chore: update golangci-lint to v2.12.2 with canonical config

Replace .golangci.yml with the canonical v2-schema config
(default: all minus six disabled linters, lll 88, tests included)
and bump every golangci-lint pin to v2.12.2:

- Dockerfile: golangci/golangci-lint:v2.12.2-alpine (hash-pinned)
- script/bootstrap: GOLANGCI_LINT_VERSION 2.12.2 with new
  linux-amd64/arm64 release-archive sha256 pins

Fix all 747 findings the stricter config surfaces, with no behavior
changes: t.Parallel() throughout the test suite, static sentinel
errors and errors.Is comparisons, checked error returns, context
propagation (contextcheck/noctx), 88-column wrapping, extracted
constants and helpers for goconst/dupl/funlen/cyclop, exhaustive
switch cases replicating existing defaults, and white-box test files
renamed to *_internal_test.go for testpackage. Three
nolint:tagliatelle directives preserve the existing snake_case JSON
wire and on-disk metadata formats.

internal/session/session.go

@@ -107,7 +107,9 @@ func (m *Manager) ValidateSession(r *http.Request) (*Data, error) {
 	}
 
 	var data Data
-	if err := m.sc.Decode(CookieName, cookie.Value, &data); err != nil {
+
+	err = m.sc.Decode(CookieName, cookie.Value, &data)
+	if err != nil {
 		return nil, ErrInvalidSession
 	}
 

internal/session/session_cookie_attributes_test.go

@@ -1,9 +1,11 @@
-package session
+package session_test
 
 import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
+
+	"sneak.berlin/go/pixa/internal/session"
 )
 
 // TestSessionCookieAttributesAlwaysSecure verifies that every cookie
@@ -16,7 +18,9 @@ import (
 // This covers both cookie-writing paths: CreateSession (the login
 // set-cookie path) and ClearSession (the logout delete-cookie path).
 func TestSessionCookieAttributesAlwaysSecure(t *testing.T) {
-	mgr, err := NewManager("test-signing-key-12345")
+	t.Parallel()
+
+	mgr, err := session.NewManager("test-signing-key-12345")
 	if err != nil {
 		t.Fatalf("NewManager() error = %v", err)
 	}
@@ -29,7 +33,9 @@ func TestSessionCookieAttributesAlwaysSecure(t *testing.T) {
 			name: "CreateSession",
 			setCookie: func(t *testing.T, w http.ResponseWriter) {
 				t.Helper()
-				if err := mgr.CreateSession(w); err != nil {
+
+				err := mgr.CreateSession(w)
+				if err != nil {
 					t.Fatalf("CreateSession() error = %v", err)
 				}
 			},
@@ -45,12 +51,15 @@ func TestSessionCookieAttributesAlwaysSecure(t *testing.T) {
 
 	for _, writePath := range writePaths {
 		t.Run(writePath.name, func(t *testing.T) {
+			t.Parallel()
+
 			w := httptest.NewRecorder()
 			writePath.setCookie(t, w)
 
 			var sessionCookie *http.Cookie
+
 			for _, c := range w.Result().Cookies() {
-				if c.Name == CookieName {
+				if c.Name == session.CookieName {
 					sessionCookie = c
 
 					break
@@ -58,7 +67,7 @@ func TestSessionCookieAttributesAlwaysSecure(t *testing.T) {
 			}
 
 			if sessionCookie == nil {
-				t.Fatalf("no cookie named %q was set", CookieName)
+				t.Fatalf("no cookie named %q was set", session.CookieName)
 			}
 
 			t.Logf("cookie attributes: HttpOnly=%v Secure=%v SameSite=%v",

internal/session/session_test.go

@@ -1,45 +1,55 @@
-package session
+package session_test
 
 import (
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 	"time"
+
+	"sneak.berlin/go/pixa/internal/session"
 )
 
 func TestManager_CreateAndValidate(t *testing.T) {
-	mgr, err := NewManager("test-signing-key-12345")
+	t.Parallel()
+
+	mgr, err := session.NewManager("test-signing-key-12345")
 	if err != nil {
 		t.Fatalf("NewManager() error = %v", err)
 	}
 
 	// Create a session
 	w := httptest.NewRecorder()
-	if err := mgr.CreateSession(w); err != nil {
+
+	err = mgr.CreateSession(w)
+	if err != nil {
 		t.Fatalf("CreateSession() error = %v", err)
 	}
 
 	// Extract the cookie from response
 	resp := w.Result()
+
 	cookies := resp.Cookies()
 	if len(cookies) == 0 {
 		t.Fatal("CreateSession() did not set a cookie")
 	}
 
 	var sessionCookie *http.Cookie
+
 	for _, c := range cookies {
-		if c.Name == CookieName {
+		if c.Name == session.CookieName {
 			sessionCookie = c
+
 			break
 		}
 	}
 
 	if sessionCookie == nil {
-		t.Fatalf("CreateSession() did not set cookie named %q", CookieName)
+		t.Fatalf("CreateSession() did not set cookie named %q", session.CookieName)
 	}
 
 	// Validate the session
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
 	req.AddCookie(sessionCookie)
 
 	data, err := mgr.ValidateSession(req)
@@ -57,27 +67,34 @@ func TestManager_CreateAndValidate(t *testing.T) {
 }
 
 func TestManager_ValidateSession_NoCookie(t *testing.T) {
-	mgr, _ := NewManager("test-signing-key-12345")
+	t.Parallel()
 
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	mgr, _ := session.NewManager("test-signing-key-12345")
+
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
 
 	_, err := mgr.ValidateSession(req)
 	if err == nil {
 		t.Error("ValidateSession() should fail with no cookie")
 	}
 
-	if err != ErrNoSession {
-		t.Errorf("ValidateSession() error = %v, want %v", err, ErrNoSession)
+	if !errors.Is(err, session.ErrNoSession) {
+		t.Errorf("ValidateSession() error = %v, want %v", err, session.ErrNoSession)
 	}
 }
 
 func TestManager_ValidateSession_TamperedCookie(t *testing.T) {
-	mgr, _ := NewManager("test-signing-key-12345")
+	t.Parallel()
 
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	mgr, _ := session.NewManager("test-signing-key-12345")
+
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
 	req.AddCookie(&http.Cookie{
-		Name:  CookieName,
-		Value: "tampered-invalid-cookie-value",
+		Name:     session.CookieName,
+		Value:    "tampered-invalid-cookie-value",
+		Secure:   true,
+		HttpOnly: true,
+		SameSite: http.SameSiteStrictMode,
 	})
 
 	_, err := mgr.ValidateSession(req)
@@ -85,30 +102,35 @@ func TestManager_ValidateSession_TamperedCookie(t *testing.T) {
 		t.Error("ValidateSession() should fail with tampered cookie")
 	}
 
-	if err != ErrInvalidSession {
-		t.Errorf("ValidateSession() error = %v, want %v", err, ErrInvalidSession)
+	if !errors.Is(err, session.ErrInvalidSession) {
+		t.Errorf("ValidateSession() error = %v, want %v", err, session.ErrInvalidSession)
 	}
 }
 
 func TestManager_ValidateSession_WrongKey(t *testing.T) {
-	mgr1, _ := NewManager("signing-key-1")
-	mgr2, _ := NewManager("signing-key-2")
+	t.Parallel()
+
+	mgr1, _ := session.NewManager("signing-key-1")
+	mgr2, _ := session.NewManager("signing-key-2")
 
 	// Create session with mgr1
 	w := httptest.NewRecorder()
 	_ = mgr1.CreateSession(w)
 
 	resp := w.Result()
+
 	var sessionCookie *http.Cookie
+
 	for _, c := range resp.Cookies() {
-		if c.Name == CookieName {
+		if c.Name == session.CookieName {
 			sessionCookie = c
+
 			break
 		}
 	}
 
 	// Try to validate with mgr2 (different key)
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
 	req.AddCookie(sessionCookie)
 
 	_, err := mgr2.ValidateSession(req)
@@ -118,7 +140,9 @@ func TestManager_ValidateSession_WrongKey(t *testing.T) {
 }
 
 func TestManager_ClearSession(t *testing.T) {
-	mgr, _ := NewManager("test-signing-key-12345")
+	t.Parallel()
+
+	mgr, _ := session.NewManager("test-signing-key-12345")
 
 	w := httptest.NewRecorder()
 	mgr.ClearSession(w)
@@ -127,9 +151,11 @@ func TestManager_ClearSession(t *testing.T) {
 	cookies := resp.Cookies()
 
 	var sessionCookie *http.Cookie
+
 	for _, c := range cookies {
-		if c.Name == CookieName {
+		if c.Name == session.CookieName {
 			sessionCookie = c
+
 			break
 		}
 	}
@@ -144,10 +170,12 @@ func TestManager_ClearSession(t *testing.T) {
 }
 
 func TestManager_IsAuthenticated(t *testing.T) {
-	mgr, _ := NewManager("test-signing-key-12345")
+	t.Parallel()
+
+	mgr, _ := session.NewManager("test-signing-key-12345")
 
 	// No session - should return false
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
 	if mgr.IsAuthenticated(req) {
 		t.Error("IsAuthenticated() should return false with no session")
 	}
@@ -157,16 +185,19 @@ func TestManager_IsAuthenticated(t *testing.T) {
 	_ = mgr.CreateSession(w)
 
 	resp := w.Result()
+
 	var sessionCookie *http.Cookie
+
 	for _, c := range resp.Cookies() {
-		if c.Name == CookieName {
+		if c.Name == session.CookieName {
 			sessionCookie = c
+
 			break
 		}
 	}
 
 	// With valid session - should return true
-	req = httptest.NewRequest(http.MethodGet, "/", nil)
+	req = httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
 	req.AddCookie(sessionCookie)
 
 	if !mgr.IsAuthenticated(req) {
@@ -175,16 +206,21 @@ func TestManager_IsAuthenticated(t *testing.T) {
 }
 
 func TestManager_CookieAttributes(t *testing.T) {
-	mgr, _ := NewManager("test-key")
+	t.Parallel()
+
+	mgr, _ := session.NewManager("test-key")
 
 	w := httptest.NewRecorder()
 	_ = mgr.CreateSession(w)
 
 	resp := w.Result()
+
 	var sessionCookie *http.Cookie
+
 	for _, c := range resp.Cookies() {
-		if c.Name == CookieName {
+		if c.Name == session.CookieName {
 			sessionCookie = c
+
 			break
 		}
 	}
@@ -198,6 +234,7 @@ func TestManager_CookieAttributes(t *testing.T) {
 	}
 
 	if sessionCookie.SameSite != http.SameSiteStrictMode {
-		t.Errorf("Cookie SameSite = %v, want %v", sessionCookie.SameSite, http.SameSiteStrictMode)
+		t.Errorf("Cookie SameSite = %v, want %v",
+			sessionCookie.SameSite, http.SameSiteStrictMode)
 	}
 }