Update golangci-lint to v2.12.2 with canonical config (#29)

Bumps golangci-lint from v2.1.6 (digest-only pin in the `Dockerfile` lint stage) to v2.12.2, pinned by tag and digest (Debian-based image).

Replaces `.golangci.yml` with the canonical strict config: all linters enabled except the standard disable list (`exhaustruct`, `depguard`, `godot`, `wsl`, `wrapcheck`, `varnamelen`), `lll` at 88, `funlen` 80/50, `cyclop` 15, `dupl` 100, and test files are now linted (the old config had `tests: false`, an enable-only list of ~20 linters, `lll` 120, and a blanket exclusion of `internal/macse`).

The stricter config surfaced ~1550 findings, all fixed:

- `wsl_v5` (439) / `nlreturn` (24): blank-line insertions
- `lll` (309): line wrapping at 88 columns; long literals split with `+` concatenation, values unchanged
- `noinlineerr` (130): `if err := ...` split into assignment plus check
- `paralleltest` (116): `t.Parallel()` added to tests without shared state; reasoned `//nolint` where `t.Setenv` or shared fixtures forbid it
- `err113` (97): package-level sentinel errors (new `internal/vault/errors.go`), `%w` wrapping, `errors.Is`
- `perfsprint` (74) / `modernize` (39) / `intrange`: `strconv`, `errors.New`, `slices.Contains`, `any`, `SplitSeq`
- `goconst` (40) / `dupword` (41) / `testifylint` (42) / `thelper` (33): constants, assertion fixes, `t.Helper()`
- `noctx` (22): `exec.CommandContext` for gpg/CLI invocations
- `testpackage` (18): black-box tests moved to `_test` packages where they use only exported identifiers; white-box files carry a reasoned `//nolint`
- `funlen`/`cyclop`/`gocognit`/`nestif`/`dupl`: behavior-preserving helper extraction
- assorted singletons: `gosec`, `gosmopolitan`, `funcorder`, `nonamedreturns`, `makezero`, `prealloc`, `godox`, `nolintlint`, `ireturn`, `nilnil`, `gochecknoinits`

## User-visible strings

**None changed.** Every error message this branch composes is byte-identical to the one `main` composes.

The `err113` sentinels are shaped so `fmt.Errorf` reassembles the original text around them: the sentinel carries the fixed words and the caller supplies the interpolated value in the position it has always occupied. Where the value sits mid-sentence the sentinel holds only a fragment (e.g. `vault.ErrVaultNotFound` is `"does not exist"`, composed by its caller as `vault <name> does not exist`); each such sentinel documents the message it participates in.

Verified mechanically, not by inspection: every `fmt.Errorf` and `errors.New` call site in both trees is parsed, the `Error()` text of any sentinel passed to `%w` is substituted in, and the resulting sets of composed message templates are compared. All 350 templates `main` produces are still produced, character for character. The set of lost or altered messages is empty.

## `unlocker list`

`findUnlockerIDByMetadata` returns `(string, error)` rather than signalling failure with an empty ID, so an unreadable `unlockers.d` is no longer indistinguishable from "no matching entry". `UnlockersList` skips such an entry with a warning naming the directory — its behavior before the scan was extracted into a helper — instead of emitting a row under a synthesized fallback ID that no `unlocker remove` or `unlocker select` can match and that suppresses the current-unlocker marker. The duplicate-check and shell-completion callers skip on the same condition, matching their pre-extraction behavior. Covered by `internal/cli/unlockers_list_test.go`.

`TODO.md` records the change plus follow-ups (version-completion TODOs formerly in code comments, darwin-gated files exceeding 88 columns that Linux CI does not lint).

`make check` is green and the pinned v2.12.2 image reports `0 issues.` Note the test suite needs the memlock ulimit from `script/cibuild` for the 10MB memguard test; that requirement is pre-existing.

Not changed: `script/bootstrap` installs golangci-lint via the system package manager (no version pin to bump), and `script/lint` invokes whatever `golangci-lint` is on PATH. golangci-lint v2.12 deprecates `gomodguard` in favor of `gomodguard_v2` (warning only); the canonical config owns that decision.

Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #29
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/cli/completions.go

@@ -1,7 +1,6 @@
 package cli
 
 import (
-	"encoding/json"
 	"path/filepath"
 	"strings"
 
@@ -11,11 +10,14 @@ import (
 	"github.com/spf13/cobra"
 )
 
-// getSecretNamesCompletionFunc returns a completion function that provides secret names
+// getSecretNamesCompletionFunc returns a completion function that provides
+// secret names
 func getSecretNamesCompletionFunc(fs afero.Fs, stateDir string) func(
 	cmd *cobra.Command, args []string, toComplete string,
 ) ([]string, cobra.ShellCompDirective) {
-	return func(_ *cobra.Command, _ []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	return func(
+		_ *cobra.Command, _ []string, toComplete string,
+	) ([]string, cobra.ShellCompDirective) {
 		// Get current vault
 		vlt, err := vault.GetCurrentVault(fs, stateDir)
 		if err != nil {
@@ -30,6 +32,7 @@ func getSecretNamesCompletionFunc(fs afero.Fs, stateDir string) func(
 
 		// Filter secrets based on what user has typed
 		var completions []string
+
 		for _, secret := range secrets {
 			if strings.HasPrefix(secret, toComplete) {
 				completions = append(completions, secret)
@@ -40,11 +43,14 @@ func getSecretNamesCompletionFunc(fs afero.Fs, stateDir string) func(
 	}
 }
 
-// getUnlockerIDsCompletionFunc returns a completion function that provides unlocker IDs
+// getUnlockerIDsCompletionFunc returns a completion function that provides
+// unlocker IDs
 func getUnlockerIDsCompletionFunc(fs afero.Fs, stateDir string) func(
 	cmd *cobra.Command, args []string, toComplete string,
 ) ([]string, cobra.ShellCompDirective) {
-	return func(_ *cobra.Command, _ []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	return func(
+		_ *cobra.Command, _ []string, toComplete string,
+	) ([]string, cobra.ShellCompDirective) {
 		// Get current vault
 		vlt, err := vault.GetCurrentVault(fs, stateDir)
 		if err != nil {
@@ -66,61 +72,24 @@ func getUnlockerIDsCompletionFunc(fs afero.Fs, stateDir string) func(
 		// Collect unlocker IDs
 		var completions []string
 
+		unlockersDir := filepath.Join(vaultDir, "unlockers.d")
+
 		for _, metadata := range unlockerMetadataList {
 			// Get the actual unlocker ID by creating the unlocker instance
-			unlockersDir := filepath.Join(vaultDir, "unlockers.d")
-			files, err := afero.ReadDir(fs, unlockersDir)
+			id, err := findUnlockerIDByMetadata(
+				fs, unlockersDir, metadata, false,
+			)
 			if err != nil {
-				secret.Warn("Could not read unlockers directory during completion", "error", err)
+				secret.Warn(
+					"Could not read unlockers directory during completion, "+
+						"skipping unlocker",
+					"unlockers_dir", unlockersDir, "error", err)
 
 				continue
 			}
 
-			for _, file := range files {
-				if !file.IsDir() {
-					continue
-				}
-
-				unlockerDir := filepath.Join(unlockersDir, file.Name())
-				metadataPath := filepath.Join(unlockerDir, "unlocker-metadata.json")
-
-				// Check if this is the right unlocker by comparing metadata
-				metadataBytes, err := afero.ReadFile(fs, metadataPath)
-				if err != nil {
-					secret.Warn("Could not read unlocker metadata during completion", "path", metadataPath, "error", err)
-
-					continue
-				}
-
-				var diskMetadata secret.UnlockerMetadata
-				if err := json.Unmarshal(metadataBytes, &diskMetadata); err != nil {
-					secret.Warn("Could not parse unlocker metadata during completion", "path", metadataPath, "error", err)
-
-					continue
-				}
-
-				// Match by type and creation time
-				if diskMetadata.Type == metadata.Type && diskMetadata.CreatedAt.Equal(metadata.CreatedAt) {
-					// Create the appropriate unlocker instance
-					var unlocker secret.Unlocker
-					switch metadata.Type {
-					case "passphrase":
-						unlocker = secret.NewPassphraseUnlocker(fs, unlockerDir, diskMetadata)
-					case "keychain":
-						unlocker = secret.NewKeychainUnlocker(fs, unlockerDir, diskMetadata)
-					case "pgp":
-						unlocker = secret.NewPGPUnlocker(fs, unlockerDir, diskMetadata)
-					}
-
-					if unlocker != nil {
-						id := unlocker.GetID()
-						if strings.HasPrefix(id, toComplete) {
-							completions = append(completions, id)
-						}
-					}
-
-					break
-				}
+			if id != "" && strings.HasPrefix(id, toComplete) {
+				completions = append(completions, id)
 			}
 		}
 
@@ -128,17 +97,21 @@ func getUnlockerIDsCompletionFunc(fs afero.Fs, stateDir string) func(
 	}
 }
 
-// getVaultNamesCompletionFunc returns a completion function that provides vault names
+// getVaultNamesCompletionFunc returns a completion function that provides
+// vault names
 func getVaultNamesCompletionFunc(fs afero.Fs, stateDir string) func(
 	cmd *cobra.Command, args []string, toComplete string,
 ) ([]string, cobra.ShellCompDirective) {
-	return func(_ *cobra.Command, _ []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	return func(
+		_ *cobra.Command, _ []string, toComplete string,
+	) ([]string, cobra.ShellCompDirective) {
 		vaults, err := vault.ListVaults(fs, stateDir)
 		if err != nil {
 			return nil, cobra.ShellCompDirectiveNoFileComp
 		}
 
 		var completions []string
+
 		for _, v := range vaults {
 			if strings.HasPrefix(v, toComplete) {
 				completions = append(completions, v)
@@ -149,57 +122,81 @@ func getVaultNamesCompletionFunc(fs afero.Fs, stateDir string) func(
 	}
 }
 
-// getVaultSecretCompletionFunc returns a completion function for vault:secret format
-// It completes vault names with ":" suffix, and after ":" it completes secrets from that vault
+// completeVaultQualifiedSecrets completes "vault:secret" references once a
+// colon is present in the input
+func completeVaultQualifiedSecrets(
+	fs afero.Fs, stateDir, toComplete string,
+) []string {
+	var completions []string
+
+	// Complete secret names for the specified vault
+	parts := strings.SplitN(toComplete, ":", vaultSecretParts)
+	vaultName := parts[0]
+	secretPrefix := parts[1]
+
+	vlt := vault.NewVault(fs, stateDir, vaultName)
+
+	secrets, err := vlt.ListSecrets()
+	if err == nil {
+		for _, secretName := range secrets {
+			if strings.HasPrefix(secretName, secretPrefix) {
+				completions = append(completions, vaultName+":"+secretName)
+			}
+		}
+	}
+
+	return completions
+}
+
+// completeUnqualifiedVaultSecrets completes vault names (with a ":"
+// suffix) and secrets from the current vault
+func completeUnqualifiedVaultSecrets(
+	fs afero.Fs, stateDir, toComplete string,
+) []string {
+	var completions []string
+
+	// Complete vault names with ":" suffix
+	vaults, err := vault.ListVaults(fs, stateDir)
+	if err == nil {
+		for _, v := range vaults {
+			if strings.HasPrefix(v, toComplete) {
+				completions = append(completions, v+":")
+			}
+		}
+	}
+
+	// Also complete secrets from current vault (for within-vault moves)
+	currentVlt, err := vault.GetCurrentVault(fs, stateDir)
+	if err == nil {
+		secrets, err := currentVlt.ListSecrets()
+		if err == nil {
+			for _, secretName := range secrets {
+				if strings.HasPrefix(secretName, toComplete) {
+					completions = append(completions, secretName)
+				}
+			}
+		}
+	}
+
+	return completions
+}
+
+// getVaultSecretCompletionFunc returns a completion function for the
+// vault:secret format. It completes vault names with ":" suffix, and
+// after ":" it completes secrets from that vault.
 func getVaultSecretCompletionFunc(fs afero.Fs, stateDir string) func(
 	cmd *cobra.Command, args []string, toComplete string,
 ) ([]string, cobra.ShellCompDirective) {
-	return func(_ *cobra.Command, _ []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-		var completions []string
-
+	return func(
+		_ *cobra.Command, _ []string, toComplete string,
+	) ([]string, cobra.ShellCompDirective) {
 		// Check if we're completing after a vault: prefix
 		if strings.Contains(toComplete, ":") {
-			// Complete secret names for the specified vault
-			const vaultSecretParts = 2
-			parts := strings.SplitN(toComplete, ":", vaultSecretParts)
-			vaultName := parts[0]
-			secretPrefix := parts[1]
-
-			vlt := vault.NewVault(fs, stateDir, vaultName)
-			secrets, err := vlt.ListSecrets()
-			if err == nil {
-				for _, secretName := range secrets {
-					if strings.HasPrefix(secretName, secretPrefix) {
-						completions = append(completions, vaultName+":"+secretName)
-					}
-				}
-			}
-
-			return completions, cobra.ShellCompDirectiveNoFileComp
+			return completeVaultQualifiedSecrets(fs, stateDir, toComplete),
+				cobra.ShellCompDirectiveNoFileComp
 		}
 
-		// Complete vault names with ":" suffix
-		vaults, err := vault.ListVaults(fs, stateDir)
-		if err == nil {
-			for _, v := range vaults {
-				if strings.HasPrefix(v, toComplete) {
-					completions = append(completions, v+":")
-				}
-			}
-		}
-
-		// Also complete secrets from current vault (for within-vault moves)
-		if currentVlt, err := vault.GetCurrentVault(fs, stateDir); err == nil {
-			secrets, err := currentVlt.ListSecrets()
-			if err == nil {
-				for _, secretName := range secrets {
-					if strings.HasPrefix(secretName, toComplete) {
-						completions = append(completions, secretName)
-					}
-				}
-			}
-		}
-
-		return completions, cobra.ShellCompDirectiveNoSpace
+		return completeUnqualifiedVaultSecrets(fs, stateDir, toComplete),
+			cobra.ShellCompDirectiveNoSpace
 	}
 }