Update golangci-lint to v2.12.2 with canonical config (#29)

Bumps golangci-lint from v2.1.6 (digest-only pin in the `Dockerfile` lint stage) to v2.12.2, pinned by tag and digest (Debian-based image).

Replaces `.golangci.yml` with the canonical strict config: all linters enabled except the standard disable list (`exhaustruct`, `depguard`, `godot`, `wsl`, `wrapcheck`, `varnamelen`), `lll` at 88, `funlen` 80/50, `cyclop` 15, `dupl` 100, and test files are now linted (the old config had `tests: false`, an enable-only list of ~20 linters, `lll` 120, and a blanket exclusion of `internal/macse`).

The stricter config surfaced ~1550 findings, all fixed:

- `wsl_v5` (439) / `nlreturn` (24): blank-line insertions
- `lll` (309): line wrapping at 88 columns; long literals split with `+` concatenation, values unchanged
- `noinlineerr` (130): `if err := ...` split into assignment plus check
- `paralleltest` (116): `t.Parallel()` added to tests without shared state; reasoned `//nolint` where `t.Setenv` or shared fixtures forbid it
- `err113` (97): package-level sentinel errors (new `internal/vault/errors.go`), `%w` wrapping, `errors.Is`
- `perfsprint` (74) / `modernize` (39) / `intrange`: `strconv`, `errors.New`, `slices.Contains`, `any`, `SplitSeq`
- `goconst` (40) / `dupword` (41) / `testifylint` (42) / `thelper` (33): constants, assertion fixes, `t.Helper()`
- `noctx` (22): `exec.CommandContext` for gpg/CLI invocations
- `testpackage` (18): black-box tests moved to `_test` packages where they use only exported identifiers; white-box files carry a reasoned `//nolint`
- `funlen`/`cyclop`/`gocognit`/`nestif`/`dupl`: behavior-preserving helper extraction
- assorted singletons: `gosec`, `gosmopolitan`, `funcorder`, `nonamedreturns`, `makezero`, `prealloc`, `godox`, `nolintlint`, `ireturn`, `nilnil`, `gochecknoinits`

## User-visible strings

**None changed.** Every error message this branch composes is byte-identical to the one `main` composes.

The `err113` sentinels are shaped so `fmt.Errorf` reassembles the original text around them: the sentinel carries the fixed words and the caller supplies the interpolated value in the position it has always occupied. Where the value sits mid-sentence the sentinel holds only a fragment (e.g. `vault.ErrVaultNotFound` is `"does not exist"`, composed by its caller as `vault <name> does not exist`); each such sentinel documents the message it participates in.

Verified mechanically, not by inspection: every `fmt.Errorf` and `errors.New` call site in both trees is parsed, the `Error()` text of any sentinel passed to `%w` is substituted in, and the resulting sets of composed message templates are compared. All 350 templates `main` produces are still produced, character for character. The set of lost or altered messages is empty.

## `unlocker list`

`findUnlockerIDByMetadata` returns `(string, error)` rather than signalling failure with an empty ID, so an unreadable `unlockers.d` is no longer indistinguishable from "no matching entry". `UnlockersList` skips such an entry with a warning naming the directory — its behavior before the scan was extracted into a helper — instead of emitting a row under a synthesized fallback ID that no `unlocker remove` or `unlocker select` can match and that suppresses the current-unlocker marker. The duplicate-check and shell-completion callers skip on the same condition, matching their pre-extraction behavior. Covered by `internal/cli/unlockers_list_test.go`.

`TODO.md` records the change plus follow-ups (version-completion TODOs formerly in code comments, darwin-gated files exceeding 88 columns that Linux CI does not lint).

`make check` is green and the pinned v2.12.2 image reports `0 issues.` Note the test suite needs the memlock ulimit from `script/cibuild` for the 10MB memguard test; that requirement is pre-existing.

Not changed: `script/bootstrap` installs golangci-lint via the system package manager (no version pin to bump), and `script/lint` invokes whatever `golangci-lint` is on PATH. golangci-lint v2.12 deprecates `gomodguard` in favor of `gomodguard_v2` (warning only); the canonical config owns that decision.

Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #29
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/vault/integration_version_test.go

@@ -19,14 +19,17 @@
 // - Consistent test mnemonic for reproducible keys
 // - Proper cleanup and isolation between tests
 
+//nolint:testpackage // uses white-box test helpers shared with this package
 package vault
 
 import (
+	"errors"
 	"fmt"
 	"path/filepath"
 	"testing"
 	"time"
 
+	"filippo.io/age"
 	"git.eeqj.de/sneak/secret/internal/secret"
 	"git.eeqj.de/sneak/secret/pkg/agehd"
 	"github.com/awnumar/memguard"
@@ -35,38 +38,33 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-// Helper function to add a secret to vault with proper buffer protection
-func addTestSecret(t *testing.T, vault *Vault, name string, value []byte, force bool) {
-	t.Helper()
-	buffer := memguard.NewBufferFromBytes(value)
-	defer buffer.Destroy()
-	err := vault.AddSecret(name, buffer, force)
-	require.NoError(t, err)
-}
+// errUnexpectedValue is returned by concurrent readers when a secret value
+// does not match the expected contents.
+var errUnexpectedValue = errors.New("unexpected value")
 
 // TestVersionIntegrationWorkflow tests the complete version workflow
+//
+//nolint:paralleltest // t.Setenv forbids parallel subtests
 func TestVersionIntegrationWorkflow(t *testing.T) {
 	fs := afero.NewMemMapFs()
-	stateDir := "/test/state"
 
 	// Set mnemonic for testing
-	t.Setenv(secret.EnvMnemonic,
-		"abandon abandon abandon abandon abandon abandon "+
-			"abandon abandon abandon abandon abandon about")
+	t.Setenv(secret.EnvMnemonic, testMnemonic)
 
 	// Create vault
-	vault, err := CreateVault(fs, stateDir, "test")
+	vault, err := CreateVault(fs, testStateDir, "test")
 	require.NoError(t, err)
 
 	// Derive and store long-term key from mnemonic
-	mnemonic := "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"
-	ltIdentity, err := agehd.DeriveIdentity(mnemonic, 0)
+	ltIdentity, err := agehd.DeriveIdentity(testMnemonic, 0)
 	require.NoError(t, err)
 
 	// Store long-term public key in vault
 	vaultDir, _ := vault.GetDirectory()
 	ltPubKeyPath := filepath.Join(vaultDir, "pub.age")
-	err = afero.WriteFile(fs, ltPubKeyPath, []byte(ltIdentity.Recipient().String()), 0o600)
+
+	err = afero.WriteFile(fs, ltPubKeyPath,
+		[]byte(ltIdentity.Recipient().String()), 0o600)
 	require.NoError(t, err)
 
 	// Unlock the vault
@@ -76,225 +74,289 @@ func TestVersionIntegrationWorkflow(t *testing.T) {
 
 	// Step 1: Create initial version
 	t.Run("create_initial_version", func(t *testing.T) {
-		addTestSecret(t, vault, secretName, []byte("version-1-data"), false)
-
-		// Verify secret can be retrieved
-		value, err := vault.GetSecret(secretName)
-		require.NoError(t, err)
-		assert.Equal(t, []byte("version-1-data"), value)
-
-		// Verify version directory structure
-		secretDir := filepath.Join(vaultDir, "secrets.d", "integration%test")
-		versions, err := secret.ListVersions(fs, secretDir)
-		require.NoError(t, err)
-		assert.Len(t, versions, 1)
-
-		// Verify current symlink exists
-		currentVersion, err := secret.GetCurrentVersion(fs, secretDir)
-		require.NoError(t, err)
-		assert.Equal(t, versions[0], currentVersion)
-
-		// Verify metadata
-		version := secret.NewVersion(vault, secretName, versions[0])
-		err = version.LoadMetadata(ltIdentity)
-		require.NoError(t, err)
-		assert.NotNil(t, version.Metadata.CreatedAt)
-		assert.NotNil(t, version.Metadata.NotBefore)
-		assert.Equal(t, int64(1), version.Metadata.NotBefore.Unix()) // epoch + 1
-		assert.Nil(t, version.Metadata.NotAfter)                     // should be nil for current version
+		testCreateInitialVersion(t, fs, vault, ltIdentity, vaultDir, secretName)
 	})
 
 	// Step 2: Create second version
-	var firstVersionName string
 	t.Run("create_second_version", func(t *testing.T) {
-		// Small delay to ensure different timestamps
-		time.Sleep(10 * time.Millisecond)
-
-		// Get first version name before creating second
-		secretDir := filepath.Join(vaultDir, "secrets.d", "integration%test")
-		versions, err := secret.ListVersions(fs, secretDir)
-		require.NoError(t, err)
-		firstVersionName = versions[0]
-
-		// Create second version
-		addTestSecret(t, vault, secretName, []byte("version-2-data"), true)
-
-		// Verify new value is current
-		value, err := vault.GetSecret(secretName)
-		require.NoError(t, err)
-		assert.Equal(t, []byte("version-2-data"), value)
-
-		// Verify we now have two versions
-		versions, err = secret.ListVersions(fs, secretDir)
-		require.NoError(t, err)
-		assert.Len(t, versions, 2)
-
-		// Verify first version metadata was updated with notAfter
-		firstVersion := secret.NewVersion(vault, secretName, firstVersionName)
-		err = firstVersion.LoadMetadata(ltIdentity)
-		require.NoError(t, err)
-		assert.NotNil(t, firstVersion.Metadata.NotAfter)
-
-		// Verify second version metadata
-		secondVersion := secret.NewVersion(vault, secretName, versions[0])
-		err = secondVersion.LoadMetadata(ltIdentity)
-		require.NoError(t, err)
-		assert.NotNil(t, secondVersion.Metadata.NotBefore)
-		assert.Nil(t, secondVersion.Metadata.NotAfter)
-
-		// NotBefore of second should equal NotAfter of first
-		assert.Equal(t, firstVersion.Metadata.NotAfter.Unix(), secondVersion.Metadata.NotBefore.Unix())
+		testCreateSecondVersion(t, fs, vault, ltIdentity, vaultDir, secretName)
 	})
 
 	// Step 3: Create third version
 	t.Run("create_third_version", func(t *testing.T) {
-		time.Sleep(10 * time.Millisecond)
-
-		addTestSecret(t, vault, secretName, []byte("version-3-data"), true)
-
-		// Verify we now have three versions
-		secretDir := filepath.Join(vaultDir, "secrets.d", "integration%test")
-		versions, err := secret.ListVersions(fs, secretDir)
-		require.NoError(t, err)
-		assert.Len(t, versions, 3)
-
-		// Current should be version-3
-		value, err := vault.GetSecret(secretName)
-		require.NoError(t, err)
-		assert.Equal(t, []byte("version-3-data"), value)
+		testCreateThirdVersion(t, fs, vault, vaultDir, secretName)
 	})
 
 	// Step 4: Retrieve specific versions
 	t.Run("retrieve_specific_versions", func(t *testing.T) {
-		secretDir := filepath.Join(vaultDir, "secrets.d", "integration%test")
-		versions, err := secret.ListVersions(fs, secretDir)
-		require.NoError(t, err)
-		require.Len(t, versions, 3)
-
-		// Get each version by its name
-		value1, err := vault.GetSecretVersion(secretName, versions[2]) // oldest
-		require.NoError(t, err)
-		assert.Equal(t, []byte("version-1-data"), value1)
-
-		value2, err := vault.GetSecretVersion(secretName, versions[1]) // middle
-		require.NoError(t, err)
-		assert.Equal(t, []byte("version-2-data"), value2)
-
-		value3, err := vault.GetSecretVersion(secretName, versions[0]) // newest
-		require.NoError(t, err)
-		assert.Equal(t, []byte("version-3-data"), value3)
-
-		// Empty version should return current
-		valueCurrent, err := vault.GetSecretVersion(secretName, "")
-		require.NoError(t, err)
-		assert.Equal(t, []byte("version-3-data"), valueCurrent)
+		testRetrieveSpecificVersions(t, fs, vault, vaultDir, secretName)
 	})
 
 	// Step 5: Promote old version to current
 	t.Run("promote_old_version", func(t *testing.T) {
-		secretDir := filepath.Join(vaultDir, "secrets.d", "integration%test")
-		versions, err := secret.ListVersions(fs, secretDir)
-		require.NoError(t, err)
-
-		// Promote the first version (oldest) to current
-		oldestVersion := versions[2]
-		err = secret.SetCurrentVersion(fs, secretDir, oldestVersion)
-		require.NoError(t, err)
-
-		// Verify current now returns the old version's value
-		value, err := vault.GetSecret(secretName)
-		require.NoError(t, err)
-		assert.Equal(t, []byte("version-1-data"), value)
-
-		// Verify the version metadata hasn't changed
-		// (promoting shouldn't modify timestamps)
-		version := secret.NewVersion(vault, secretName, oldestVersion)
-		err = version.LoadMetadata(ltIdentity)
-		require.NoError(t, err)
-		assert.NotNil(t, version.Metadata.NotAfter) // should still have its old notAfter
+		testPromoteOldVersion(t, fs, vault, ltIdentity, vaultDir, secretName)
 	})
 
 	// Step 6: Test version limits
 	t.Run("version_serial_limits", func(t *testing.T) {
-		// Create a new secret for this test
-		limitSecretName := "limit/test"
-		secretDir := filepath.Join(vaultDir, "secrets.d", "limit%test", "versions")
-
-		// Create 998 versions (we already have one from the first AddSecret)
-		addTestSecret(t, vault, limitSecretName, []byte("initial"), false)
-
-		// Get today's date for consistent version names
-		today := time.Now().Format("20060102")
-
-		// Manually create many versions with same date
-		for i := 2; i <= 998; i++ {
-			versionName := fmt.Sprintf("%s.%03d", today, i)
-			versionDir := filepath.Join(secretDir, versionName)
-			err := fs.MkdirAll(versionDir, 0o755)
-			require.NoError(t, err)
-		}
-
-		// Should be able to create one more (999)
-		versionName, err := secret.GenerateVersionName(fs, filepath.Dir(secretDir))
-		require.NoError(t, err)
-		assert.Equal(t, fmt.Sprintf("%s.999", today), versionName)
-
-		// Create the 999th version directory
-		err = fs.MkdirAll(filepath.Join(secretDir, versionName), 0o755)
-		require.NoError(t, err)
-
-		// Should fail to create 1000th version
-		_, err = secret.GenerateVersionName(fs, filepath.Dir(secretDir))
-		assert.Error(t, err)
-		assert.Contains(t, err.Error(), "exceeded maximum versions per day")
+		testVersionSerialLimits(t, fs, vault, vaultDir)
 	})
 
 	// Step 7: Test error cases
 	t.Run("error_cases", func(t *testing.T) {
-		// Try to get non-existent version
-		_, err := vault.GetSecretVersion(secretName, "99991231.999")
-		assert.Error(t, err)
-		assert.Contains(t, err.Error(), "not found")
-
-		// Try to get version of non-existent secret
-		_, err = vault.GetSecretVersion("nonexistent/secret", "")
-		assert.Error(t, err)
-
-		// Try to add secret without force when it exists
-		failBuffer := memguard.NewBufferFromBytes([]byte("should-fail"))
-		defer failBuffer.Destroy()
-		err = vault.AddSecret(secretName, failBuffer, false)
-		assert.Error(t, err)
-		assert.Contains(t, err.Error(), "already exists")
+		testVersionErrorCases(t, vault, secretName)
 	})
 }
 
+func testCreateInitialVersion(
+	t *testing.T, fs afero.Fs, vault *Vault,
+	ltIdentity *age.X25519Identity, vaultDir, secretName string,
+) {
+	t.Helper()
+
+	addTestSecretToVault(t, vault, secretName, []byte("version-1-data"), false)
+
+	// Verify secret can be retrieved
+	value, err := vault.GetSecret(secretName)
+	require.NoError(t, err)
+	assert.Equal(t, []byte("version-1-data"), value)
+
+	// Verify version directory structure
+	secretDir := filepath.Join(vaultDir, "secrets.d", "integration%test")
+	versions, err := secret.ListVersions(fs, secretDir)
+	require.NoError(t, err)
+	assert.Len(t, versions, 1)
+
+	// Verify current symlink exists
+	currentVersion, err := secret.GetCurrentVersion(fs, secretDir)
+	require.NoError(t, err)
+	assert.Equal(t, versions[0], currentVersion)
+
+	// Verify metadata
+	version := secret.NewVersion(vault, secretName, versions[0])
+	err = version.LoadMetadata(ltIdentity)
+	require.NoError(t, err)
+	assert.NotNil(t, version.Metadata.CreatedAt)
+	assert.NotNil(t, version.Metadata.NotBefore)
+	assert.Equal(t, int64(1), version.Metadata.NotBefore.Unix()) // epoch + 1
+	// NotAfter should be nil for current version
+	assert.Nil(t, version.Metadata.NotAfter)
+}
+
+func testCreateSecondVersion(
+	t *testing.T, fs afero.Fs, vault *Vault,
+	ltIdentity *age.X25519Identity, vaultDir, secretName string,
+) {
+	t.Helper()
+
+	// Small delay to ensure different timestamps
+	time.Sleep(10 * time.Millisecond)
+
+	// Get first version name before creating second
+	secretDir := filepath.Join(vaultDir, "secrets.d", "integration%test")
+
+	versions, err := secret.ListVersions(fs, secretDir)
+	require.NoError(t, err)
+
+	firstVersionName := versions[0]
+
+	// Create second version
+	addTestSecretToVault(t, vault, secretName, []byte("version-2-data"), true)
+
+	// Verify new value is current
+	value, err := vault.GetSecret(secretName)
+	require.NoError(t, err)
+	assert.Equal(t, []byte("version-2-data"), value)
+
+	// Verify we now have two versions
+	versions, err = secret.ListVersions(fs, secretDir)
+	require.NoError(t, err)
+	assert.Len(t, versions, 2)
+
+	// Verify first version metadata was updated with notAfter
+	firstVersion := secret.NewVersion(vault, secretName, firstVersionName)
+	err = firstVersion.LoadMetadata(ltIdentity)
+	require.NoError(t, err)
+	assert.NotNil(t, firstVersion.Metadata.NotAfter)
+
+	// Verify second version metadata
+	secondVersion := secret.NewVersion(vault, secretName, versions[0])
+	err = secondVersion.LoadMetadata(ltIdentity)
+	require.NoError(t, err)
+	assert.NotNil(t, secondVersion.Metadata.NotBefore)
+	assert.Nil(t, secondVersion.Metadata.NotAfter)
+
+	// NotBefore of second should equal NotAfter of first
+	assert.Equal(t, firstVersion.Metadata.NotAfter.Unix(),
+		secondVersion.Metadata.NotBefore.Unix())
+}
+
+func testCreateThirdVersion(
+	t *testing.T, fs afero.Fs, vault *Vault, vaultDir, secretName string,
+) {
+	t.Helper()
+
+	time.Sleep(10 * time.Millisecond)
+
+	addTestSecretToVault(t, vault, secretName, []byte("version-3-data"), true)
+
+	// Verify we now have three versions
+	secretDir := filepath.Join(vaultDir, "secrets.d", "integration%test")
+	versions, err := secret.ListVersions(fs, secretDir)
+	require.NoError(t, err)
+	assert.Len(t, versions, 3)
+
+	// Current should be version-3
+	value, err := vault.GetSecret(secretName)
+	require.NoError(t, err)
+	assert.Equal(t, []byte("version-3-data"), value)
+}
+
+func testRetrieveSpecificVersions(
+	t *testing.T, fs afero.Fs, vault *Vault, vaultDir, secretName string,
+) {
+	t.Helper()
+
+	secretDir := filepath.Join(vaultDir, "secrets.d", "integration%test")
+	versions, err := secret.ListVersions(fs, secretDir)
+	require.NoError(t, err)
+	require.Len(t, versions, 3)
+
+	// Get each version by its name
+	value1, err := vault.GetSecretVersion(secretName, versions[2]) // oldest
+	require.NoError(t, err)
+	assert.Equal(t, []byte("version-1-data"), value1)
+
+	value2, err := vault.GetSecretVersion(secretName, versions[1]) // middle
+	require.NoError(t, err)
+	assert.Equal(t, []byte("version-2-data"), value2)
+
+	value3, err := vault.GetSecretVersion(secretName, versions[0]) // newest
+	require.NoError(t, err)
+	assert.Equal(t, []byte("version-3-data"), value3)
+
+	// Empty version should return current
+	valueCurrent, err := vault.GetSecretVersion(secretName, "")
+	require.NoError(t, err)
+	assert.Equal(t, []byte("version-3-data"), valueCurrent)
+}
+
+func testPromoteOldVersion(
+	t *testing.T, fs afero.Fs, vault *Vault,
+	ltIdentity *age.X25519Identity, vaultDir, secretName string,
+) {
+	t.Helper()
+
+	secretDir := filepath.Join(vaultDir, "secrets.d", "integration%test")
+	versions, err := secret.ListVersions(fs, secretDir)
+	require.NoError(t, err)
+
+	// Promote the first version (oldest) to current
+	oldestVersion := versions[2]
+	err = secret.SetCurrentVersion(fs, secretDir, oldestVersion)
+	require.NoError(t, err)
+
+	// Verify current now returns the old version's value
+	value, err := vault.GetSecret(secretName)
+	require.NoError(t, err)
+	assert.Equal(t, []byte("version-1-data"), value)
+
+	// Verify the version metadata hasn't changed
+	// (promoting shouldn't modify timestamps)
+	version := secret.NewVersion(vault, secretName, oldestVersion)
+	err = version.LoadMetadata(ltIdentity)
+	require.NoError(t, err)
+	// should still have its old notAfter
+	assert.NotNil(t, version.Metadata.NotAfter)
+}
+
+func testVersionSerialLimits(
+	t *testing.T, fs afero.Fs, vault *Vault, vaultDir string,
+) {
+	t.Helper()
+
+	// Create a new secret for this test
+	limitSecretName := "limit/test"
+	secretDir := filepath.Join(vaultDir, "secrets.d", "limit%test", "versions")
+
+	// Create 998 versions (we already have one from the first AddSecret)
+	addTestSecretToVault(t, vault, limitSecretName, []byte("initial"), false)
+
+	// Get today's date for consistent version names
+	today := time.Now().Format("20060102")
+
+	// Manually create many versions with same date
+	for i := 2; i <= 998; i++ {
+		versionName := fmt.Sprintf("%s.%03d", today, i)
+		versionDir := filepath.Join(secretDir, versionName)
+		err := fs.MkdirAll(versionDir, 0o755)
+		require.NoError(t, err)
+	}
+
+	// Should be able to create one more (999)
+	versionName, err := secret.GenerateVersionName(fs, filepath.Dir(secretDir))
+	require.NoError(t, err)
+	assert.Equal(t, today+".999", versionName)
+
+	// Create the 999th version directory
+	err = fs.MkdirAll(filepath.Join(secretDir, versionName), 0o755)
+	require.NoError(t, err)
+
+	// Should fail to create 1000th version
+	_, err = secret.GenerateVersionName(fs, filepath.Dir(secretDir))
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "exceeded maximum versions per day")
+}
+
+func testVersionErrorCases(t *testing.T, vault *Vault, secretName string) {
+	t.Helper()
+
+	// Try to get non-existent version
+	_, err := vault.GetSecretVersion(secretName, "99991231.999")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "not found")
+
+	// Try to get version of non-existent secret
+	_, err = vault.GetSecretVersion("nonexistent/secret", "")
+	require.Error(t, err)
+
+	// Try to add secret without force when it exists
+	failBuffer := memguard.NewBufferFromBytes([]byte("should-fail"))
+	defer failBuffer.Destroy()
+
+	err = vault.AddSecret(secretName, failBuffer, false)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "already exists")
+}
+
 // TestVersionConcurrency tests concurrent version operations
+//
+//nolint:paralleltest // createTestVaultWithKey uses t.Setenv
 func TestVersionConcurrency(t *testing.T) {
 	fs := afero.NewMemMapFs()
-	stateDir := "/test/state"
 
 	// Set up vault
-	vault := createTestVaultWithKey(t, fs, stateDir, "test")
+	vault := createTestVaultWithKey(t, fs)
 
 	secretName := "concurrent/test"
 
 	// Create initial version
-	addTestSecret(t, vault, secretName, []byte("initial"), false)
+	addTestSecretToVault(t, vault, secretName, []byte("initial"), false)
 
 	// Test concurrent reads
 	t.Run("concurrent_reads", func(t *testing.T) {
 		done := make(chan bool, 10)
-		errors := make(chan error, 10)
+		errCh := make(chan error, 10)
 
 		for range 10 {
 			go func() {
 				value, err := vault.GetSecret(secretName)
 				if err != nil {
-					errors <- err
+					errCh <- err
 				} else if string(value) != "initial" {
-					errors <- fmt.Errorf("unexpected value: %s", value)
+					errCh <- fmt.Errorf("%w: %s", errUnexpectedValue, value)
 				}
+
 				done <- true
 			}()
 		}
@@ -306,7 +368,7 @@ func TestVersionConcurrency(t *testing.T) {
 
 		// Check for errors
 		select {
-		case err := <-errors:
+		case err := <-errCh:
 			t.Fatalf("concurrent read failed: %v", err)
 		default:
 			// No errors
@@ -315,12 +377,14 @@ func TestVersionConcurrency(t *testing.T) {
 }
 
 // TestVersionCompatibility tests that old secrets without versions still work
+//
+//nolint:paralleltest // createTestVaultWithKey uses t.Setenv
 func TestVersionCompatibility(t *testing.T) {
 	fs := afero.NewMemMapFs()
-	stateDir := "/test/state"
 
 	// Set up vault
-	vault := createTestVaultWithKey(t, fs, stateDir, "test")
+	vault := createTestVaultWithKey(t, fs)
+
 	ltIdentity, err := vault.GetOrDeriveLongTermKey()
 	require.NoError(t, err)
 
@@ -333,9 +397,12 @@ func TestVersionCompatibility(t *testing.T) {
 
 	// Create old-style encrypted value directly in secret directory
 	testValue := []byte("legacy-value")
+
 	testValueBuffer := memguard.NewBufferFromBytes(testValue)
 	defer testValueBuffer.Destroy()
+
 	ltRecipient := ltIdentity.Recipient()
+
 	encrypted, err := secret.EncryptToRecipient(testValueBuffer, ltRecipient)
 	require.NoError(t, err)
 
@@ -345,7 +412,7 @@ func TestVersionCompatibility(t *testing.T) {
 
 	// Should fail to get with version-aware methods
 	_, err = vault.GetSecret(secretName)
-	assert.Error(t, err)
+	require.Error(t, err)
 
 	// List versions should return empty
 	versions, err := secret.ListVersions(fs, secretDir)