chore: update golangci-lint to v2.12.2 with canonical config

Replace .golangci.yml with the canonical v2-schema config (default: all minus six disabled linters, lll 88, tests included) and bump every golangci-lint pin to v2.12.2: - Dockerfile: golangci/golangci-lint:v2.12.2-alpine (hash-pinned) - script/bootstrap: GOLANGCI_LINT_VERSION 2.12.2 with new linux-amd64/arm64 release-archive sha256 pins Fix all 747 findings the stricter config surfaces, with no behavior changes: t.Parallel() throughout the test suite, static sentinel errors and errors.Is comparisons, checked error returns, context propagation (contextcheck/noctx), 88-column wrapping, extracted constants and helpers for goconst/dupl/funlen/cyclop, exhaustive switch cases replicating existing defaults, and white-box test files renamed to *_internal_test.go for testpackage. Three nolint:tagliatelle directives preserve the existing snake_case JSON wire and on-disk metadata formats.
2026-08-07 17:10:27 +00:00
parent 5d0b5f864e
commit 23506df609
55 changed files with 2584 additions and 1863 deletions
--- a/internal/allowlist/allowlist_test.go
+++ b/internal/allowlist/allowlist_test.go
@@ -7,104 +7,37 @@ import (
 	"sneak.berlin/go/pixa/internal/allowlist"
 )

-func TestHostAllowList_IsAllowed(t *testing.T) {
-	tests := []struct {
-		name     string
-		patterns []string
-		testURL  string
-		want     bool
-	}{
-		{
-			name:     "exact match",
-			patterns: []string{"cdn.example.com"},
-			testURL:  "https://cdn.example.com/image.jpg",
-			want:     true,
-		},
-		{
-			name:     "exact match case insensitive",
-			patterns: []string{"CDN.Example.COM"},
-			testURL:  "https://cdn.example.com/image.jpg",
-			want:     true,
-		},
-		{
-			name:     "exact match not found",
-			patterns: []string{"cdn.example.com"},
-			testURL:  "https://other.example.com/image.jpg",
-			want:     false,
-		},
-		{
-			name:     "suffix match",
-			patterns: []string{".example.com"},
-			testURL:  "https://cdn.example.com/image.jpg",
-			want:     true,
-		},
-		{
-			name:     "suffix match deep subdomain",
-			patterns: []string{".example.com"},
-			testURL:  "https://cdn.images.example.com/image.jpg",
-			want:     true,
-		},
-		{
-			name:     "suffix match apex domain",
-			patterns: []string{".example.com"},
-			testURL:  "https://example.com/image.jpg",
-			want:     true,
-		},
-		{
-			name:     "suffix match not found",
-			patterns: []string{".example.com"},
-			testURL:  "https://notexample.com/image.jpg",
-			want:     false,
-		},
-		{
-			name:     "suffix match partial not allowed",
-			patterns: []string{".example.com"},
-			testURL:  "https://fakeexample.com/image.jpg",
-			want:     false,
-		},
-		{
-			name:     "multiple patterns",
-			patterns: []string{"cdn.example.com", ".images.org", "static.test.net"},
-			testURL:  "https://photos.images.org/image.jpg",
-			want:     true,
-		},
-		{
-			name:     "empty allow list",
-			patterns: []string{},
-			testURL:  "https://cdn.example.com/image.jpg",
-			want:     false,
-		},
-		{
-			name:     "nil url",
-			patterns: []string{"cdn.example.com"},
-			testURL:  "",
-			want:     false,
-		},
-		{
-			name:     "url with port",
-			patterns: []string{"cdn.example.com"},
-			testURL:  "https://cdn.example.com:443/image.jpg",
-			want:     true,
-		},
-		{
-			name:     "whitespace in patterns",
-			patterns: []string{"  cdn.example.com  ", "  .other.com  "},
-			testURL:  "https://cdn.example.com/image.jpg",
-			want:     true,
-		},
-	}
+const (
+	testExactHost = "cdn.example.com"
+	testImageURL  = "https://cdn.example.com/image.jpg"
+	testSuffix    = ".example.com"
+)
+
+type isAllowedCase struct {
+	name     string
+	patterns []string
+	testURL  string
+	want     bool
+}
+
+func runIsAllowedCases(t *testing.T, tests []isAllowedCase) {
+	t.Helper()

 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			w := allowlist.New(tt.patterns)

 			var u *url.URL
+
 			if tt.testURL != "" {
-				var err error
-				u, err = url.Parse(tt.testURL)
+				parsed, err := url.Parse(tt.testURL)
 				if err != nil {
 					t.Fatalf("failed to parse test URL: %v", err)
 				}
+
+				u = parsed
 			}

 			got := w.IsAllowed(u)
@@ -115,7 +48,101 @@ func TestHostAllowList_IsAllowed(t *testing.T) {
 	}
 }

+func TestHostAllowList_IsAllowed_ExactMatch(t *testing.T) {
+	t.Parallel()
+
+	runIsAllowedCases(t, []isAllowedCase{
+		{
+			name:     "exact match",
+			patterns: []string{testExactHost},
+			testURL:  testImageURL,
+			want:     true,
+		},
+		{
+			name:     "exact match case insensitive",
+			patterns: []string{"CDN.Example.COM"},
+			testURL:  testImageURL,
+			want:     true,
+		},
+		{
+			name:     "exact match not found",
+			patterns: []string{testExactHost},
+			testURL:  "https://other.example.com/image.jpg",
+			want:     false,
+		},
+		{
+			name:     "multiple patterns",
+			patterns: []string{testExactHost, ".images.org", "static.test.net"},
+			testURL:  "https://photos.images.org/image.jpg",
+			want:     true,
+		},
+		{
+			name:     "empty allow list",
+			patterns: []string{},
+			testURL:  testImageURL,
+			want:     false,
+		},
+		{
+			name:     "nil url",
+			patterns: []string{testExactHost},
+			testURL:  "",
+			want:     false,
+		},
+		{
+			name:     "url with port",
+			patterns: []string{testExactHost},
+			testURL:  "https://cdn.example.com:443/image.jpg",
+			want:     true,
+		},
+		{
+			name:     "whitespace in patterns",
+			patterns: []string{"  cdn.example.com  ", "  .other.com  "},
+			testURL:  testImageURL,
+			want:     true,
+		},
+	})
+}
+
+func TestHostAllowList_IsAllowed_SuffixMatch(t *testing.T) {
+	t.Parallel()
+
+	runIsAllowedCases(t, []isAllowedCase{
+		{
+			name:     "suffix match",
+			patterns: []string{testSuffix},
+			testURL:  testImageURL,
+			want:     true,
+		},
+		{
+			name:     "suffix match deep subdomain",
+			patterns: []string{testSuffix},
+			testURL:  "https://cdn.images.example.com/image.jpg",
+			want:     true,
+		},
+		{
+			name:     "suffix match apex domain",
+			patterns: []string{testSuffix},
+			testURL:  "https://example.com/image.jpg",
+			want:     true,
+		},
+		{
+			name:     "suffix match not found",
+			patterns: []string{testSuffix},
+			testURL:  "https://notexample.com/image.jpg",
+			want:     false,
+		},
+		{
+			name:     "suffix match partial not allowed",
+			patterns: []string{testSuffix},
+			testURL:  "https://fakeexample.com/image.jpg",
+			want:     false,
+		},
+	})
+}
+
 func TestHostAllowList_IsEmpty(t *testing.T) {
+	t.Parallel()
+
 	tests := []struct {
 		name     string
 		patterns []string
@@ -145,6 +172,8 @@ func TestHostAllowList_IsEmpty(t *testing.T) {

 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			w := allowlist.New(tt.patterns)
 			if got := w.IsEmpty(); got != tt.want {
 				t.Errorf("IsEmpty() = %v, want %v", got, tt.want)
@@ -154,6 +183,8 @@ func TestHostAllowList_IsEmpty(t *testing.T) {
 }

 func TestHostAllowList_Count(t *testing.T) {
+	t.Parallel()
+
 	tests := []struct {
 		name     string
 		patterns []string
@@ -183,6 +214,8 @@ func TestHostAllowList_Count(t *testing.T) {

 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			w := allowlist.New(tt.patterns)
 			if got := w.Count(); got != tt.want {
 				t.Errorf("Count() = %v, want %v", got, tt.want)