Update golangci-lint to v2.12.2 with canonical config (#29)

Bumps golangci-lint from v2.1.6 (digest-only pin in the `Dockerfile` lint stage) to v2.12.2, pinned by tag and digest (Debian-based image). Replaces `.golangci.yml` with the canonical strict config: all linters enabled except the standard disable list (`exhaustruct`, `depguard`, `godot`, `wsl`, `wrapcheck`, `varnamelen`), `lll` at 88, `funlen` 80/50, `cyclop` 15, `dupl` 100, and test files are now linted (the old config had `tests: false`, an enable-only list of ~20 linters, `lll` 120, and a blanket exclusion of `internal/macse`). The stricter config surfaced ~1550 findings, all fixed: - `wsl_v5` (439) / `nlreturn` (24): blank-line insertions - `lll` (309): line wrapping at 88 columns; long literals split with `+` concatenation, values unchanged - `noinlineerr` (130): `if err := ...` split into assignment plus check - `paralleltest` (116): `t.Parallel()` added to tests without shared state; reasoned `//nolint` where `t.Setenv` or shared fixtures forbid it - `err113` (97): package-level sentinel errors (new `internal/vault/errors.go`), `%w` wrapping, `errors.Is` - `perfsprint` (74) / `modernize` (39) / `intrange`: `strconv`, `errors.New`, `slices.Contains`, `any`, `SplitSeq` - `goconst` (40) / `dupword` (41) / `testifylint` (42) / `thelper` (33): constants, assertion fixes, `t.Helper()` - `noctx` (22): `exec.CommandContext` for gpg/CLI invocations - `testpackage` (18): black-box tests moved to `_test` packages where they use only exported identifiers; white-box files carry a reasoned `//nolint` - `funlen`/`cyclop`/`gocognit`/`nestif`/`dupl`: behavior-preserving helper extraction - assorted singletons: `gosec`, `gosmopolitan`, `funcorder`, `nonamedreturns`, `makezero`, `prealloc`, `godox`, `nolintlint`, `ireturn`, `nilnil`, `gochecknoinits` ## User-visible strings **None changed.** Every error message this branch composes is byte-identical to the one `main` composes. The `err113` sentinels are shaped so `fmt.Errorf` reassembles the original text around them: the sentinel carries the fixed words and the caller supplies the interpolated value in the position it has always occupied. Where the value sits mid-sentence the sentinel holds only a fragment (e.g. `vault.ErrVaultNotFound` is `"does not exist"`, composed by its caller as `vault <name> does not exist`); each such sentinel documents the message it participates in. Verified mechanically, not by inspection: every `fmt.Errorf` and `errors.New` call site in both trees is parsed, the `Error()` text of any sentinel passed to `%w` is substituted in, and the resulting sets of composed message templates are compared. All 350 templates `main` produces are still produced, character for character. The set of lost or altered messages is empty. ## `unlocker list` `findUnlockerIDByMetadata` returns `(string, error)` rather than signalling failure with an empty ID, so an unreadable `unlockers.d` is no longer indistinguishable from "no matching entry". `UnlockersList` skips such an entry with a warning naming the directory — its behavior before the scan was extracted into a helper — instead of emitting a row under a synthesized fallback ID that no `unlocker remove` or `unlocker select` can match and that suppresses the current-unlocker marker. The duplicate-check and shell-completion callers skip on the same condition, matching their pre-extraction behavior. Covered by `internal/cli/unlockers_list_test.go`. `TODO.md` records the change plus follow-ups (version-completion TODOs formerly in code comments, darwin-gated files exceeding 88 columns that Linux CI does not lint). `make check` is green and the pinned v2.12.2 image reports `0 issues.` Note the test suite needs the memlock ulimit from `script/cibuild` for the 10MB memguard test; that requirement is pre-existing. Not changed: `script/bootstrap` installs golangci-lint via the system package manager (no version pin to bump), and `script/lint` invokes whatever `golangci-lint` is on PATH. golangci-lint v2.12 deprecates `gomodguard` in favor of `gomodguard_v2` (warning only); the canonical config owns that decision. Co-authored-by: sneak <sneak@sneak.berlin> Reviewed-on: #29 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>
2026-08-10 15:23:33 +02:00
parent 6e5e0db999
commit 41cea400a7
60 changed files with 6867 additions and 4875 deletions
--- a/internal/cli/version.go
+++ b/internal/cli/version.go
@@ -1,12 +1,16 @@
 package cli

 import (
+	"errors"
 	"fmt"
+	"io"
 	"log"
 	"path/filepath"
 	"strings"
 	"text/tabwriter"
+	"time"

+	"filippo.io/age"
 	"git.eeqj.de/sneak/secret/internal/secret"
 	"git.eeqj.de/sneak/secret/internal/vault"
 	"github.com/spf13/afero"
@@ -17,6 +21,12 @@ const (
 	tabWriterPadding = 2
 )

+// Sentinel errors for version operations
+var (
+	errVersionNotFound            = errors.New("not found for secret")
+	errCannotRemoveCurrentVersion = errors.New("promote another version first")
+)
+
 // newVersionCmd returns the version management command
 func newVersionCmd() *cobra.Command {
 	cli, err := NewCLIInstance()
@@ -32,7 +42,8 @@ func VersionCommands(cli *Instance) *cobra.Command {
 	versionCmd := &cobra.Command{
 		Use:   "version",
 		Short: "Manage secret versions",
-		Long:  "Commands for managing secret versions including listing, promoting, and retrieving specific versions",
+		Long: "Commands for managing secret versions including listing, " +
+			"promoting, and retrieving specific versions",
 	}

 	// List versions command
@@ -51,14 +62,17 @@ func VersionCommands(cli *Instance) *cobra.Command {
 	promoteCmd := &cobra.Command{
 		Use:   "promote <secret-name> <version>",
 		Short: "Promote a specific version to current",
-		Long:  "Updates the current symlink to point to the specified version without modifying timestamps",
-		Args:  cobra.ExactArgs(2), //nolint:mnd // Command requires exactly 2 arguments: secret-name and version
-		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+		Long: "Updates the current symlink to point to the specified " +
+			"version without modifying timestamps",
+		Args: cobra.ExactArgs(2), //nolint:mnd // secret-name and version args
+		ValidArgsFunction: func(
+			cmd *cobra.Command, args []string, toComplete string,
+		) ([]string, cobra.ShellCompDirective) {
 			// Complete secret name for first arg
 			if len(args) == 0 {
 				return getSecretNamesCompletionFunc(cli.fs, cli.stateDir)(cmd, args, toComplete)
 			}
-			// TODO: Complete version numbers for second arg
+			// Version number completion for the second arg is not implemented
 			return nil, cobra.ShellCompDirectiveNoFileComp
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -71,14 +85,17 @@ func VersionCommands(cli *Instance) *cobra.Command {
 		Use:     "remove <secret-name> <version>",
 		Aliases: []string{"rm"},
 		Short:   "Remove a specific version of a secret",
-		Long:    "Remove a specific version of a secret. Cannot remove the current version.",
-		Args:    cobra.ExactArgs(2), //nolint:mnd // Command requires exactly 2 arguments: secret-name and version
-		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+		Long: "Remove a specific version of a secret. Cannot remove the " +
+			"current version.",
+		Args: cobra.ExactArgs(2), //nolint:mnd // secret-name and version args
+		ValidArgsFunction: func(
+			cmd *cobra.Command, args []string, toComplete string,
+		) ([]string, cobra.ShellCompDirective) {
 			// Complete secret name for first arg
 			if len(args) == 0 {
 				return getSecretNamesCompletionFunc(cli.fs, cli.stateDir)(cmd, args, toComplete)
 			}
-			// TODO: Complete version numbers for second arg
+			// Version number completion for the second arg is not implemented
 			return nil, cobra.ShellCompDirectiveNoFileComp
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -121,10 +138,11 @@ func (cli *Instance) ListVersions(cmd *cobra.Command, secretName string) error {

 		return fmt.Errorf("failed to check if secret exists: %w", err)
 	}
+
 	if !exists {
 		secret.Debug("Secret not found", "secret_name", secretName)

-		return fmt.Errorf("secret '%s' not found", secretName)
+		return fmt.Errorf("secret '%s' %w", secretName, errSecretNotFound)
 	}

 	// List all versions
@@ -145,6 +163,7 @@ func (cli *Instance) ListVersions(cmd *cobra.Command, secretName string) error {
 	currentVersion, err := secret.GetCurrentVersion(cli.fs, secretDir)
 	if err != nil {
 		secret.Debug("Failed to get current version", "error", err)
+
 		currentVersion = ""
 	}

@@ -160,44 +179,7 @@ func (cli *Instance) ListVersions(cmd *cobra.Command, secretName string) error {

 	// Load and display each version's metadata
 	for _, version := range versions {
-		sv := secret.NewVersion(vlt, secretName, version)
-
-		// Load metadata
-		if err := sv.LoadMetadata(ltIdentity); err != nil {
-			secret.Warn("Failed to load version metadata", "version", version, "error", err)
-			// Display version with error
-			status := "error"
-			if version == currentVersion {
-				status = "current (error)"
-			}
-			_, _ = fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\n", version, "-", status, "-", "-")
-
-			continue
-		}
-
-		// Determine status
-		status := "expired"
-		if version == currentVersion {
-			status = "current"
-		}
-
-		// Format timestamps
-		createdAt := "-"
-		if sv.Metadata.CreatedAt != nil {
-			createdAt = sv.Metadata.CreatedAt.Format("2006-01-02 15:04:05")
-		}
-
-		notBefore := "-"
-		if sv.Metadata.NotBefore != nil {
-			notBefore = sv.Metadata.NotBefore.Format("2006-01-02 15:04:05")
-		}
-
-		notAfter := "-"
-		if sv.Metadata.NotAfter != nil {
-			notAfter = sv.Metadata.NotAfter.Format("2006-01-02 15:04:05")
-		}
-
-		_, _ = fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\n", version, createdAt, status, notBefore, notAfter)
+		printVersionRow(w, vlt, secretName, version, currentVersion, ltIdentity)
 	}

 	_ = w.Flush()
@@ -205,8 +187,58 @@ func (cli *Instance) ListVersions(cmd *cobra.Command, secretName string) error {
 	return nil
 }

+// printVersionRow loads one version's metadata and writes its table row
+func printVersionRow(
+	w io.Writer, vlt *vault.Vault,
+	secretName, version, currentVersion string,
+	ltIdentity *age.X25519Identity,
+) {
+	sv := secret.NewVersion(vlt, secretName, version)
+
+	// Load metadata
+	err := sv.LoadMetadata(ltIdentity)
+	if err != nil {
+		secret.Warn("Failed to load version metadata",
+			"version", version, "error", err)
+		// Display version with error
+		status := "error"
+		if version == currentVersion {
+			status = "current (error)"
+		}
+
+		_, _ = fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\n", version, "-", status, "-", "-")
+
+		return
+	}
+
+	// Determine status
+	status := "expired"
+	if version == currentVersion {
+		status = "current"
+	}
+
+	// Format timestamps
+	createdAt := formatVersionTime(sv.Metadata.CreatedAt)
+	notBefore := formatVersionTime(sv.Metadata.NotBefore)
+	notAfter := formatVersionTime(sv.Metadata.NotAfter)
+
+	_, _ = fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\n",
+		version, createdAt, status, notBefore, notAfter)
+}
+
+// formatVersionTime formats an optional version timestamp, "-" when unset
+func formatVersionTime(t *time.Time) string {
+	if t == nil {
+		return "-"
+	}
+
+	return t.Format("2006-01-02 15:04:05")
+}
+
 // PromoteVersion promotes a specific version to current
-func (cli *Instance) PromoteVersion(cmd *cobra.Command, secretName string, version string) error {
+func (cli *Instance) PromoteVersion(
+	cmd *cobra.Command, secretName string, version string,
+) error {
 	// Get current vault
 	vlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
 	if err != nil {
@@ -224,16 +256,20 @@ func (cli *Instance) PromoteVersion(cmd *cobra.Command, secretName string, versi

 	// Check if version exists
 	versionDir := filepath.Join(secretDir, "versions", version)
+
 	exists, err := afero.DirExists(cli.fs, versionDir)
 	if err != nil {
 		return fmt.Errorf("failed to check if version exists: %w", err)
 	}
+
 	if !exists {
-		return fmt.Errorf("version '%s' not found for secret '%s'", version, secretName)
+		return fmt.Errorf("version '%s' %w '%s'",
+			version, errVersionNotFound, secretName)
 	}

 	// Update the current symlink using the proper function
-	if err := secret.SetCurrentVersion(cli.fs, secretDir, version); err != nil {
+	err = secret.SetCurrentVersion(cli.fs, secretDir, version)
+	if err != nil {
 		return fmt.Errorf("failed to update current version: %w", err)
 	}

@@ -243,7 +279,9 @@ func (cli *Instance) PromoteVersion(cmd *cobra.Command, secretName string, versi
 }

 // RemoveVersion removes a specific version of a secret
-func (cli *Instance) RemoveVersion(cmd *cobra.Command, secretName string, version string) error {
+func (cli *Instance) RemoveVersion(
+	cmd *cobra.Command, secretName string, version string,
+) error {
 	// Get current vault
 	vlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
 	if err != nil {
@@ -264,18 +302,22 @@ func (cli *Instance) RemoveVersion(cmd *cobra.Command, secretName string, versio
 	if err != nil {
 		return fmt.Errorf("failed to check if secret exists: %w", err)
 	}
+
 	if !exists {
-		return fmt.Errorf("secret '%s' not found", secretName)
+		return fmt.Errorf("secret '%s' %w", secretName, errSecretNotFound)
 	}

 	// Check if version exists
 	versionDir := filepath.Join(secretDir, "versions", version)
+
 	exists, err = afero.DirExists(cli.fs, versionDir)
 	if err != nil {
 		return fmt.Errorf("failed to check if version exists: %w", err)
 	}
+
 	if !exists {
-		return fmt.Errorf("version '%s' not found for secret '%s'", version, secretName)
+		return fmt.Errorf("version '%s' %w '%s'",
+			version, errVersionNotFound, secretName)
 	}

 	// Get current version
@@ -286,11 +328,13 @@ func (cli *Instance) RemoveVersion(cmd *cobra.Command, secretName string, versio

 	// Don't allow removing the current version
 	if version == currentVersion {
-		return fmt.Errorf("cannot remove the current version '%s'; promote another version first", version)
+		return fmt.Errorf("cannot remove the current version '%s'; %w",
+			version, errCannotRemoveCurrentVersion)
 	}

 	// Remove the version directory
-	if err := cli.fs.RemoveAll(versionDir); err != nil {
+	err = cli.fs.RemoveAll(versionDir)
+	if err != nil {
 		return fmt.Errorf("failed to remove version: %w", err)
 	}