, p) {
 				return true
 			}
 		}
 		return false
 	}
 
+	containsBinaryReference := func(line string) bool {
+		if strings.Contains(line, "proxsave") || strings.Contains(line, "proxmox-backup") {
+			return true
+		}
+		return false
+	}
+
+	hasCurrentEntry := false
+
 	for _, line := range lines {
 		trimmed := strings.TrimSpace(line)
 		if trimmed == "" || strings.HasPrefix(trimmed, "#") {
 			updatedLines = append(updatedLines, line)
 			continue
 		}
-		if containsAny(line) {
-			// Skip all existing proxmox-backup entries (bash or go) to recreate cleanly.
+		if containsLegacy(line) {
+			// Remove cron entries that still reference the legacy Bash script paths.
+			continue
+		}
+		if containsCorrectPath(line) {
+			hasCurrentEntry = true
+			updatedLines = append(updatedLines, line)
+			continue
+		}
+		if containsBinaryReference(line) {
+			// Remove proxsave/proxmox-backup entries that point to outdated binaries.
 			continue
 		}
 		updatedLines = append(updatedLines, line)
@@ -732,17 +761,23 @@ func migrateLegacyCronEntries(ctx context.Context, baseDir, execPath string, boo
 	if schedule == "" {
 		schedule = "0 2 * * *"
 	}
-	// Always append a fresh default entry pointing to the Go binary (or fallback).
-	defaultLine := fmt.Sprintf("%s %s", schedule, newCommandToken)
-	updatedLines = append(updatedLines, defaultLine)
+	// Append a fresh default entry pointing to the Go binary (or fallback) if one doesn't exist already.
+	if !hasCurrentEntry {
+		defaultLine := fmt.Sprintf("%s %s", schedule, newCommandToken)
+		updatedLines = append(updatedLines, defaultLine)
+	}
 
 	newCron := strings.Join(updatedLines, "\n") + "\n"
 	if err := writeCron(newCron); err != nil {
 		bootstrap.Warning("WARNING: Failed to update cron entries: %v", err)
 		return
 	}
 
-	bootstrap.Debug("Recreated cron entry for proxsave at 02:00: %s", newCommandToken)
+	if hasCurrentEntry {
+		bootstrap.Debug("Existing cron entry already targets %s; no changes made.", newCommandToken)
+	} else {
+		bootstrap.Debug("Recreated cron entry for proxsave at schedule %s: %s", schedule, newCommandToken)
+	}
 }
 
 func logBootstrapWarning(bootstrap *logging.BootstrapLogger, format string, args ...interface{}) {

docs/CLI_REFERENCE.md

@@ -182,7 +182,7 @@ Some interactive commands support two interface modes:
 7. Atomically replaces current binary (write to .tmp, then rename)
 8. Updates symlinks in `/usr/local/bin/` (proxsave, proxmox-backup)
 9. Cleans up legacy Bash script symlinks
-10. Migrates cron entries and fixes file permissions
+10. Migrates cron entries (legacy entries are replaced, existing ones using the Go binary are preserved) and fixes file permissions
 
 **Post-upgrade steps**:
 1. Configuration file automatically compatible with new version
@@ -196,7 +196,7 @@ Some interactive commands support two interface modes:
 - **No configuration changes**: `backup.env` is never modified during `--upgrade`
 - **Platform support**: Linux only (amd64, arm64)
 - **Incompatible flags**: Cannot use with `--install` or `--new-install`
-- **Automatic maintenance**: Symlinks, cron, and permissions updated automatically
+- **Automatic maintenance**: Symlinks, cron (without touching entries already pointing to proxsave/proxmox-backup), and permissions updated automatically
 - **Safe replacement**: Old binary is replaced atomically (no backup created)
 - **Separate config upgrade**: Use `--upgrade-config` separately to update configuration
 

docs/INSTALL.md

@@ -93,7 +93,7 @@ The `--upgrade` command:
 - ✅ Atomically replaces current binary
 - ✅ Updates symlinks (`/usr/local/bin/proxsave`, `/usr/local/bin/proxmox-backup`)
 - ✅ Cleans up legacy Bash script symlinks
-- ✅ Migrates cron entries to new binary
+- ✅ Migrates cron entries to new binary while preserving entries that already point to the Go executable
 - ✅ Fixes file permissions
 - ❌ **Does NOT modify** your `backup.env` configuration
 
@@ -416,4 +416,4 @@ Run first backup
 | **Code size** | 20,370 lines | ~3,000 lines Go code |
 | **Memory usage** | Higher (multiple processes) | Lower (single binary) |
 | **Maintenance** | Archived, critical fixes only | Active development |
-| **Compatibility** | Can coexist with Go version | Can coexist with Bash version |
+| **Compatibility** | Can coexist with Go version | Can coexist with Bash version |

embed.go

@@ -68,6 +68,3 @@ func collectEmbeddedDocs() ([]DocAsset, error) {
 	})
 	return assets, nil
 }
-
-// Dummy symbol so that Go Report Card recognizes this package as valid.
-const _goreportcardFix = true

go.mod

@@ -2,7 +2,7 @@ module github.com/tis24dev/proxsave
 
 go 1.25
 
-toolchain go1.25.4
+toolchain go1.25.5
 
 require (
 	filippo.io/age v1.2.1

internal/orchestrator/.backup.lock

@@ -1,3 +1,3 @@
-pid=230863
+pid=324942
 host=pbs1
-time=2025-12-02T16:24:15+01:00
+time=2025-12-02T20:27:27+01:00