Check errors by identity, not by message text, in tests (closes #49)

Tests that asserted a failure by a fragment of its message now use
errors.Is: a refactor returning the wrong error, or wrapping with %v
instead of %w, now fails them. New tests return each exported error of
internal/vault and pkg/bip85 that no test returned, and check wrapped
causes (os.ErrNotExist, ErrMnemonicMismatch through GetSecret,
ErrInvalidPathComponent through DeriveBIP85Entropy). The 999-versions
test moves into package secret to name its unexported error. Checks of
errors no test can name keep their text; they are listed on the issue.

Model: opus-5-5

internal/cli/create_vault_test.go

@@ -66,22 +66,18 @@ func TestCreateExistingVaultChangesNothing(t *testing.T) {
 
 	tests := []struct {
 		command string
-		want    string
 		run     func(c *cli.Instance) error
 	}{
 		{
 			"init",
-			"failed to create default vault: vault default already exists",
 			func(c *cli.Instance) error { return c.Init(cmd) },
 		},
 		{
 			"vault create default",
-			"vault default already exists",
 			func(c *cli.Instance) error { return c.CreateVault(cmd, "default") },
 		},
 		{
 			"vault create work",
-			"vault work already exists",
 			func(c *cli.Instance) error { return c.CreateVault(cmd, "work") },
 		},
 	}
@@ -92,7 +88,7 @@ func TestCreateExistingVaultChangesNothing(t *testing.T) {
 
 			err := tt.run(newCLI(fs))
 
-			require.EqualError(t, err, tt.want)
+			require.ErrorIs(t, err, vault.ErrVaultExists)
 			require.Equal(t, before, snapshotStateDir(t, fs))
 		})
 	}
@@ -227,9 +223,7 @@ func TestStopDuringCreateLeavesWholeVaultOrNone(t *testing.T) {
 		fs := afero.NewMemMapFs()
 		require.NoError(t, fs.MkdirAll(testStateDir, secret.DirPerms))
 
-		requireStopsLeaveWholeVaultOrNone(t, fs, "default",
-			"failed to create default vault: vault default already exists",
-			mnemonic, passphrase,
+		requireStopsLeaveWholeVaultOrNone(t, fs, "default", mnemonic, passphrase,
 			func(c *cli.Instance) error { return c.Init(cmd) })
 	})
 
@@ -239,8 +233,7 @@ func TestStopDuringCreateLeavesWholeVaultOrNone(t *testing.T) {
 		_, err := vault.CreateVault(fs, testStateDir, "default", mnemonic, nil)
 		require.NoError(t, err)
 
-		requireStopsLeaveWholeVaultOrNone(t, fs, "work", "vault work already exists",
-			mnemonic, passphrase,
+		requireStopsLeaveWholeVaultOrNone(t, fs, "work", mnemonic, passphrase,
 			func(c *cli.Instance) error { return c.CreateVault(cmd, "work") })
 	})
 }
@@ -248,9 +241,10 @@ func TestStopDuringCreateLeavesWholeVaultOrNone(t *testing.T) {
 // requireStopsLeaveWholeVaultOrNone checks, as
 // TestStopDuringCreateLeavesWholeVaultOrNone describes, the stops of the
 // command run, creating the vault name on fs with mnemonic and passphrase.
-// Run again where the vault is there, the command must fail with exists.
+// Run again where the vault is there, the command must fail with
+// vault.ErrVaultExists.
 func requireStopsLeaveWholeVaultOrNone(
-	t *testing.T, fs afero.Fs, name, exists string,
+	t *testing.T, fs afero.Fs, name string,
 	mnemonic, passphrase *memguard.LockedBuffer,
 	run func(c *cli.Instance) error,
 ) {
@@ -312,7 +306,7 @@ func requireStopsLeaveWholeVaultOrNone(
 		c.UnlockPassphrase = passphrase
 
 		if _, there := state[vaultDir+"/"]; there {
-			require.EqualError(t, run(c), exists)
+			require.ErrorIs(t, run(c), vault.ErrVaultExists)
 		} else {
 			require.NoError(t, run(c))
 		}

internal/cli/integration_test.go

@@ -680,10 +680,10 @@ func test06GetSecret(t *testing.T, testMnemonic string, runSecret func(...string
 	require.NoError(t, err, "get secret should succeed")
 	assert.Equal(t, "password123", strings.TrimSpace(output), "should return correct secret value")
 
-	// Test that without mnemonic, we get an error
-	output, err = runSecret("get", "database/password")
-	require.Error(t, err, "get should fail without unlock method")
-	assert.Contains(t, output, "failed to unlock vault", "should indicate unlock failure")
+	// Test that without mnemonic, we get an error: the passphrase unlocker
+	// cannot ask for its passphrase, as the tests have no terminal
+	_, err = runSecret("get", "database/password")
+	require.ErrorIs(t, err, secret.ErrPassphraseNotRead, "get should fail without unlock method")
 }
 
 func test07AddSecretVersion(t *testing.T, tempDir, testMnemonic string, runSecret func(...string) (string, error), runSecretWithEnv func(map[string]string, ...string) (string, error), runSecretWithStdin func(string, map[string]string, ...string) (string, error)) {
@@ -839,12 +839,11 @@ func test09GetSpecificVersion(t *testing.T, tempDir, testMnemonic string, runSec
 	assert.Equal(t, "newpassword456", strings.TrimSpace(output), "should return new secret value without --version")
 
 	// An empty --version is not a version; it does not mean the current one
-	output, err = runSecretWithEnv(map[string]string{
+	_, err = runSecretWithEnv(map[string]string{
 		secret.EnvMnemonic: testMnemonic,
 	}, "get", "--version", "", "database/password")
 
-	require.Error(t, err, "get with an empty version should fail")
-	assert.Contains(t, output, "version '' not found", "should reject the empty version")
+	require.ErrorIs(t, err, vault.ErrVersionNotFound, "should reject the empty version")
 }
 
 func test10PromoteVersion(t *testing.T, tempDir, testMnemonic string, runSecret func(...string) (string, error), runSecretWithEnv func(map[string]string, ...string) (string, error)) {
@@ -1158,11 +1157,7 @@ func testInvalidSecretNames(t *testing.T, testMnemonic string, runSecretWithStdi
 			shouldFail := slices.Contains(definitelyInvalid, invalidName)
 
 			if shouldFail {
-				require.Error(t, err, "add '%s' should fail", invalidName)
-
-				if err != nil {
-					assert.Contains(t, output, "invalid secret name", "should indicate invalid name for '%s'", invalidName)
-				}
+				require.ErrorIs(t, err, vault.ErrInvalidSecretName, "add '%s' should fail", invalidName)
 			} else {
 				// For the slash cases and .hidden, they might succeed
 				// Just log what happened
@@ -1310,9 +1305,8 @@ func test12cCrossVaultMove(t *testing.T, testMnemonic string, runSecretWithEnv f
 	require.NoError(t, err, "add force/test in work should succeed")
 
 	// Move without force should fail
-	output, err = runSecretWithEnv(env, "move", "work:force/test", "default")
-	require.Error(t, err, "move without force should fail when dest exists")
-	assert.Contains(t, output, "already exists", "should indicate destination exists")
+	_, err = runSecretWithEnv(env, "move", "work:force/test", "default")
+	require.ErrorIs(t, err, vault.ErrSecretExists, "move without force should fail when dest exists")
 
 	// Move with force should succeed
 	output, err = runSecretWithEnv(env, "move", "--force", "work:force/test", "default")
@@ -1427,9 +1421,8 @@ func test14SwitchVault(t *testing.T, tempDir string, runSecret func(...string) (
 	require.NoError(t, err, "vault select default should succeed")
 
 	// Test selecting non-existent vault
-	output, err := runSecret("vault", "select", "nonexistent")
-	require.Error(t, err, "selecting non-existent vault should fail")
-	assert.Contains(t, output, "does not exist", "should indicate vault doesn't exist")
+	_, err = runSecret("vault", "select", "nonexistent")
+	require.ErrorIs(t, err, vault.ErrVaultNotFound, "selecting non-existent vault should fail")
 }
 
 func test15VaultIsolation(t *testing.T, testMnemonic string, runSecret func(...string) (string, error), runSecretWithEnv func(map[string]string, ...string) (string, error), runSecretWithStdin func(string, map[string]string, ...string) (string, error)) {
@@ -1450,11 +1443,10 @@ func test15VaultIsolation(t *testing.T, testMnemonic string, runSecret func(...s
 	require.NoError(t, err, "vault select work should succeed")
 
 	// Try to get the default-only secret (should fail)
-	output, err := runSecretWithEnv(map[string]string{
+	_, err = runSecretWithEnv(map[string]string{
 		secret.EnvMnemonic: testMnemonic,
 	}, "get", "default-only/secret")
-	require.Error(t, err, "should not be able to get default vault secret from work vault")
-	assert.Contains(t, output, "not found", "should indicate secret not found")
+	require.ErrorIs(t, err, vault.ErrSecretNotFound, "should not be able to get default vault secret from work vault")
 
 	// Add a unique secret to work vault
 	_, err = runSecretWithStdin("work-vault-secret", map[string]string{
@@ -1467,14 +1459,13 @@ func test15VaultIsolation(t *testing.T, testMnemonic string, runSecret func(...s
 	require.NoError(t, err, "vault select default should succeed")
 
 	// Try to get the work-only secret (should fail)
-	output, err = runSecretWithEnv(map[string]string{
+	_, err = runSecretWithEnv(map[string]string{
 		secret.EnvMnemonic: testMnemonic,
 	}, "get", "work-only/secret")
-	require.Error(t, err, "should not be able to get work vault secret from default vault")
-	assert.Contains(t, output, "not found", "should indicate secret not found")
+	require.ErrorIs(t, err, vault.ErrSecretNotFound, "should not be able to get work vault secret from default vault")
 
 	// Verify we can still get the default-only secret
-	output, err = runSecretWithEnv(map[string]string{
+	output, err := runSecretWithEnv(map[string]string{
 		secret.EnvMnemonic: testMnemonic,
 	}, "get", "default-only/secret")
 	require.NoError(t, err, "get default-only secret should succeed")
@@ -1586,11 +1577,10 @@ func test17ImportFromFile(t *testing.T, tempDir, testMnemonic string, runSecretW
 	// Just verify the import succeeded
 
 	// Test importing non-existent file
-	output, err = runSecretWithEnv(map[string]string{
+	_, err = runSecretWithEnv(map[string]string{
 		secret.EnvMnemonic: testMnemonic,
 	}, "import", "imported/nonexistent", "--source", "/nonexistent/file")
-	require.Error(t, err, "importing non-existent file should fail")
-	assert.Contains(t, output, "failed", "should indicate failure")
+	require.ErrorIs(t, err, os.ErrNotExist, "importing non-existent file should fail")
 
 	// Verify filesystem structure
 	defaultVaultDir := filepath.Join(tempDir, "vaults.d", "default")
@@ -1905,11 +1895,10 @@ func test23ErrorHandling(t *testing.T, tempDir, secretPath, testMnemonic string,
 	t.Helper()
 
 	// Get non-existent secret
-	output, err := runSecretWithEnv(map[string]string{
+	_, err := runSecretWithEnv(map[string]string{
 		secret.EnvMnemonic: testMnemonic,
 	}, "get", "nonexistent/secret")
-	require.Error(t, err, "get non-existent secret should fail")
-	assert.Contains(t, output, "not found", "should indicate secret not found")
+	require.ErrorIs(t, err, vault.ErrSecretNotFound, "get non-existent secret should fail")
 
 	// Add secret without mnemonic or unlocker
 	unsetMnemonic := os.Getenv(secret.EnvMnemonic)
@@ -1939,13 +1928,12 @@ func test23ErrorHandling(t *testing.T, tempDir, secretPath, testMnemonic string,
 	// Invalid secret names (already tested in test 12)
 
 	// Non-existent vault operations
-	output, err = runSecret("vault", "select", "nonexistent")
-	require.Error(t, err, "select non-existent vault should fail")
-	assert.Contains(t, output, "does not exist", "should indicate vault doesn't exist")
+	_, err = runSecret("vault", "select", "nonexistent")
+	require.ErrorIs(t, err, vault.ErrVaultNotFound, "select non-existent vault should fail")
 
 	// Import to non-existent vault with test passphrase
 	testPassphrase := "test-passphrase-123" // Define testPassphrase locally
-	output, err = runSecretWithEnv(map[string]string{
+	output, err := runSecretWithEnv(map[string]string{
 		secret.EnvMnemonic:         testMnemonic,
 		secret.EnvUnlockPassphrase: testPassphrase,
 	}, "vault", "import", "nonexistent")
@@ -1953,11 +1941,10 @@ func test23ErrorHandling(t *testing.T, tempDir, secretPath, testMnemonic string,
 	assert.Contains(t, output, "does not exist", "should indicate vault doesn't exist")
 
 	// Get specific version that doesn't exist
-	output, err = runSecretWithEnv(map[string]string{
+	_, err = runSecretWithEnv(map[string]string{
 		secret.EnvMnemonic: testMnemonic,
 	}, "get", "--version", "99999999.999", "database/password")
-	require.Error(t, err, "get non-existent version should fail")
-	assert.Contains(t, output, "not found", "should indicate version not found")
+	require.ErrorIs(t, err, vault.ErrVersionNotFound, "get non-existent version should fail")
 
 	// Promote non-existent version
 	output, err = runSecretWithEnv(map[string]string{
@@ -2367,11 +2354,10 @@ func test30BackupRestore(t *testing.T, tempDir, secretPath, testMnemonic string,
 	assert.NotEmpty(t, output, "restored secret should have value")
 
 	// Verify post-backup secret is gone
-	output, err = runSecretWithEnv(map[string]string{
+	_, err = runSecretWithEnv(map[string]string{
 		secret.EnvMnemonic: testMnemonic,
 	}, "get", "post-backup/secret")
-	require.Error(t, err, "post-backup secret should not exist after restore")
-	assert.Contains(t, output, "not found", "should indicate secret not found")
+	require.ErrorIs(t, err, vault.ErrSecretNotFound, "post-backup secret should not exist after restore")
 
 	t.Log("Backup and restore completed successfully")
 }
@@ -2436,8 +2422,7 @@ func test31EnvMnemonicUsesVaultDerivationIndex(t *testing.T, tempDir, secretPath
 		t.Logf("Output: %s", getOutput)
 
 		// This is the expected behavior with the current bug
-		require.Error(t, err, "get should fail due to wrong derivation index")
-		assert.Contains(t, getOutput, "derived public key does not match vault", "should indicate key derivation failure")
+		require.ErrorIs(t, err, vault.ErrMnemonicMismatch, "get should fail due to wrong derivation index")
 
 		// Document what should happen when the bug is fixed
 		t.Log("When the bug is fixed, GetValue should read vault metadata and use derivation index 1")

internal/cli/path_traversal_test.go

@@ -154,11 +154,10 @@ func newFsFromSnapshot(t *testing.T, tree map[string]string) afero.Fs {
 }
 
 // requireRejectedAndUnchanged runs a command on a copy of the state
-// directory recorded in before. It requires an error with exactly the
-// message of want, so that a later check rejecting the argument does not
-// count, and everything under the state directory as it was: the error
-// alone proves nothing, since it could come after the vault had already
-// been deleted.
+// directory recorded in before. It requires the error want, so that a later
+// check rejecting the argument does not count, and everything under the
+// state directory as it was: the error alone proves nothing, since it could
+// come after the vault had already been deleted.
 func requireRejectedAndUnchanged(
 	t *testing.T, before map[string]string, want error,
 	run func(c *cli.Instance) error,
@@ -170,7 +169,7 @@ func requireRejectedAndUnchanged(
 	err := run(cli.NewCLIInstanceWithStateDir(fs, testStateDir))
 
 	require.Equal(t, before, snapshotStateDir(t, fs))
-	require.EqualError(t, err, want.Error())
+	require.ErrorIs(t, err, want)
 }
 
 // TestInvalidSecretNameLeavesVaultsUnchanged is a regression test for
@@ -193,77 +192,76 @@ func TestInvalidSecretNameLeavesVaultsUnchanged(t *testing.T) {
 	cmd := &cobra.Command{}
 
 	tests := []struct {
-		command  string
-		rejected string // the secret name the command must reject
-		run      func(c *cli.Instance) error
+		command string
+		run     func(c *cli.Instance) error
 	}{
-		{"rm --force ..", "..", func(c *cli.Instance) error {
+		{"rm --force ..", func(c *cli.Instance) error {
 			return c.RemoveSecret(cmd, "..", true)
 		}},
-		{"rm --force .", ".", func(c *cli.Instance) error {
+		{"rm --force .", func(c *cli.Instance) error {
 			return c.RemoveSecret(cmd, ".", true)
 		}},
-		{`rm --force ""`, "", func(c *cli.Instance) error {
+		{`rm --force ""`, func(c *cli.Instance) error {
 			return c.RemoveSecret(cmd, "", true)
 		}},
-		{"rm --force ../../etc", "../../etc", func(c *cli.Instance) error {
+		{"rm --force ../../etc", func(c *cli.Instance) error {
 			return c.RemoveSecret(cmd, "../../etc", true)
 		}},
-		{"mv --force .. x", "..", func(c *cli.Instance) error {
+		{"mv --force .. x", func(c *cli.Instance) error {
 			return c.MoveSecret(cmd, "..", "x", true)
 		}},
-		{"mv --force x ..", "..", func(c *cli.Instance) error {
+		{"mv --force x ..", func(c *cli.Instance) error {
 			return c.MoveSecret(cmd, "x", "..", true)
 		}},
-		{`mv --force x ""`, "", func(c *cli.Instance) error {
+		{`mv --force x ""`, func(c *cli.Instance) error {
 			return c.MoveSecret(cmd, "x", "", true)
 		}},
 		// "work" is not the current vault: a move within it must not
 		// select it when a name is rejected.
-		{"mv --force work:.. work:x", "..", func(c *cli.Instance) error {
+		{"mv --force work:.. work:x", func(c *cli.Instance) error {
 			return c.MoveSecret(cmd, "work:..", "work:x", true)
 		}},
-		{"mv --force work:x work:..", "..", func(c *cli.Instance) error {
+		{"mv --force work:x work:..", func(c *cli.Instance) error {
 			return c.MoveSecret(cmd, "work:x", "work:..", true)
 		}},
-		{"mv --force default:.. work", "..", func(c *cli.Instance) error {
+		{"mv --force default:.. work", func(c *cli.Instance) error {
 			return c.MoveSecret(cmd, "default:..", "work", true)
 		}},
-		{"mv --force default:.. work:y", "..", func(c *cli.Instance) error {
+		{"mv --force default:.. work:y", func(c *cli.Instance) error {
 			return c.MoveSecret(cmd, "default:..", "work:y", true)
 		}},
-		{"mv --force default:x work:..", "..", func(c *cli.Instance) error {
+		{"mv --force default:x work:..", func(c *cli.Instance) error {
 			return c.MoveSecret(cmd, "default:x", "work:..", true)
 		}},
-		{"import --force ..", "..", func(c *cli.Instance) error {
+		{"import --force ..", func(c *cli.Instance) error {
 			return c.ImportSecret(cmd, "..", missingFile, true)
 		}},
-		{"import --force .", ".", func(c *cli.Instance) error {
+		{"import --force .", func(c *cli.Instance) error {
 			return c.ImportSecret(cmd, ".", missingFile, true)
 		}},
-		{"import --force ../../etc", "../../etc", func(c *cli.Instance) error {
+		{"import --force ../../etc", func(c *cli.Instance) error {
 			return c.ImportSecret(cmd, "../../etc", missingFile, true)
 		}},
-		{"version list ..", "..", func(c *cli.Instance) error {
+		{"version list ..", func(c *cli.Instance) error {
 			return c.ListVersions(cmd, "..")
 		}},
-		{"version promote ..", "..", func(c *cli.Instance) error {
+		{"version promote ..", func(c *cli.Instance) error {
 			return c.PromoteVersion(cmd, "..", testVersion)
 		}},
-		{"version rm --force ..", "..", func(c *cli.Instance) error {
+		{"version rm --force ..", func(c *cli.Instance) error {
 			return c.RemoveVersion(cmd, "..", testVersion, true)
 		}},
-		{"encrypt ..", "..", func(c *cli.Instance) error {
+		{"encrypt ..", func(c *cli.Instance) error {
 			return c.Encrypt("..", "", "")
 		}},
-		{"decrypt ..", "..", func(c *cli.Instance) error {
+		{"decrypt ..", func(c *cli.Instance) error {
 			return c.Decrypt("..", "", "")
 		}},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.command, func(t *testing.T) {
-			requireRejectedAndUnchanged(t, before, vault.ValidateSecretName(tt.rejected), tt.run)
+			requireRejectedAndUnchanged(t, before, vault.ErrInvalidSecretName, tt.run)
 		})
 	}
 }
@@ -299,10 +297,18 @@ func TestInvalidVersionLeavesVaultsUnchanged(t *testing.T) {
 	for _, tt := range commands {
 		for _, version := range []string{"", ".", "..", "../../..", "a/b"} {
 			t.Run(fmt.Sprintf("%s %q", tt.command, version), func(t *testing.T) {
+				fs := newFsFromSnapshot(t, before)
+
+				err := tt.run(cli.NewCLIInstanceWithStateDir(fs, testStateDir), version)
+
+				require.Equal(t, before, snapshotStateDir(t, fs))
+
+				// Compared as text: `version rm` and `version promote` return
+				// internal/cli's own error of this text, which errors.Is does
+				// not match to vault.ErrVersionNotFound.
 				want := fmt.Errorf("version '%s' %w '%s'",
 					version, vault.ErrVersionNotFound, "x")
-				requireRejectedAndUnchanged(t, before, want,
-					func(c *cli.Instance) error { return tt.run(c, version) })
+				require.EqualError(t, err, want.Error())
 			})
 		}
 	}
@@ -355,7 +361,7 @@ func TestInvalidVaultNameLeavesStateUnchanged(t *testing.T) {
 	for _, tt := range commands {
 		for _, name := range []string{"", ".", "..", "a/b"} {
 			t.Run(fmt.Sprintf(tt.command, name), func(t *testing.T) {
-				requireRejectedAndUnchanged(t, before, vault.ValidateVaultName(name),
+				requireRejectedAndUnchanged(t, before, vault.ErrInvalidVaultName,
 					func(c *cli.Instance) error {
 						c.Mnemonic = mnemonic
 						c.UnlockPassphrase = passphrase

internal/cli/secrets_size_test.go

@@ -93,8 +93,8 @@ func newSizeTestVault(t *testing.T) (afero.Fs, *vault.Vault) {
 }
 
 // runAddSecretSizeCase adds a secret of the given size through stdin and
-// verifies the outcome.
-func runAddSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string) {
+// verifies the outcome: wantErr, or the secret stored when wantErr is nil.
+func runAddSecretSizeCase(t *testing.T, size int, wantErr error) {
 	t.Helper()
 	skipIfLockedMemoryTooLow(t, size)
 
@@ -128,9 +128,8 @@ func runAddSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string) {
 	secretName := fmt.Sprintf("test-secret-%d", size)
 	err = cli.AddSecret(secretName, false)
 
-	if wantErr {
-		require.Error(t, err)
-		assert.Contains(t, err.Error(), errMsg)
+	if wantErr != nil {
+		require.ErrorIs(t, err, wantErr)
 
 		return
 	}
@@ -148,8 +147,8 @@ func runAddSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string) {
 }
 
 // runImportSecretSizeCase imports a secret file of the given size and
-// verifies the outcome.
-func runImportSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string) {
+// verifies the outcome: wantErr, or the secret stored when wantErr is nil.
+func runImportSecretSizeCase(t *testing.T, size int, wantErr error) {
 	t.Helper()
 	skipIfLockedMemoryTooLow(t, size)
 
@@ -181,9 +180,8 @@ func runImportSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string
 	secretName := fmt.Sprintf("imported-secret-%d", size)
 	err = cli.ImportSecret(cmd, secretName, testFile, false)
 
-	if wantErr {
-		require.Error(t, err)
-		assert.Contains(t, err.Error(), errMsg)
+	if wantErr != nil {
+		require.ErrorIs(t, err, wantErr)
 
 		return
 	}
@@ -205,57 +203,48 @@ func runImportSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string
 //nolint:paralleltest // together the subtests lock more than the memlock limit
 func TestAddSecretVariousSizes(t *testing.T) {
 	tests := []struct {
-		name        string
-		size        int
-		shouldError bool
-		errorMsg    string
+		name    string
+		size    int
+		wantErr error
 	}{
 		{
-			name:        "1KB secret",
-			size:        1024,
-			shouldError: false,
+			name: "1KB secret",
+			size: 1024,
 		},
 		{
-			name:        "10KB secret",
-			size:        10 * 1024,
-			shouldError: false,
+			name: "10KB secret",
+			size: 10 * 1024,
 		},
 		{
-			name:        "100KB secret",
-			size:        100 * 1024,
-			shouldError: false,
+			name: "100KB secret",
+			size: 100 * 1024,
 		},
 		{
-			name:        "1MB secret",
-			size:        1024 * 1024,
-			shouldError: false,
+			name: "1MB secret",
+			size: 1024 * 1024,
 		},
 		{
-			name:        "10MB secret",
-			size:        10 * 1024 * 1024,
-			shouldError: false,
+			name: "10MB secret",
+			size: 10 * 1024 * 1024,
 		},
 		{
-			name:        "99MB secret",
-			size:        99 * 1024 * 1024,
-			shouldError: false,
+			name: "99MB secret",
+			size: 99 * 1024 * 1024,
 		},
 		{
-			name:        "100MB secret minus 1 byte",
-			size:        100*1024*1024 - 1,
-			shouldError: false,
+			name: "100MB secret minus 1 byte",
+			size: 100*1024*1024 - 1,
 		},
 		{
-			name:        "101MB secret - should fail",
-			size:        101 * 1024 * 1024,
-			shouldError: true,
-			errorMsg:    "secret too large: exceeds 100MB limit",
+			name:    "101MB secret - should fail",
+			size:    101 * 1024 * 1024,
+			wantErr: errSecretTooLarge,
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			runAddSecretSizeCase(t, tt.size, tt.shouldError, tt.errorMsg)
+			runAddSecretSizeCase(t, tt.size, tt.wantErr)
 		})
 	}
 }
@@ -265,57 +254,48 @@ func TestAddSecretVariousSizes(t *testing.T) {
 //nolint:paralleltest // together the subtests lock more than the memlock limit
 func TestImportSecretVariousSizes(t *testing.T) {
 	tests := []struct {
-		name        string
-		size        int
-		shouldError bool
-		errorMsg    string
+		name    string
+		size    int
+		wantErr error
 	}{
 		{
-			name:        "1KB file",
-			size:        1024,
-			shouldError: false,
+			name: "1KB file",
+			size: 1024,
 		},
 		{
-			name:        "10KB file",
-			size:        10 * 1024,
-			shouldError: false,
+			name: "10KB file",
+			size: 10 * 1024,
 		},
 		{
-			name:        "100KB file",
-			size:        100 * 1024,
-			shouldError: false,
+			name: "100KB file",
+			size: 100 * 1024,
 		},
 		{
-			name:        "1MB file",
-			size:        1024 * 1024,
-			shouldError: false,
+			name: "1MB file",
+			size: 1024 * 1024,
 		},
 		{
-			name:        "10MB file",
-			size:        10 * 1024 * 1024,
-			shouldError: false,
+			name: "10MB file",
+			size: 10 * 1024 * 1024,
 		},
 		{
-			name:        "99MB file",
-			size:        99 * 1024 * 1024,
-			shouldError: false,
+			name: "99MB file",
+			size: 99 * 1024 * 1024,
 		},
 		{
-			name:        "100MB file",
-			size:        100 * 1024 * 1024,
-			shouldError: false,
+			name: "100MB file",
+			size: 100 * 1024 * 1024,
 		},
 		{
-			name:        "101MB file - should fail",
-			size:        101 * 1024 * 1024,
-			shouldError: true,
-			errorMsg:    "secret file too large: exceeds 100MB limit",
+			name:    "101MB file - should fail",
+			size:    101 * 1024 * 1024,
+			wantErr: errSecretFileTooLarge,
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			runImportSecretSizeCase(t, tt.size, tt.shouldError, tt.errorMsg)
+			runImportSecretSizeCase(t, tt.size, tt.wantErr)
 		})
 	}
 }

internal/cli/version_test.go

@@ -171,8 +171,7 @@ func TestListVersionsNonExistentSecret(t *testing.T) {
 
 	// Try to list versions of non-existent secret
 	err := cli.ListVersions(cmd, "nonexistent/secret")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "not found")
+	require.ErrorIs(t, err, errSecretNotFound)
 }
 
 func TestPromoteVersionCommand(t *testing.T) {
@@ -266,8 +265,7 @@ func TestPromoteNonExistentVersion(t *testing.T) {
 
 	// Try to promote non-existent version
 	err = cli.PromoteVersion(cmd, "test/secret", "20991231.999")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "not found")
+	require.ErrorIs(t, err, errVersionNotFound)
 }
 
 func TestGetSecretWithVersion(t *testing.T) {