chore: update golangci-lint to v2.12.2 with canonical config (#54)

Canonical v2-schema `.golangci.yml`, golangci-lint pins bumped to v2.12.2 in `Dockerfile` and `script/bootstrap`, and the tree brought to `0 issues.` under it.

Three behaviour deltas: `Cache.StoreVariant` takes a context (cancelled requests skip the accounting row, recovered by reconciliation); `MetadataStorage.Store` no longer leaks `.tmp-*.json` on Write/Close/Rename failure (dead-defer bug fix); the `signing_key` too-short error text gained a `value too short:` prefix.

Eviction-loop context cancellation deferred to #102.

internal/imgcache/eviction.go

@@ -2,6 +2,7 @@ package imgcache
 
 import (
 	"context"
+	"database/sql"
 	"encoding/json"
 	"fmt"
 	"io/fs"
@@ -130,7 +131,8 @@ func (c *Cache) evictBatch(ctx context.Context, excessBytes int64) (int64, error
 			break
 		}
 
-		if err := c.evictCandidate(ctx, candidate); err != nil {
+		err := c.evictCandidate(ctx, candidate)
+		if err != nil {
 			c.log.Warn("failed to evict cache entry",
 				"cache_key", candidate.cacheKey,
 				"content_hash", candidate.contentHash,
@@ -209,7 +211,9 @@ func (c *Cache) variantCandidates(ctx context.Context) ([]evictionCandidate, err
 		candidate := evictionCandidate{isVariant: true}
 
 		var key string
-		if err := rows.Scan(&key, &candidate.sizeBytes, &candidate.lastAccessedAt); err != nil {
+
+		err := rows.Scan(&key, &candidate.sizeBytes, &candidate.lastAccessedAt)
+		if err != nil {
 			return nil, fmt.Errorf("failed to scan variant candidate: %w", err)
 		}
 
@@ -217,7 +221,8 @@ func (c *Cache) variantCandidates(ctx context.Context) ([]evictionCandidate, err
 		candidates = append(candidates, candidate)
 	}
 
-	if err := rows.Err(); err != nil {
+	err = rows.Err()
+	if err != nil {
 		return nil, fmt.Errorf("variant candidate iteration failed: %w", err)
 	}
 
@@ -246,7 +251,9 @@ func (c *Cache) sourceCandidates(ctx context.Context) ([]evictionCandidate, erro
 		var candidate evictionCandidate
 
 		var hash string
-		if err := rows.Scan(&hash, &candidate.sizeBytes, &candidate.lastAccessedAt); err != nil {
+
+		err := rows.Scan(&hash, &candidate.sizeBytes, &candidate.lastAccessedAt)
+		if err != nil {
 			return nil, fmt.Errorf("failed to scan source candidate: %w", err)
 		}
 
@@ -254,7 +261,8 @@ func (c *Cache) sourceCandidates(ctx context.Context) ([]evictionCandidate, erro
 		candidates = append(candidates, candidate)
 	}
 
-	if err := rows.Err(); err != nil {
+	err = rows.Err()
+	if err != nil {
 		return nil, fmt.Errorf("source candidate iteration failed: %w", err)
 	}
 
@@ -271,7 +279,8 @@ func (c *Cache) evictVariant(ctx context.Context, cacheKey VariantKey) error {
 		return fmt.Errorf("failed to delete variant accounting row: %w", err)
 	}
 
-	if err := c.variants.DeleteWithMeta(cacheKey); err != nil {
+	err = c.variants.DeleteWithMeta(cacheKey)
+	if err != nil {
 		return err
 	}
 
@@ -315,17 +324,20 @@ func (c *Cache) evictSourceBlob(ctx context.Context, contentHash ContentHash) er
 
 	defer func() { _ = tx.Rollback() }()
 
-	if _, err := tx.ExecContext(ctx,
-		`DELETE FROM source_metadata WHERE content_hash = ?`, string(contentHash)); err != nil {
+	_, err = tx.ExecContext(ctx,
+		`DELETE FROM source_metadata WHERE content_hash = ?`, string(contentHash))
+	if err != nil {
 		return fmt.Errorf("failed to delete source metadata rows: %w", err)
 	}
 
-	if _, err := tx.ExecContext(ctx,
-		`DELETE FROM source_content WHERE content_hash = ?`, string(contentHash)); err != nil {
+	_, err = tx.ExecContext(ctx,
+		`DELETE FROM source_content WHERE content_hash = ?`, string(contentHash))
+	if err != nil {
 		return fmt.Errorf("failed to delete source content row: %w", err)
 	}
 
-	if err := tx.Commit(); err != nil {
+	err = tx.Commit()
+	if err != nil {
 		return fmt.Errorf("failed to commit eviction transaction: %w", err)
 	}
 
@@ -335,13 +347,15 @@ func (c *Cache) evictSourceBlob(ctx context.Context, contentHash ContentHash) er
 
 	// Only after the rows are gone may the files be removed.
 	for _, reference := range references {
-		if err := c.srcMetadata.Delete(reference.host, reference.pathHash); err != nil {
+		err := c.srcMetadata.Delete(reference.host, reference.pathHash)
+		if err != nil {
 			c.log.Warn("failed to delete metadata sidecar",
 				"host", reference.host, "path_hash", reference.pathHash, "error", err)
 		}
 	}
 
-	if err := c.srcContent.Delete(contentHash); err != nil {
+	err = c.srcContent.Delete(contentHash)
+	if err != nil {
 		return err
 	}
 
@@ -368,7 +382,9 @@ func (c *Cache) sourceReferences(
 		var reference sourceReference
 
 		var pathHash string
-		if err := rows.Scan(&reference.host, &pathHash); err != nil {
+
+		err := rows.Scan(&reference.host, &pathHash)
+		if err != nil {
 			return nil, fmt.Errorf("failed to scan source reference: %w", err)
 		}
 
@@ -376,7 +392,8 @@ func (c *Cache) sourceReferences(
 		references = append(references, reference)
 	}
 
-	if err := rows.Err(); err != nil {
+	err = rows.Err()
+	if err != nil {
 		return nil, fmt.Errorf("source reference iteration failed: %w", err)
 	}
 
@@ -465,7 +482,8 @@ func (c *Cache) evictionLoop(interval time.Duration) {
 // runEvictionPass runs one eviction pass, logging failures instead of
 // propagating them (the loop must keep running).
 func (c *Cache) runEvictionPass(ctx context.Context) {
-	if err := c.EvictToLimit(ctx); err != nil {
+	err := c.EvictToLimit(ctx)
+	if err != nil {
 		c.log.Warn("cache eviction pass failed", "error", err)
 	}
 }
@@ -473,7 +491,8 @@ func (c *Cache) runEvictionPass(ctx context.Context) {
 // runReconciliationPass runs one reconciliation pass, logging failures
 // instead of propagating them (the loop must keep running).
 func (c *Cache) runReconciliationPass(ctx context.Context) {
-	if err := c.reconcileAccounting(ctx); err != nil {
+	err := c.reconcileAccounting(ctx)
+	if err != nil {
 		c.log.Warn("cache accounting reconciliation failed", "error", err)
 	}
 }
@@ -494,19 +513,23 @@ func (c *Cache) reconcileAccounting(ctx context.Context) error {
 		return nil
 	}
 
-	if err := c.reconcileVariantFiles(ctx); err != nil {
+	err := c.reconcileVariantFiles(ctx)
+	if err != nil {
 		return err
 	}
 
-	if err := c.reconcileVariantRows(ctx); err != nil {
+	err = c.reconcileVariantRows(ctx)
+	if err != nil {
 		return err
 	}
 
-	if err := c.reconcileSourceFiles(ctx); err != nil {
+	err = c.reconcileSourceFiles(ctx)
+	if err != nil {
 		return err
 	}
 
-	if err := c.reconcileSourceRows(ctx); err != nil {
+	err = c.reconcileSourceRows(ctx)
+	if err != nil {
 		return err
 	}
 
@@ -516,25 +539,28 @@ func (c *Cache) reconcileAccounting(ctx context.Context) error {
 // reconcileVariantFiles walks the variant storage directory, adopting
 // files without accounting rows and sweeping stale temp files.
 func (c *Cache) reconcileVariantFiles(ctx context.Context) error {
-	return filepath.WalkDir(c.variants.baseDir, func(path string, entry fs.DirEntry, err error) error {
-		if err != nil || entry.IsDir() {
-			return err
-		}
+	return filepath.WalkDir(
+		c.variants.baseDir,
+		func(path string, entry fs.DirEntry, err error) error {
+			if err != nil || entry.IsDir() {
+				return err
+			}
 
-		name := entry.Name()
+			name := entry.Name()
 
-		if strings.HasPrefix(name, tempFilePrefix) {
-			c.sweepStaleTempFile(path, entry)
+			if strings.HasPrefix(name, tempFilePrefix) {
+				c.sweepStaleTempFile(path, entry)
 
-			return nil
-		}
+				return nil
+			}
 
-		if strings.HasSuffix(name, variantMetaSuffix) {
-			return nil
-		}
+			if strings.HasSuffix(name, variantMetaSuffix) {
+				return nil
+			}
 
-		return c.adoptVariantFile(ctx, path, entry, VariantKey(name))
-	})
+			return c.adoptVariantFile(ctx, path, entry, VariantKey(name))
+		},
+	)
 }
 
 // adoptVariantFile inserts an accounting row for a variant file that
@@ -581,7 +607,8 @@ func (c *Cache) adoptVariantFile(
 // variantContentTypeFromSidecar reads the content type from a variant
 // .meta sidecar, falling back to application/octet-stream.
 func (c *Cache) variantContentTypeFromSidecar(variantPath string) string {
-	metaData, err := os.ReadFile(variantPath + variantMetaSuffix) //nolint:gosec // path from cache walk
+	//nolint:gosec // path from cache walk
+	metaData, err := os.ReadFile(variantPath + variantMetaSuffix)
 	if err != nil {
 		return fallbackContentType
 	}
@@ -607,8 +634,9 @@ func (c *Cache) reconcileVariantRows(ctx context.Context) error {
 			continue
 		}
 
-		if _, err := c.db.ExecContext(ctx,
-			`DELETE FROM variant_content WHERE cache_key = ?`, string(key)); err != nil {
+		_, err := c.db.ExecContext(ctx,
+			`DELETE FROM variant_content WHERE cache_key = ?`, string(key))
+		if err != nil {
 			return fmt.Errorf("failed to drop stale variant accounting row: %w", err)
 		}
 
@@ -620,29 +648,43 @@ func (c *Cache) reconcileVariantRows(ctx context.Context) error {
 
 // allVariantKeys returns every tracked variant cache key.
 func (c *Cache) allVariantKeys(ctx context.Context) ([]VariantKey, error) {
-	rows, err := c.db.QueryContext(ctx, `SELECT cache_key FROM variant_content`)
+	return queryStringColumn[VariantKey](ctx, c.db,
+		`SELECT cache_key FROM variant_content`, "variant keys", "variant key")
+}
+
+// queryStringColumn runs a single-column query and returns the column
+// values as T. plural names the set for the query and scan failure
+// messages; singular names one row for the scan and iteration failure
+// messages.
+func queryStringColumn[T ~string](
+	ctx context.Context, db *sql.DB, query, plural, singular string,
+) ([]T, error) {
+	rows, err := db.QueryContext(ctx, query)
 	if err != nil {
-		return nil, fmt.Errorf("failed to query variant keys: %w", err)
+		return nil, fmt.Errorf("failed to query %s: %w", plural, err)
 	}
 
 	defer func() { _ = rows.Close() }()
 
-	var keys []VariantKey
+	var values []T
 
 	for rows.Next() {
-		var key string
-		if err := rows.Scan(&key); err != nil {
-			return nil, fmt.Errorf("failed to scan variant key: %w", err)
+		var value string
+
+		err := rows.Scan(&value)
+		if err != nil {
+			return nil, fmt.Errorf("failed to scan %s: %w", singular, err)
 		}
 
-		keys = append(keys, VariantKey(key))
+		values = append(values, T(value))
 	}
 
-	if err := rows.Err(); err != nil {
-		return nil, fmt.Errorf("variant key iteration failed: %w", err)
+	err = rows.Err()
+	if err != nil {
+		return nil, fmt.Errorf("%s iteration failed: %w", singular, err)
 	}
 
-	return keys, nil
+	return values, nil
 }
 
 // reconcileSourceFiles walks the source content directory, removing
@@ -650,21 +692,24 @@ func (c *Cache) allVariantKeys(ctx context.Context) ([]VariantKey, error) {
 // lookups always go through source_metadata) and sweeping stale temp
 // files.
 func (c *Cache) reconcileSourceFiles(ctx context.Context) error {
-	return filepath.WalkDir(c.srcContent.baseDir, func(path string, entry fs.DirEntry, err error) error {
-		if err != nil || entry.IsDir() {
-			return err
-		}
+	return filepath.WalkDir(
+		c.srcContent.baseDir,
+		func(path string, entry fs.DirEntry, err error) error {
+			if err != nil || entry.IsDir() {
+				return err
+			}
 
-		name := entry.Name()
+			name := entry.Name()
 
-		if strings.HasPrefix(name, tempFilePrefix) {
-			c.sweepStaleTempFile(path, entry)
+			if strings.HasPrefix(name, tempFilePrefix) {
+				c.sweepStaleTempFile(path, entry)
 
-			return nil
-		}
+				return nil
+			}
 
-		return c.removeUntrackedSourceFile(ctx, path, ContentHash(name))
-	})
+			return c.removeUntrackedSourceFile(ctx, path, ContentHash(name))
+		},
+	)
 }
 
 // removeUntrackedSourceFile deletes a source blob file that has no
@@ -686,13 +731,14 @@ func (c *Cache) removeUntrackedSourceFile(
 		return nil
 	}
 
-	if _, err := c.db.ExecContext(ctx,
-		`DELETE FROM source_metadata WHERE content_hash = ?`, string(contentHash)); err != nil {
+	_, err = c.db.ExecContext(ctx,
+		`DELETE FROM source_metadata WHERE content_hash = ?`, string(contentHash))
+	if err != nil {
 		return fmt.Errorf("failed to delete metadata rows for untracked blob: %w", err)
 	}
 
-	//nolint:gosec // G703: path comes from walking our own cache directory
-	if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
+	err = os.Remove(path)
+	if err != nil && !os.IsNotExist(err) {
 		return fmt.Errorf("failed to remove untracked source file: %w", err)
 	}
 
@@ -716,7 +762,8 @@ func (c *Cache) reconcileSourceRows(ctx context.Context) error {
 
 		// The blob file is already gone; evictSourceBlob removes the
 		// rows and sidecars and tolerates the missing file.
-		if err := c.evictSourceBlob(ctx, hash); err != nil {
+		err := c.evictSourceBlob(ctx, hash)
+		if err != nil {
 			return err
 		}
 
@@ -728,29 +775,9 @@ func (c *Cache) reconcileSourceRows(ctx context.Context) error {
 
 // allSourceContentHashes returns every tracked source content hash.
 func (c *Cache) allSourceContentHashes(ctx context.Context) ([]ContentHash, error) {
-	rows, err := c.db.QueryContext(ctx, `SELECT content_hash FROM source_content`)
-	if err != nil {
-		return nil, fmt.Errorf("failed to query source content hashes: %w", err)
-	}
-
-	defer func() { _ = rows.Close() }()
-
-	var hashes []ContentHash
-
-	for rows.Next() {
-		var hash string
-		if err := rows.Scan(&hash); err != nil {
-			return nil, fmt.Errorf("failed to scan content hash: %w", err)
-		}
-
-		hashes = append(hashes, ContentHash(hash))
-	}
-
-	if err := rows.Err(); err != nil {
-		return nil, fmt.Errorf("content hash iteration failed: %w", err)
-	}
-
-	return hashes, nil
+	return queryStringColumn[ContentHash](ctx, c.db,
+		`SELECT content_hash FROM source_content`,
+		"source content hashes", "content hash")
 }
 
 // sweepStaleTempFile removes a temp file left behind by a crashed
@@ -765,8 +792,8 @@ func (c *Cache) sweepStaleTempFile(path string, entry fs.DirEntry) {
 		return
 	}
 
-	//nolint:gosec // G703: path comes from walking our own cache directory
-	if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
+	err = os.Remove(path)
+	if err != nil && !os.IsNotExist(err) {
 		c.log.Warn("failed to remove stale temp file", "path", path, "error", err)
 
 		return