Update golangci-lint to v2.12.2 with canonical config (#29)

Bumps golangci-lint from v2.1.6 (digest-only pin in the `Dockerfile` lint stage) to v2.12.2, pinned by tag and digest (Debian-based image).

Replaces `.golangci.yml` with the canonical strict config: all linters enabled except the standard disable list (`exhaustruct`, `depguard`, `godot`, `wsl`, `wrapcheck`, `varnamelen`), `lll` at 88, `funlen` 80/50, `cyclop` 15, `dupl` 100, and test files are now linted (the old config had `tests: false`, an enable-only list of ~20 linters, `lll` 120, and a blanket exclusion of `internal/macse`).

The stricter config surfaced ~1550 findings, all fixed:

- `wsl_v5` (439) / `nlreturn` (24): blank-line insertions
- `lll` (309): line wrapping at 88 columns; long literals split with `+` concatenation, values unchanged
- `noinlineerr` (130): `if err := ...` split into assignment plus check
- `paralleltest` (116): `t.Parallel()` added to tests without shared state; reasoned `//nolint` where `t.Setenv` or shared fixtures forbid it
- `err113` (97): package-level sentinel errors (new `internal/vault/errors.go`), `%w` wrapping, `errors.Is`
- `perfsprint` (74) / `modernize` (39) / `intrange`: `strconv`, `errors.New`, `slices.Contains`, `any`, `SplitSeq`
- `goconst` (40) / `dupword` (41) / `testifylint` (42) / `thelper` (33): constants, assertion fixes, `t.Helper()`
- `noctx` (22): `exec.CommandContext` for gpg/CLI invocations
- `testpackage` (18): black-box tests moved to `_test` packages where they use only exported identifiers; white-box files carry a reasoned `//nolint`
- `funlen`/`cyclop`/`gocognit`/`nestif`/`dupl`: behavior-preserving helper extraction
- assorted singletons: `gosec`, `gosmopolitan`, `funcorder`, `nonamedreturns`, `makezero`, `prealloc`, `godox`, `nolintlint`, `ireturn`, `nilnil`, `gochecknoinits`

## User-visible strings

**None changed.** Every error message this branch composes is byte-identical to the one `main` composes.

The `err113` sentinels are shaped so `fmt.Errorf` reassembles the original text around them: the sentinel carries the fixed words and the caller supplies the interpolated value in the position it has always occupied. Where the value sits mid-sentence the sentinel holds only a fragment (e.g. `vault.ErrVaultNotFound` is `"does not exist"`, composed by its caller as `vault <name> does not exist`); each such sentinel documents the message it participates in.

Verified mechanically, not by inspection: every `fmt.Errorf` and `errors.New` call site in both trees is parsed, the `Error()` text of any sentinel passed to `%w` is substituted in, and the resulting sets of composed message templates are compared. All 350 templates `main` produces are still produced, character for character. The set of lost or altered messages is empty.

## `unlocker list`

`findUnlockerIDByMetadata` returns `(string, error)` rather than signalling failure with an empty ID, so an unreadable `unlockers.d` is no longer indistinguishable from "no matching entry". `UnlockersList` skips such an entry with a warning naming the directory — its behavior before the scan was extracted into a helper — instead of emitting a row under a synthesized fallback ID that no `unlocker remove` or `unlocker select` can match and that suppresses the current-unlocker marker. The duplicate-check and shell-completion callers skip on the same condition, matching their pre-extraction behavior. Covered by `internal/cli/unlockers_list_test.go`.

`TODO.md` records the change plus follow-ups (version-completion TODOs formerly in code comments, darwin-gated files exceeding 88 columns that Linux CI does not lint).

`make check` is green and the pinned v2.12.2 image reports `0 issues.` Note the test suite needs the memlock ulimit from `script/cibuild` for the 10MB memguard test; that requirement is pre-existing.

Not changed: `script/bootstrap` installs golangci-lint via the system package manager (no version pin to bump), and `script/lint` invokes whatever `golangci-lint` is on PATH. golangci-lint v2.12 deprecates `gomodguard` in favor of `gomodguard_v2` (warning only); the canonical config owns that decision.

Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #29
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/secret/secret.go

@@ -2,6 +2,7 @@ package secret
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"log/slog"
 	"os"
@@ -15,6 +16,18 @@ import (
 	"github.com/spf13/afero"
 )
 
+var (
+	// errSecretNotFound carries only the message tail; callers compose
+	// "secret <name> not found" around it so the emitted text is
+	// unchanged.
+	errSecretNotFound             = errors.New("not found")
+	errUnlockerRequired           = errors.New("unlocker required to decrypt secret")
+	errGetEncryptedDataDeprecated = errors.New(
+		"GetEncryptedData is deprecated - use version-specific methods")
+	errGetCurrentVaultNotRegistered = errors.New(
+		"GetCurrentVault function not registered")
+)
+
 // VaultInterface defines the interface that vault implementations must satisfy
 type VaultInterface interface {
 	GetDirectory() (string, error)
@@ -22,7 +35,8 @@ type VaultInterface interface {
 	GetName() string
 	GetFilesystem() afero.Fs
 	GetCurrentUnlocker() (Unlocker, error)
-	CreatePassphraseUnlocker(passphrase *memguard.LockedBuffer) (*PassphraseUnlocker, error)
+	CreatePassphraseUnlocker(
+		passphrase *memguard.LockedBuffer) (*PassphraseUnlocker, error)
 }
 
 // Secret represents a secret in a vault
@@ -62,7 +76,8 @@ func NewSecret(vault VaultInterface, name string) *Secret {
 	}
 }
 
-// GetValue retrieves and decrypts the current version's value using the provided unlocker
+// GetValue retrieves and decrypts the current version's value using the
+// provided unlocker
 func (s *Secret) GetValue(unlocker Unlocker) (*memguard.LockedBuffer, error) {
 	DebugWith("Getting secret value",
 		slog.String("secret_name", s.Name),
@@ -72,14 +87,17 @@ func (s *Secret) GetValue(unlocker Unlocker) (*memguard.LockedBuffer, error) {
 	// Check if secret exists
 	exists, err := s.Exists()
 	if err != nil {
-		Debug("Failed to check if secret exists during GetValue", "error", err, "secret_name", s.Name)
+		Debug("Failed to check if secret exists during GetValue",
+			"error", err, "secret_name", s.Name)
 
 		return nil, fmt.Errorf("failed to check if secret exists: %w", err)
 	}
-	if !exists {
-		Debug("Secret not found during GetValue", "secret_name", s.Name, "vault_name", s.vault.GetName())
 
-		return nil, fmt.Errorf("secret %s not found", s.Name)
+	if !exists {
+		Debug("Secret not found during GetValue",
+			"secret_name", s.Name, "vault_name", s.vault.GetName())
+
+		return nil, fmt.Errorf("secret %s %w", s.Name, errSecretNotFound)
 	}
 
 	Debug("Secret exists, getting current version", "secret_name", s.Name)
@@ -95,52 +113,9 @@ func (s *Secret) GetValue(unlocker Unlocker) (*memguard.LockedBuffer, error) {
 	// Create version object
 	version := NewVersion(s.vault, s.Name, currentVersion)
 
-	// Check if we have SB_SECRET_MNEMONIC environment variable for direct decryption
+	// Check for SB_SECRET_MNEMONIC environment variable for direct decryption
 	if envMnemonic := os.Getenv(EnvMnemonic); envMnemonic != "" {
-		Debug("Using mnemonic from environment for direct long-term key derivation", "secret_name", s.Name)
-
-		// Get vault directory to read metadata
-		vaultDir, err := s.vault.GetDirectory()
-		if err != nil {
-			Debug("Failed to get vault directory", "error", err, "secret_name", s.Name)
-
-			return nil, fmt.Errorf("failed to get vault directory: %w", err)
-		}
-
-		// Load vault metadata to get the correct derivation index
-		metadataPath := filepath.Join(vaultDir, "vault-metadata.json")
-		metadataBytes, err := afero.ReadFile(s.vault.GetFilesystem(), metadataPath)
-		if err != nil {
-			Debug("Failed to read vault metadata", "error", err, "path", metadataPath)
-
-			return nil, fmt.Errorf("failed to read vault metadata: %w", err)
-		}
-
-		var metadata VaultMetadata
-		if err := json.Unmarshal(metadataBytes, &metadata); err != nil {
-			Debug("Failed to parse vault metadata", "error", err, "secret_name", s.Name)
-
-			return nil, fmt.Errorf("failed to parse vault metadata: %w", err)
-		}
-
-		DebugWith("Using vault derivation index from metadata",
-			slog.String("secret_name", s.Name),
-			slog.String("vault_name", s.vault.GetName()),
-			slog.Uint64("derivation_index", uint64(metadata.DerivationIndex)),
-		)
-
-		// Use mnemonic with the vault's derivation index from metadata
-		ltIdentity, err := agehd.DeriveIdentity(envMnemonic, metadata.DerivationIndex)
-		if err != nil {
-			Debug("Failed to derive long-term key from mnemonic for secret", "error", err, "secret_name", s.Name)
-
-			return nil, fmt.Errorf("failed to derive long-term key from mnemonic: %w", err)
-		}
-
-		Debug("Successfully derived long-term key from mnemonic", "secret_name", s.Name)
-
-		// Use the long-term key to decrypt the version
-		return version.GetValue(ltIdentity)
+		return s.getValueViaMnemonic(version, envMnemonic)
 	}
 
 	Debug("Using unlocker for vault access", "secret_name", s.Name)
@@ -149,51 +124,12 @@ func (s *Secret) GetValue(unlocker Unlocker) (*memguard.LockedBuffer, error) {
 	if unlocker == nil {
 		Debug("No unlocker provided for secret decryption", "secret_name", s.Name)
 
-		return nil, fmt.Errorf("unlocker required to decrypt secret")
+		return nil, errUnlockerRequired
 	}
 
-	DebugWith("Getting vault's long-term key using unlocker",
-		slog.String("secret_name", s.Name),
-		slog.String("unlocker_type", unlocker.GetType()),
-		slog.String("unlocker_id", unlocker.GetID()),
-	)
-
-	// Step 1: Use the unlocker to get the vault's long-term private key
-	unlockIdentity, err := unlocker.GetIdentity()
+	ltIdentity, err := s.getLongTermIdentityFromUnlocker(unlocker)
 	if err != nil {
-		Debug("Failed to get unlocker identity", "error", err, "secret_name", s.Name, "unlocker_type", unlocker.GetType())
-
-		return nil, fmt.Errorf("failed to get unlocker identity: %w", err)
-	}
-
-	// Read the encrypted long-term private key from the unlocker directory
-	encryptedLtPrivKeyPath := filepath.Join(unlocker.GetDirectory(), "longterm.age")
-	Debug("Reading encrypted long-term private key", "path", encryptedLtPrivKeyPath)
-
-	encryptedLtPrivKey, err := afero.ReadFile(s.vault.GetFilesystem(), encryptedLtPrivKeyPath)
-	if err != nil {
-		Debug("Failed to read encrypted long-term private key", "error", err, "path", encryptedLtPrivKeyPath)
-
-		return nil, fmt.Errorf("failed to read encrypted long-term private key: %w", err)
-	}
-
-	// Decrypt the encrypted long-term private key using the unlocker
-	Debug("Decrypting long-term private key using unlocker", "secret_name", s.Name)
-	ltPrivKeyBuffer, err := DecryptWithIdentity(encryptedLtPrivKey, unlockIdentity)
-	if err != nil {
-		Debug("Failed to decrypt long-term private key", "error", err, "secret_name", s.Name)
-
-		return nil, fmt.Errorf("failed to decrypt long-term private key: %w", err)
-	}
-	defer ltPrivKeyBuffer.Destroy()
-
-	// Parse the long-term private key
-	Debug("Parsing long-term private key", "secret_name", s.Name)
-	ltIdentity, err := age.ParseX25519Identity(ltPrivKeyBuffer.String())
-	if err != nil {
-		Debug("Failed to parse long-term private key", "error", err, "secret_name", s.Name)
-
-		return nil, fmt.Errorf("failed to parse long-term private key: %w", err)
+		return nil, err
 	}
 
 	DebugWith("Successfully obtained vault's long-term key",
@@ -207,7 +143,8 @@ func (s *Secret) GetValue(unlocker Unlocker) (*memguard.LockedBuffer, error) {
 
 // LoadMetadata is deprecated - metadata is now per-version and encrypted
 func (s *Secret) LoadMetadata() error {
-	Debug("LoadMetadata called but is deprecated in versioned model", "secret_name", s.Name)
+	Debug("LoadMetadata called but is deprecated in versioned model",
+		"secret_name", s.Name)
 	// For backward compatibility, we'll populate with basic info
 	now := time.Now()
 	s.Metadata = Metadata{
@@ -227,9 +164,10 @@ func (s *Secret) GetMetadata() Metadata {
 
 // GetEncryptedData is deprecated - data is now stored in versions
 func (s *Secret) GetEncryptedData() ([]byte, error) {
-	Debug("GetEncryptedData called but is deprecated in versioned model", "secret_name", s.Name)
+	Debug("GetEncryptedData called but is deprecated in versioned model",
+		"secret_name", s.Name)
 
-	return nil, fmt.Errorf("GetEncryptedData is deprecated - use version-specific methods")
+	return nil, errGetEncryptedDataDeprecated
 }
 
 // Exists checks if the secret exists on disk
@@ -242,7 +180,8 @@ func (s *Secret) Exists() (bool, error) {
 	// Check if the secret directory exists and has a current symlink
 	exists, err := afero.DirExists(s.vault.GetFilesystem(), s.Directory)
 	if err != nil {
-		Debug("Failed to check secret directory existence", "error", err, "secret_dir", s.Directory)
+		Debug("Failed to check secret directory existence",
+			"error", err, "secret_dir", s.Directory)
 
 		return false, err
 	}
@@ -269,14 +208,134 @@ func (s *Secret) Exists() (bool, error) {
 	return true, nil
 }
 
+// getValueViaMnemonic derives the vault's long-term key from the
+// mnemonic in the environment and decrypts the version value with it.
+func (s *Secret) getValueViaMnemonic(
+	version *Version, envMnemonic string,
+) (*memguard.LockedBuffer, error) {
+	Debug("Using mnemonic from environment for direct long-term key derivation",
+		"secret_name", s.Name)
+
+	// Get vault directory to read metadata
+	vaultDir, err := s.vault.GetDirectory()
+	if err != nil {
+		Debug("Failed to get vault directory", "error", err, "secret_name", s.Name)
+
+		return nil, fmt.Errorf("failed to get vault directory: %w", err)
+	}
+
+	// Load vault metadata to get the correct derivation index
+	metadataPath := filepath.Join(vaultDir, "vault-metadata.json")
+
+	metadataBytes, err := afero.ReadFile(s.vault.GetFilesystem(), metadataPath)
+	if err != nil {
+		Debug("Failed to read vault metadata", "error", err, "path", metadataPath)
+
+		return nil, fmt.Errorf("failed to read vault metadata: %w", err)
+	}
+
+	var metadata VaultMetadata
+
+	err = json.Unmarshal(metadataBytes, &metadata)
+	if err != nil {
+		Debug("Failed to parse vault metadata", "error", err, "secret_name", s.Name)
+
+		return nil, fmt.Errorf("failed to parse vault metadata: %w", err)
+	}
+
+	DebugWith("Using vault derivation index from metadata",
+		slog.String("secret_name", s.Name),
+		slog.String("vault_name", s.vault.GetName()),
+		slog.Uint64("derivation_index", uint64(metadata.DerivationIndex)),
+	)
+
+	// Use mnemonic with the vault's derivation index from metadata
+	ltIdentity, err := agehd.DeriveIdentity(envMnemonic, metadata.DerivationIndex)
+	if err != nil {
+		Debug("Failed to derive long-term key from mnemonic for secret",
+			"error", err, "secret_name", s.Name)
+
+		return nil, fmt.Errorf(
+			"failed to derive long-term key from mnemonic: %w", err)
+	}
+
+	Debug("Successfully derived long-term key from mnemonic", "secret_name", s.Name)
+
+	// Use the long-term key to decrypt the version
+	return version.GetValue(ltIdentity)
+}
+
+// getLongTermIdentityFromUnlocker uses the unlocker to obtain and parse
+// the vault's long-term private key.
+func (s *Secret) getLongTermIdentityFromUnlocker(
+	unlocker Unlocker,
+) (*age.X25519Identity, error) {
+	DebugWith("Getting vault's long-term key using unlocker",
+		slog.String("secret_name", s.Name),
+		slog.String("unlocker_type", unlocker.GetType()),
+		slog.String("unlocker_id", unlocker.GetID()),
+	)
+
+	// Step 1: Use the unlocker to get the vault's long-term private key
+	unlockIdentity, err := unlocker.GetIdentity()
+	if err != nil {
+		Debug("Failed to get unlocker identity",
+			"error", err, "secret_name", s.Name,
+			"unlocker_type", unlocker.GetType())
+
+		return nil, fmt.Errorf("failed to get unlocker identity: %w", err)
+	}
+
+	// Read the encrypted long-term private key from the unlocker directory
+	encryptedLtPrivKeyPath := filepath.Join(unlocker.GetDirectory(), "longterm.age")
+	Debug("Reading encrypted long-term private key", "path", encryptedLtPrivKeyPath)
+
+	encryptedLtPrivKey, err := afero.ReadFile(
+		s.vault.GetFilesystem(), encryptedLtPrivKeyPath)
+	if err != nil {
+		Debug("Failed to read encrypted long-term private key",
+			"error", err, "path", encryptedLtPrivKeyPath)
+
+		return nil, fmt.Errorf(
+			"failed to read encrypted long-term private key: %w", err)
+	}
+
+	// Decrypt the encrypted long-term private key using the unlocker
+	Debug("Decrypting long-term private key using unlocker", "secret_name", s.Name)
+
+	ltPrivKeyBuffer, err := DecryptWithIdentity(encryptedLtPrivKey, unlockIdentity)
+	if err != nil {
+		Debug("Failed to decrypt long-term private key",
+			"error", err, "secret_name", s.Name)
+
+		return nil, fmt.Errorf("failed to decrypt long-term private key: %w", err)
+	}
+	defer ltPrivKeyBuffer.Destroy()
+
+	// Parse the long-term private key
+	Debug("Parsing long-term private key", "secret_name", s.Name)
+
+	ltIdentity, err := age.ParseX25519Identity(ltPrivKeyBuffer.String())
+	if err != nil {
+		Debug("Failed to parse long-term private key",
+			"error", err, "secret_name", s.Name)
+
+		return nil, fmt.Errorf("failed to parse long-term private key: %w", err)
+	}
+
+	return ltIdentity, nil
+}
+
 // GetCurrentVault gets the current vault from the file system
 // This function is a wrapper around the actual implementation in the vault package
 // and exists to break the import cycle.
+//
+//nolint:ireturn // must return the interface to break the import cycle
 func GetCurrentVault(fs afero.Fs, stateDir string) (VaultInterface, error) {
 	// This is a forward declaration. The actual implementation is provided
 	// by the vault package when it calls RegisterGetCurrentVaultFunc.
 	if getCurrentVaultFunc == nil {
-		return nil, fmt.Errorf("GetCurrentVault function not registered")
+		return nil, errGetCurrentVaultNotRegistered
 	}
 
 	return getCurrentVaultFunc(fs, stateDir)
@@ -288,8 +347,10 @@ func GetCurrentVault(fs afero.Fs, stateDir string) (VaultInterface, error) {
 //nolint:gochecknoglobals // Required to break import cycle
 var getCurrentVaultFunc func(fs afero.Fs, stateDir string) (VaultInterface, error)
 
-// RegisterGetCurrentVaultFunc allows the vault package to register its implementation
-// of GetCurrentVault to break the import cycle
-func RegisterGetCurrentVaultFunc(fn func(fs afero.Fs, stateDir string) (VaultInterface, error)) {
+// RegisterGetCurrentVaultFunc allows the vault package to register its
+// implementation of GetCurrentVault to break the import cycle
+func RegisterGetCurrentVaultFunc(
+	fn func(fs afero.Fs, stateDir string) (VaultInterface, error),
+) {
 	getCurrentVaultFunc = fn
 }