Update golangci-lint to v2.12.2 with canonical config (closes #30)

- Replace .golangci.yml with the canonical strict config (all linters enabled except the standard disable list; lll 88, funlen 80/50, cyclop 15, dupl 100; test files now linted) - Pin the Dockerfile lint stage to golangci/golangci-lint:v2.12.2 by tag and digest (Debian-based) - Fix all ~1550 findings surfaced by the new config: line wrapping, wsl_v5/nlreturn blank lines, noinlineerr splits, err113 sentinel errors, perfsprint/modernize rewrites, goconst constants, thelper, testifylint, noctx CommandContext, testpackage conversions, t.Parallel() where safe, and complexity/dupl helper extraction - Record the change and follow-up items in TODO.md User-visible strings -------------------- No user-visible string changes remain. Every error message this branch composes is byte-identical to the one main composes. The err113 sentinels are shaped so that fmt.Errorf reassembles the original text around them: a sentinel carries the fixed words of the message and the caller supplies the interpolated value in the position it has always occupied. Where the value sits in the middle of the sentence the sentinel therefore holds only a fragment (for example vault.ErrVaultNotFound is "does not exist", composed by its caller as "vault <name> does not exist"); each such sentinel documents the message it participates in. Verified mechanically rather than by inspection: every fmt.Errorf and errors.New call site in both trees was parsed, the Error() text of any sentinel passed to %w substituted in, and the resulting sets of composed message templates compared. All 350 templates main produces are still produced, character for character; the set of messages lost or altered is empty. unlocker list ------------- findUnlockerIDByMetadata now returns (string, error) instead of signalling failure with an empty ID. An unreadable unlockers.d is no longer indistinguishable from "no matching entry", so UnlockersList skips the entry with a warning naming the directory, as it did before the scan was extracted into a helper, rather than emitting a row under a synthesized fallback ID that no unlocker remove or unlocker select can match and that suppresses the current-unlocker marker. The duplicate-check and shell-completion callers skip on the same condition, matching their pre-extraction behavior. Covered by tests in internal/cli/unlockers_list_test.go.
2026-08-07 17:27:23 +00:00
parent 6e5e0db999
commit 397011a592
60 changed files with 6867 additions and 4875 deletions
--- a/internal/cli/version.go
+++ b/internal/cli/version.go
@@ -1,12 +1,16 @@
 package cli

 import (
+	"errors"
 	"fmt"
+	"io"
 	"log"
 	"path/filepath"
 	"strings"
 	"text/tabwriter"
+	"time"

+	"filippo.io/age"
 	"git.eeqj.de/sneak/secret/internal/secret"
 	"git.eeqj.de/sneak/secret/internal/vault"
 	"github.com/spf13/afero"
@@ -17,6 +21,12 @@ const (
 	tabWriterPadding = 2
 )

+// Sentinel errors for version operations
+var (
+	errVersionNotFound            = errors.New("not found for secret")
+	errCannotRemoveCurrentVersion = errors.New("promote another version first")
+)
+
 // newVersionCmd returns the version management command
 func newVersionCmd() *cobra.Command {
 	cli, err := NewCLIInstance()
@@ -32,7 +42,8 @@ func VersionCommands(cli *Instance) *cobra.Command {
 	versionCmd := &cobra.Command{
 		Use:   "version",
 		Short: "Manage secret versions",
-		Long:  "Commands for managing secret versions including listing, promoting, and retrieving specific versions",
+		Long: "Commands for managing secret versions including listing, " +
+			"promoting, and retrieving specific versions",
 	}

 	// List versions command
@@ -51,14 +62,17 @@ func VersionCommands(cli *Instance) *cobra.Command {
 	promoteCmd := &cobra.Command{
 		Use:   "promote <secret-name> <version>",
 		Short: "Promote a specific version to current",
-		Long:  "Updates the current symlink to point to the specified version without modifying timestamps",
-		Args:  cobra.ExactArgs(2), //nolint:mnd // Command requires exactly 2 arguments: secret-name and version
-		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+		Long: "Updates the current symlink to point to the specified " +
+			"version without modifying timestamps",
+		Args: cobra.ExactArgs(2), //nolint:mnd // secret-name and version args
+		ValidArgsFunction: func(
+			cmd *cobra.Command, args []string, toComplete string,
+		) ([]string, cobra.ShellCompDirective) {
 			// Complete secret name for first arg
 			if len(args) == 0 {
 				return getSecretNamesCompletionFunc(cli.fs, cli.stateDir)(cmd, args, toComplete)
 			}
-			// TODO: Complete version numbers for second arg
+			// Version number completion for the second arg is not implemented
 			return nil, cobra.ShellCompDirectiveNoFileComp
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -71,14 +85,17 @@ func VersionCommands(cli *Instance) *cobra.Command {
 		Use:     "remove <secret-name> <version>",
 		Aliases: []string{"rm"},
 		Short:   "Remove a specific version of a secret",
-		Long:    "Remove a specific version of a secret. Cannot remove the current version.",
-		Args:    cobra.ExactArgs(2), //nolint:mnd // Command requires exactly 2 arguments: secret-name and version
-		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+		Long: "Remove a specific version of a secret. Cannot remove the " +
+			"current version.",
+		Args: cobra.ExactArgs(2), //nolint:mnd // secret-name and version args
+		ValidArgsFunction: func(
+			cmd *cobra.Command, args []string, toComplete string,
+		) ([]string, cobra.ShellCompDirective) {
 			// Complete secret name for first arg
 			if len(args) == 0 {
 				return getSecretNamesCompletionFunc(cli.fs, cli.stateDir)(cmd, args, toComplete)
 			}
-			// TODO: Complete version numbers for second arg
+			// Version number completion for the second arg is not implemented
 			return nil, cobra.ShellCompDirectiveNoFileComp
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -121,10 +138,11 @@ func (cli *Instance) ListVersions(cmd *cobra.Command, secretName string) error {

 		return fmt.Errorf("failed to check if secret exists: %w", err)
 	}
+
 	if !exists {
 		secret.Debug("Secret not found", "secret_name", secretName)

-		return fmt.Errorf("secret '%s' not found", secretName)
+		return fmt.Errorf("secret '%s' %w", secretName, errSecretNotFound)
 	}

 	// List all versions
@@ -145,6 +163,7 @@ func (cli *Instance) ListVersions(cmd *cobra.Command, secretName string) error {
 	currentVersion, err := secret.GetCurrentVersion(cli.fs, secretDir)
 	if err != nil {
 		secret.Debug("Failed to get current version", "error", err)
+
 		currentVersion = ""
 	}

@@ -160,44 +179,7 @@ func (cli *Instance) ListVersions(cmd *cobra.Command, secretName string) error {

 	// Load and display each version's metadata
 	for _, version := range versions {
-		sv := secret.NewVersion(vlt, secretName, version)
-
-		// Load metadata
-		if err := sv.LoadMetadata(ltIdentity); err != nil {
-			secret.Warn("Failed to load version metadata", "version", version, "error", err)
-			// Display version with error
-			status := "error"
-			if version == currentVersion {
-				status = "current (error)"
-			}
-			_, _ = fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\n", version, "-", status, "-", "-")
-
-			continue
-		}
-
-		// Determine status
-		status := "expired"
-		if version == currentVersion {
-			status = "current"
-		}
-
-		// Format timestamps
-		createdAt := "-"
-		if sv.Metadata.CreatedAt != nil {
-			createdAt = sv.Metadata.CreatedAt.Format("2006-01-02 15:04:05")
-		}
-
-		notBefore := "-"
-		if sv.Metadata.NotBefore != nil {
-			notBefore = sv.Metadata.NotBefore.Format("2006-01-02 15:04:05")
-		}
-
-		notAfter := "-"
-		if sv.Metadata.NotAfter != nil {
-			notAfter = sv.Metadata.NotAfter.Format("2006-01-02 15:04:05")
-		}
-
-		_, _ = fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\n", version, createdAt, status, notBefore, notAfter)
+		printVersionRow(w, vlt, secretName, version, currentVersion, ltIdentity)
 	}

 	_ = w.Flush()
@@ -205,8 +187,58 @@ func (cli *Instance) ListVersions(cmd *cobra.Command, secretName string) error {
 	return nil
 }

+// printVersionRow loads one version's metadata and writes its table row
+func printVersionRow(
+	w io.Writer, vlt *vault.Vault,
+	secretName, version, currentVersion string,
+	ltIdentity *age.X25519Identity,
+) {
+	sv := secret.NewVersion(vlt, secretName, version)
+
+	// Load metadata
+	err := sv.LoadMetadata(ltIdentity)
+	if err != nil {
+		secret.Warn("Failed to load version metadata",
+			"version", version, "error", err)
+		// Display version with error
+		status := "error"
+		if version == currentVersion {
+			status = "current (error)"
+		}
+
+		_, _ = fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\n", version, "-", status, "-", "-")
+
+		return
+	}
+
+	// Determine status
+	status := "expired"
+	if version == currentVersion {
+		status = "current"
+	}
+
+	// Format timestamps
+	createdAt := formatVersionTime(sv.Metadata.CreatedAt)
+	notBefore := formatVersionTime(sv.Metadata.NotBefore)
+	notAfter := formatVersionTime(sv.Metadata.NotAfter)
+
+	_, _ = fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\n",
+		version, createdAt, status, notBefore, notAfter)
+}
+
+// formatVersionTime formats an optional version timestamp, "-" when unset
+func formatVersionTime(t *time.Time) string {
+	if t == nil {
+		return "-"
+	}
+
+	return t.Format("2006-01-02 15:04:05")
+}
+
 // PromoteVersion promotes a specific version to current
-func (cli *Instance) PromoteVersion(cmd *cobra.Command, secretName string, version string) error {
+func (cli *Instance) PromoteVersion(
+	cmd *cobra.Command, secretName string, version string,
+) error {
 	// Get current vault
 	vlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
 	if err != nil {
@@ -224,16 +256,20 @@ func (cli *Instance) PromoteVersion(cmd *cobra.Command, secretName string, versi

 	// Check if version exists
 	versionDir := filepath.Join(secretDir, "versions", version)
+
 	exists, err := afero.DirExists(cli.fs, versionDir)
 	if err != nil {
 		return fmt.Errorf("failed to check if version exists: %w", err)
 	}
+
 	if !exists {
-		return fmt.Errorf("version '%s' not found for secret '%s'", version, secretName)
+		return fmt.Errorf("version '%s' %w '%s'",
+			version, errVersionNotFound, secretName)
 	}

 	// Update the current symlink using the proper function
-	if err := secret.SetCurrentVersion(cli.fs, secretDir, version); err != nil {
+	err = secret.SetCurrentVersion(cli.fs, secretDir, version)
+	if err != nil {
 		return fmt.Errorf("failed to update current version: %w", err)
 	}

@@ -243,7 +279,9 @@ func (cli *Instance) PromoteVersion(cmd *cobra.Command, secretName string, versi
 }

 // RemoveVersion removes a specific version of a secret
-func (cli *Instance) RemoveVersion(cmd *cobra.Command, secretName string, version string) error {
+func (cli *Instance) RemoveVersion(
+	cmd *cobra.Command, secretName string, version string,
+) error {
 	// Get current vault
 	vlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
 	if err != nil {
@@ -264,18 +302,22 @@ func (cli *Instance) RemoveVersion(cmd *cobra.Command, secretName string, versio
 	if err != nil {
 		return fmt.Errorf("failed to check if secret exists: %w", err)
 	}
+
 	if !exists {
-		return fmt.Errorf("secret '%s' not found", secretName)
+		return fmt.Errorf("secret '%s' %w", secretName, errSecretNotFound)
 	}

 	// Check if version exists
 	versionDir := filepath.Join(secretDir, "versions", version)
+
 	exists, err = afero.DirExists(cli.fs, versionDir)
 	if err != nil {
 		return fmt.Errorf("failed to check if version exists: %w", err)
 	}
+
 	if !exists {
-		return fmt.Errorf("version '%s' not found for secret '%s'", version, secretName)
+		return fmt.Errorf("version '%s' %w '%s'",
+			version, errVersionNotFound, secretName)
 	}

 	// Get current version
@@ -286,11 +328,13 @@ func (cli *Instance) RemoveVersion(cmd *cobra.Command, secretName string, versio

 	// Don't allow removing the current version
 	if version == currentVersion {
-		return fmt.Errorf("cannot remove the current version '%s'; promote another version first", version)
+		return fmt.Errorf("cannot remove the current version '%s'; %w",
+			version, errCannotRemoveCurrentVersion)
 	}

 	// Remove the version directory
-	if err := cli.fs.RemoveAll(versionDir); err != nil {
+	err = cli.fs.RemoveAll(versionDir)
+	if err != nil {
 		return fmt.Errorf("failed to remove version: %w", err)
 	}