Update golangci-lint to v2.12.2 with canonical config (#29)

Bumps golangci-lint from v2.1.6 (digest-only pin in the `Dockerfile` lint stage) to v2.12.2, pinned by tag and digest (Debian-based image).

Replaces `.golangci.yml` with the canonical strict config: all linters enabled except the standard disable list (`exhaustruct`, `depguard`, `godot`, `wsl`, `wrapcheck`, `varnamelen`), `lll` at 88, `funlen` 80/50, `cyclop` 15, `dupl` 100, and test files are now linted (the old config had `tests: false`, an enable-only list of ~20 linters, `lll` 120, and a blanket exclusion of `internal/macse`).

The stricter config surfaced ~1550 findings, all fixed:

- `wsl_v5` (439) / `nlreturn` (24): blank-line insertions
- `lll` (309): line wrapping at 88 columns; long literals split with `+` concatenation, values unchanged
- `noinlineerr` (130): `if err := ...` split into assignment plus check
- `paralleltest` (116): `t.Parallel()` added to tests without shared state; reasoned `//nolint` where `t.Setenv` or shared fixtures forbid it
- `err113` (97): package-level sentinel errors (new `internal/vault/errors.go`), `%w` wrapping, `errors.Is`
- `perfsprint` (74) / `modernize` (39) / `intrange`: `strconv`, `errors.New`, `slices.Contains`, `any`, `SplitSeq`
- `goconst` (40) / `dupword` (41) / `testifylint` (42) / `thelper` (33): constants, assertion fixes, `t.Helper()`
- `noctx` (22): `exec.CommandContext` for gpg/CLI invocations
- `testpackage` (18): black-box tests moved to `_test` packages where they use only exported identifiers; white-box files carry a reasoned `//nolint`
- `funlen`/`cyclop`/`gocognit`/`nestif`/`dupl`: behavior-preserving helper extraction
- assorted singletons: `gosec`, `gosmopolitan`, `funcorder`, `nonamedreturns`, `makezero`, `prealloc`, `godox`, `nolintlint`, `ireturn`, `nilnil`, `gochecknoinits`

## User-visible strings

**None changed.** Every error message this branch composes is byte-identical to the one `main` composes.

The `err113` sentinels are shaped so `fmt.Errorf` reassembles the original text around them: the sentinel carries the fixed words and the caller supplies the interpolated value in the position it has always occupied. Where the value sits mid-sentence the sentinel holds only a fragment (e.g. `vault.ErrVaultNotFound` is `"does not exist"`, composed by its caller as `vault <name> does not exist`); each such sentinel documents the message it participates in.

Verified mechanically, not by inspection: every `fmt.Errorf` and `errors.New` call site in both trees is parsed, the `Error()` text of any sentinel passed to `%w` is substituted in, and the resulting sets of composed message templates are compared. All 350 templates `main` produces are still produced, character for character. The set of lost or altered messages is empty.

## `unlocker list`

`findUnlockerIDByMetadata` returns `(string, error)` rather than signalling failure with an empty ID, so an unreadable `unlockers.d` is no longer indistinguishable from "no matching entry". `UnlockersList` skips such an entry with a warning naming the directory — its behavior before the scan was extracted into a helper — instead of emitting a row under a synthesized fallback ID that no `unlocker remove` or `unlocker select` can match and that suppresses the current-unlocker marker. The duplicate-check and shell-completion callers skip on the same condition, matching their pre-extraction behavior. Covered by `internal/cli/unlockers_list_test.go`.

`TODO.md` records the change plus follow-ups (version-completion TODOs formerly in code comments, darwin-gated files exceeding 88 columns that Linux CI does not lint).

`make check` is green and the pinned v2.12.2 image reports `0 issues.` Note the test suite needs the memlock ulimit from `script/cibuild` for the 10MB memguard test; that requirement is pre-existing.

Not changed: `script/bootstrap` installs golangci-lint via the system package manager (no version pin to bump), and `script/lint` invokes whatever `golangci-lint` is on PATH. golangci-lint v2.12 deprecates `gomodguard` in favor of `gomodguard_v2` (warning only); the canonical config owns that decision.

Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #29
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/secret/version_test.go

@@ -32,22 +32,32 @@
 // - Long-term key required for all operations
 // - Concurrent reads handled safely
 
-package secret
+package secret_test
 
 import (
+	"errors"
 	"fmt"
 	"path/filepath"
 	"testing"
 	"time"
 
 	"filippo.io/age"
+	"git.eeqj.de/sneak/secret/internal/secret"
 	"github.com/awnumar/memguard"
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
-// MockVault implements VaultInterface for testing
+const (
+	testSecretDir     = "/test/secret"
+	testVaultName     = "test"
+	testVaultStateDir = "/test"
+)
+
+var errNotImplementedInMock = errors.New("not implemented in mock")
+
+// MockVersionVault implements VaultInterface for testing
 type MockVersionVault struct {
 	Name        string
 	fs          afero.Fs
@@ -60,31 +70,37 @@ func (m *MockVersionVault) GetDirectory() (string, error) {
 }
 
 func (m *MockVersionVault) AddSecret(_ string, _ *memguard.LockedBuffer, _ bool) error {
-	return fmt.Errorf("not implemented in mock")
+	return errNotImplementedInMock
 }
 
 func (m *MockVersionVault) GetName() string {
 	return m.Name
 }
 
+//nolint:ireturn // implements VaultInterface
 func (m *MockVersionVault) GetFilesystem() afero.Fs {
 	return m.fs
 }
 
-func (m *MockVersionVault) GetCurrentUnlocker() (Unlocker, error) {
-	return nil, fmt.Errorf("not implemented in mock")
+//nolint:ireturn // implements VaultInterface
+func (m *MockVersionVault) GetCurrentUnlocker() (secret.Unlocker, error) {
+	return nil, errNotImplementedInMock
 }
 
-func (m *MockVersionVault) CreatePassphraseUnlocker(_ *memguard.LockedBuffer) (*PassphraseUnlocker, error) {
-	return nil, fmt.Errorf("not implemented in mock")
+func (m *MockVersionVault) CreatePassphraseUnlocker(
+	_ *memguard.LockedBuffer,
+) (*secret.PassphraseUnlocker, error) {
+	return nil, errNotImplementedInMock
 }
 
 func TestGenerateVersionName(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
-	secretDir := "/test/secret"
+	secretDir := testSecretDir
 
 	// Test first version generation
-	version1, err := GenerateVersionName(fs, secretDir)
+	version1, err := secret.GenerateVersionName(fs, secretDir)
 	require.NoError(t, err)
 	assert.Regexp(t, `^\d{8}\.001$`, version1)
 
@@ -94,7 +110,7 @@ func TestGenerateVersionName(t *testing.T) {
 	require.NoError(t, err)
 
 	// Test second version generation on same day
-	version2, err := GenerateVersionName(fs, secretDir)
+	version2, err := secret.GenerateVersionName(fs, secretDir)
 	require.NoError(t, err)
 	assert.Regexp(t, `^\d{8}\.002$`, version2)
 
@@ -104,8 +120,10 @@ func TestGenerateVersionName(t *testing.T) {
 }
 
 func TestGenerateVersionNameMaxSerial(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
-	secretDir := "/test/secret"
+	secretDir := testSecretDir
 	versionsDir := filepath.Join(secretDir, "versions")
 
 	// Create 999 versions
@@ -117,20 +135,22 @@ func TestGenerateVersionNameMaxSerial(t *testing.T) {
 	}
 
 	// Try to create one more - should fail
-	_, err := GenerateVersionName(fs, secretDir)
-	assert.Error(t, err)
+	_, err := secret.GenerateVersionName(fs, secretDir)
+	require.Error(t, err)
 	assert.Contains(t, err.Error(), "exceeded maximum versions per day")
 }
 
 func TestNewVersion(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 	vault := &MockVersionVault{
-		Name:     "test",
+		Name:     testVaultName,
 		fs:       fs,
-		stateDir: "/test",
+		stateDir: testVaultStateDir,
 	}
 
-	sv := NewVersion(vault, "test/secret", "20231215.001")
+	sv := secret.NewVersion(vault, "test/secret", "20231215.001")
 
 	assert.Equal(t, "test/secret", sv.SecretName)
 	assert.Equal(t, "20231215.001", sv.Version)
@@ -140,11 +160,13 @@ func TestNewVersion(t *testing.T) {
 }
 
 func TestSecretVersionSave(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 	vault := &MockVersionVault{
-		Name:     "test",
+		Name:     testVaultName,
 		fs:       fs,
-		stateDir: "/test",
+		stateDir: testVaultStateDir,
 	}
 
 	// Create vault directory structure and long-term key
@@ -155,18 +177,21 @@ func TestSecretVersionSave(t *testing.T) {
 	// Generate and store long-term public key
 	ltIdentity, err := age.GenerateX25519Identity()
 	require.NoError(t, err)
+
 	vault.longTermKey = ltIdentity
 
 	ltPubKeyPath := filepath.Join(vaultDir, "pub.age")
-	err = afero.WriteFile(fs, ltPubKeyPath, []byte(ltIdentity.Recipient().String()), 0o600)
+	err = afero.WriteFile(
+		fs, ltPubKeyPath, []byte(ltIdentity.Recipient().String()), 0o600)
 	require.NoError(t, err)
 
 	// Create and save a version
-	sv := NewVersion(vault, "test/secret", "20231215.001")
+	sv := secret.NewVersion(vault, "test/secret", "20231215.001")
 	testValue := []byte("test-secret-value")
 
 	testBuffer := memguard.NewBufferFromBytes(testValue)
 	defer testBuffer.Destroy()
+
 	err = sv.Save(testBuffer)
 	require.NoError(t, err)
 
@@ -178,11 +203,13 @@ func TestSecretVersionSave(t *testing.T) {
 }
 
 func TestSecretVersionLoadMetadata(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 	vault := &MockVersionVault{
-		Name:     "test",
+		Name:     testVaultName,
 		fs:       fs,
-		stateDir: "/test",
+		stateDir: testVaultStateDir,
 	}
 
 	// Setup vault with long-term key
@@ -192,14 +219,16 @@ func TestSecretVersionLoadMetadata(t *testing.T) {
 
 	ltIdentity, err := age.GenerateX25519Identity()
 	require.NoError(t, err)
+
 	vault.longTermKey = ltIdentity
 
 	ltPubKeyPath := filepath.Join(vaultDir, "pub.age")
-	err = afero.WriteFile(fs, ltPubKeyPath, []byte(ltIdentity.Recipient().String()), 0o600)
+	err = afero.WriteFile(
+		fs, ltPubKeyPath, []byte(ltIdentity.Recipient().String()), 0o600)
 	require.NoError(t, err)
 
 	// Create and save a version with custom metadata
-	sv := NewVersion(vault, "test/secret", "20231215.001")
+	sv := secret.NewVersion(vault, "test/secret", "20231215.001")
 	now := time.Now()
 	epochPlusOne := time.Unix(1, 0)
 	sv.Metadata.NotBefore = &epochPlusOne
@@ -207,11 +236,12 @@ func TestSecretVersionLoadMetadata(t *testing.T) {
 
 	testBuffer := memguard.NewBufferFromBytes([]byte("test-value"))
 	defer testBuffer.Destroy()
+
 	err = sv.Save(testBuffer)
 	require.NoError(t, err)
 
 	// Create new version object and load metadata
-	sv2 := NewVersion(vault, "test/secret", "20231215.001")
+	sv2 := secret.NewVersion(vault, "test/secret", "20231215.001")
 	err = sv2.LoadMetadata(ltIdentity)
 	require.NoError(t, err)
 
@@ -223,11 +253,13 @@ func TestSecretVersionLoadMetadata(t *testing.T) {
 }
 
 func TestSecretVersionGetValue(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 	vault := &MockVersionVault{
-		Name:     "test",
+		Name:     testVaultName,
 		fs:       fs,
-		stateDir: "/test",
+		stateDir: testVaultStateDir,
 	}
 
 	// Setup vault with long-term key
@@ -237,64 +269,77 @@ func TestSecretVersionGetValue(t *testing.T) {
 
 	ltIdentity, err := age.GenerateX25519Identity()
 	require.NoError(t, err)
+
 	vault.longTermKey = ltIdentity
 
 	ltPubKeyPath := filepath.Join(vaultDir, "pub.age")
-	err = afero.WriteFile(fs, ltPubKeyPath, []byte(ltIdentity.Recipient().String()), 0o600)
+	err = afero.WriteFile(
+		fs, ltPubKeyPath, []byte(ltIdentity.Recipient().String()), 0o600)
 	require.NoError(t, err)
 
 	// Create and save a version
-	sv := NewVersion(vault, "test/secret", "20231215.001")
+	sv := secret.NewVersion(vault, "test/secret", "20231215.001")
 	originalValue := []byte("test-secret-value-12345")
 	expectedValue := make([]byte, len(originalValue))
 	copy(expectedValue, originalValue)
 
 	originalBuffer := memguard.NewBufferFromBytes(originalValue)
 	defer originalBuffer.Destroy()
+
 	err = sv.Save(originalBuffer)
 	require.NoError(t, err)
 
 	// Retrieve the value
 	retrievedBuffer, err := sv.GetValue(ltIdentity)
 	require.NoError(t, err)
+
 	defer retrievedBuffer.Destroy()
 
 	assert.Equal(t, expectedValue, retrievedBuffer.Bytes())
 }
 
 func TestListVersions(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
-	secretDir := "/test/secret"
+	secretDir := testSecretDir
 	versionsDir := filepath.Join(secretDir, "versions")
 
 	// No versions directory
-	versions, err := ListVersions(fs, secretDir)
+	versions, err := secret.ListVersions(fs, secretDir)
 	require.NoError(t, err)
 	assert.Empty(t, versions)
 
 	// Create some versions
-	testVersions := []string{"20231215.001", "20231215.002", "20231216.001", "20231214.001"}
+	testVersions := []string{
+		"20231215.001", "20231215.002", "20231216.001", "20231214.001",
+	}
 	for _, v := range testVersions {
 		err := fs.MkdirAll(filepath.Join(versionsDir, v), 0o755)
 		require.NoError(t, err)
 	}
 
 	// Create a file (not directory) that should be ignored
-	err = afero.WriteFile(fs, filepath.Join(versionsDir, "ignore.txt"), []byte("test"), 0o600)
+	err = afero.WriteFile(
+		fs, filepath.Join(versionsDir, "ignore.txt"), []byte("test"), 0o600)
 	require.NoError(t, err)
 
 	// List versions
-	versions, err = ListVersions(fs, secretDir)
+	versions, err = secret.ListVersions(fs, secretDir)
 	require.NoError(t, err)
 
 	// Should be sorted in reverse chronological order
-	expected := []string{"20231216.001", "20231215.002", "20231215.001", "20231214.001"}
+	expected := []string{
+		"20231216.001", "20231215.002", "20231215.001", "20231214.001",
+	}
 	assert.Equal(t, expected, versions)
 }
 
 func TestGetCurrentVersion(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
-	secretDir := "/test/secret"
+	secretDir := testSecretDir
 
 	// The current file contains just the version name
 	currentPath := filepath.Join(secretDir, "current")
@@ -304,39 +349,43 @@ func TestGetCurrentVersion(t *testing.T) {
 	err = afero.WriteFile(fs, currentPath, []byte("20231216.001"), 0o600)
 	require.NoError(t, err)
 
-	version, err := GetCurrentVersion(fs, secretDir)
+	version, err := secret.GetCurrentVersion(fs, secretDir)
 	require.NoError(t, err)
 	assert.Equal(t, "20231216.001", version)
 }
 
 func TestSetCurrentVersion(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
-	secretDir := "/test/secret"
+	secretDir := testSecretDir
 
 	err := fs.MkdirAll(secretDir, 0o755)
 	require.NoError(t, err)
 
 	// Set current version
-	err = SetCurrentVersion(fs, secretDir, "20231216.002")
+	err = secret.SetCurrentVersion(fs, secretDir, "20231216.002")
 	require.NoError(t, err)
 
 	// Verify it was set
-	version, err := GetCurrentVersion(fs, secretDir)
+	version, err := secret.GetCurrentVersion(fs, secretDir)
 	require.NoError(t, err)
 	assert.Equal(t, "20231216.002", version)
 
 	// Update to different version
-	err = SetCurrentVersion(fs, secretDir, "20231217.001")
+	err = secret.SetCurrentVersion(fs, secretDir, "20231217.001")
 	require.NoError(t, err)
 
-	version, err = GetCurrentVersion(fs, secretDir)
+	version, err = secret.GetCurrentVersion(fs, secretDir)
 	require.NoError(t, err)
 	assert.Equal(t, "20231217.001", version)
 }
 
 func TestVersionMetadataTimestamps(t *testing.T) {
+	t.Parallel()
+
 	// Test that all timestamp fields behave consistently as pointers
-	vm := VersionMetadata{
+	vm := secret.VersionMetadata{
 		ID: "test-id",
 	}
 
@@ -368,5 +417,6 @@ func TestVersionMetadataTimestamps(t *testing.T) {
 // Helper function
 func fileExists(fs afero.Fs, path string) bool {
 	exists, _ := afero.Exists(fs, path)
+
 	return exists
 }