Update golangci-lint to v2.12.2 with canonical config

- Replace .golangci.yml with the canonical strict config (all linters
  enabled except the standard disable list; lll 88, funlen 80/50,
  cyclop 15, dupl 100; test files now linted)
- Pin the Dockerfile lint stage to golangci/golangci-lint:v2.12.2 by
  tag and digest (Debian-based)
- Fix all ~1550 findings surfaced by the new config: line wrapping,
  wsl_v5/nlreturn blank lines, noinlineerr splits, err113 sentinel
  errors, perfsprint/modernize rewrites, goconst constants, thelper,
  testifylint, noctx CommandContext, testpackage conversions,
  t.Parallel() where safe, and complexity/dupl helper extraction
- Record the change and follow-up items in TODO.md

internal/cli/crypto.go

@@ -1,6 +1,7 @@
 package cli
 
 import (
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -12,11 +13,22 @@ import (
 	"github.com/spf13/cobra"
 )
 
-func newEncryptCmd() *cobra.Command {
+// Sentinel errors for encrypt/decrypt operations
+var (
+	errNotAgeSecretKey = errors.New(
+		"does not contain a valid age secret key")
+	errSecretDoesNotExist = errors.New("does not exist")
+)
+
+// newCryptoCmd builds an encrypt/decrypt command with input/output flags
+func newCryptoCmd(
+	use, short, long string,
+	run func(cli *Instance, secretName, inputFile, outputFile string) error,
+) *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "encrypt <secret-name>",
-		Short: "Encrypt data using an age secret key stored in a secret",
-		Long:  `Encrypt data using an age secret key. If the secret doesn't exist, a new age key is generated and stored.`,
+		Use:   use,
+		Short: short,
+		Long:  long,
 		Args:  cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			inputFile, _ := cmd.Flags().GetString("input")
@@ -26,9 +38,10 @@ func newEncryptCmd() *cobra.Command {
 			if err != nil {
 				return fmt.Errorf("failed to initialize CLI: %w", err)
 			}
+
 			cli.cmd = cmd
 
-			return cli.Encrypt(args[0], inputFile, outputFile)
+			return run(cli, args[0], inputFile, outputFile)
 		},
 	}
 
@@ -38,30 +51,73 @@ func newEncryptCmd() *cobra.Command {
 	return cmd
 }
 
+func newEncryptCmd() *cobra.Command {
+	return newCryptoCmd(
+		"encrypt <secret-name>",
+		"Encrypt data using an age secret key stored in a secret",
+		"Encrypt data using an age secret key. If the secret doesn't "+
+			"exist, a new age key is generated and stored.",
+		(*Instance).Encrypt,
+	)
+}
+
 func newDecryptCmd() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "decrypt <secret-name>",
-		Short: "Decrypt data using an age secret key stored in a secret",
-		Long:  `Decrypt data using an age secret key stored in the specified secret.`,
-		Args:  cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			inputFile, _ := cmd.Flags().GetString("input")
-			outputFile, _ := cmd.Flags().GetString("output")
+	return newCryptoCmd(
+		"decrypt <secret-name>",
+		"Decrypt data using an age secret key stored in a secret",
+		"Decrypt data using an age secret key stored in the specified secret.",
+		(*Instance).Decrypt,
+	)
+}
 
-			cli, err := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
-			cli.cmd = cmd
+// resolveEncryptionKey returns a secure buffer holding the age secret key
+// for the named secret, generating and storing a new key if the secret
+// does not exist. The caller must destroy the returned buffer.
+func (cli *Instance) resolveEncryptionKey(
+	vlt *vault.Vault, secretName string,
+) (*memguard.LockedBuffer, error) {
+	// Check if secret exists
+	secretObj := secret.NewSecret(vlt, secretName)
 
-			return cli.Decrypt(args[0], inputFile, outputFile)
-		},
+	exists, err := secretObj.Exists()
+	if err != nil {
+		return nil, fmt.Errorf("failed to check if secret exists: %w", err)
 	}
 
-	cmd.Flags().StringP("input", "i", "", "Input file (default: stdin)")
-	cmd.Flags().StringP("output", "o", "", "Output file (default: stdout)")
+	if !exists {
+		// Secret doesn't exist, generate new age key and store it
+		identity, err := age.GenerateX25519Identity()
+		if err != nil {
+			return nil, fmt.Errorf("failed to generate age key: %w", err)
+		}
 
-	return cmd
+		// Store the generated key directly in a secure buffer
+		secureBuffer := memguard.NewBufferFromBytes([]byte(identity.String()))
+
+		err = vlt.AddSecret(secretName, secureBuffer, false)
+		if err != nil {
+			secureBuffer.Destroy()
+
+			return nil, fmt.Errorf("failed to store age key: %w", err)
+		}
+
+		return secureBuffer, nil
+	}
+
+	// Secret exists, get the age secret key from it
+	secretBuffer, err := cli.getSecretValue(vlt, secretObj)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get secret value: %w", err)
+	}
+
+	// Validate that it's a valid age secret key
+	if !isValidAgeSecretKey(secretBuffer.String()) {
+		secretBuffer.Destroy()
+
+		return nil, fmt.Errorf("secret '%s' %w", secretName, errNotAgeSecretKey)
+	}
+
+	return secretBuffer, nil
 }
 
 // Encrypt encrypts data using an age secret key stored in a secret
@@ -72,55 +128,15 @@ func (cli *Instance) Encrypt(secretName, inputFile, outputFile string) error {
 		return err
 	}
 
-	var ageSecretKey string
-
-	// Check if secret exists
-	secretObj := secret.NewSecret(vlt, secretName)
-	exists, err := secretObj.Exists()
+	// Get or create the age secret key for this secret
+	keyBuffer, err := cli.resolveEncryptionKey(vlt, secretName)
 	if err != nil {
-		return fmt.Errorf("failed to check if secret exists: %w", err)
+		return err
 	}
+	defer keyBuffer.Destroy()
 
-	if !exists { //nolint:nestif // Clear conditional logic for secret generation vs retrieval
-		// Secret doesn't exist, generate new age key and store it
-		identity, err := age.GenerateX25519Identity()
-		if err != nil {
-			return fmt.Errorf("failed to generate age key: %w", err)
-		}
-
-		// Store the generated key directly in a secure buffer
-		identityStr := identity.String()
-		secureBuffer := memguard.NewBufferFromBytes([]byte(identityStr))
-		defer secureBuffer.Destroy()
-
-		// Set ageSecretKey for later use (we need it for encryption)
-		ageSecretKey = identityStr
-
-		err = vlt.AddSecret(secretName, secureBuffer, false)
-		if err != nil {
-			return fmt.Errorf("failed to store age key: %w", err)
-		}
-	} else {
-		// Secret exists, get the age secret key from it
-		secretBuffer, err := cli.getSecretValue(vlt, secretObj)
-		if err != nil {
-			return fmt.Errorf("failed to get secret value: %w", err)
-		}
-		defer secretBuffer.Destroy()
-
-		ageSecretKey = secretBuffer.String()
-
-		// Validate that it's a valid age secret key
-		if !isValidAgeSecretKey(ageSecretKey) {
-			return fmt.Errorf("secret '%s' does not contain a valid age secret key", secretName)
-		}
-	}
-
-	// Parse the secret key using secure buffer
-	finalSecureBuffer := memguard.NewBufferFromBytes([]byte(ageSecretKey))
-	defer finalSecureBuffer.Destroy()
-
-	identity, err := age.ParseX25519Identity(finalSecureBuffer.String())
+	// Parse the secret key
+	identity, err := age.ParseX25519Identity(keyBuffer.String())
 	if err != nil {
 		return fmt.Errorf("failed to parse age secret key: %w", err)
 	}
@@ -130,23 +146,27 @@ func (cli *Instance) Encrypt(secretName, inputFile, outputFile string) error {
 
 	// Set up input reader
 	var input io.Reader = os.Stdin
+
 	if inputFile != "" {
 		file, err := cli.fs.Open(inputFile)
 		if err != nil {
 			return fmt.Errorf("failed to open input file: %w", err)
 		}
 		defer func() { _ = file.Close() }()
+
 		input = file
 	}
 
 	// Set up output writer
 	output := cli.cmd.OutOrStdout()
+
 	if outputFile != "" {
 		file, err := cli.fs.Create(outputFile)
 		if err != nil {
 			return fmt.Errorf("failed to create output file: %w", err)
 		}
 		defer func() { _ = file.Close() }()
+
 		output = file
 	}
 
@@ -156,11 +176,13 @@ func (cli *Instance) Encrypt(secretName, inputFile, outputFile string) error {
 		return fmt.Errorf("failed to create age encryptor: %w", err)
 	}
 
-	if _, err := io.Copy(encryptor, input); err != nil {
+	_, err = io.Copy(encryptor, input)
+	if err != nil {
 		return fmt.Errorf("failed to encrypt data: %w", err)
 	}
 
-	if err := encryptor.Close(); err != nil {
+	err = encryptor.Close()
+	if err != nil {
 		return fmt.Errorf("failed to finalize encryption: %w", err)
 	}
 
@@ -177,26 +199,18 @@ func (cli *Instance) Decrypt(secretName, inputFile, outputFile string) error {
 
 	// Check if secret exists
 	secretObj := secret.NewSecret(vlt, secretName)
+
 	exists, err := secretObj.Exists()
 	if err != nil {
 		return fmt.Errorf("failed to check if secret exists: %w", err)
 	}
 
 	if !exists {
-		return fmt.Errorf("secret '%s' does not exist", secretName)
+		return fmt.Errorf("secret '%s' %w", secretName, errSecretDoesNotExist)
 	}
 
 	// Get the age secret key from the secret
-	var secretBuffer *memguard.LockedBuffer
-	if os.Getenv(secret.EnvMnemonic) != "" {
-		secretBuffer, err = secretObj.GetValue(nil)
-	} else {
-		unlocker, unlockErr := vlt.GetCurrentUnlocker()
-		if unlockErr != nil {
-			return fmt.Errorf("failed to get current unlocker: %w", unlockErr)
-		}
-		secretBuffer, err = secretObj.GetValue(unlocker)
-	}
+	secretBuffer, err := cli.getSecretValue(vlt, secretObj)
 	if err != nil {
 		return fmt.Errorf("failed to get secret value: %w", err)
 	}
@@ -204,7 +218,7 @@ func (cli *Instance) Decrypt(secretName, inputFile, outputFile string) error {
 
 	// Validate that it's a valid age secret key
 	if !isValidAgeSecretKey(secretBuffer.String()) {
-		return fmt.Errorf("secret '%s' does not contain a valid age secret key", secretName)
+		return fmt.Errorf("secret '%s' %w", secretName, errNotAgeSecretKey)
 	}
 
 	// Parse the age secret key to get the identity
@@ -215,23 +229,27 @@ func (cli *Instance) Decrypt(secretName, inputFile, outputFile string) error {
 
 	// Set up input reader
 	var input io.Reader = os.Stdin
+
 	if inputFile != "" {
 		file, err := cli.fs.Open(inputFile)
 		if err != nil {
 			return fmt.Errorf("failed to open input file: %w", err)
 		}
 		defer func() { _ = file.Close() }()
+
 		input = file
 	}
 
 	// Set up output writer
 	output := cli.cmd.OutOrStdout()
+
 	if outputFile != "" {
 		file, err := cli.fs.Create(outputFile)
 		if err != nil {
 			return fmt.Errorf("failed to create output file: %w", err)
 		}
 		defer func() { _ = file.Close() }()
+
 		output = file
 	}
 
@@ -241,22 +259,27 @@ func (cli *Instance) Decrypt(secretName, inputFile, outputFile string) error {
 		return fmt.Errorf("failed to create age decryptor: %w", err)
 	}
 
-	if _, err := io.Copy(output, decryptor); err != nil {
+	_, err = io.Copy(output, decryptor)
+	if err != nil {
 		return fmt.Errorf("failed to decrypt data: %w", err)
 	}
 
 	return nil
 }
 
-// isValidAgeSecretKey checks if a string is a valid age secret key by attempting to parse it
+// isValidAgeSecretKey checks if a string is a valid age secret key by
+// attempting to parse it
 func isValidAgeSecretKey(key string) bool {
 	_, err := age.ParseX25519Identity(key)
 
 	return err == nil
 }
 
-// getSecretValue retrieves the value of a secret using the appropriate unlocker
-func (cli *Instance) getSecretValue(vlt *vault.Vault, secretObj *secret.Secret) (*memguard.LockedBuffer, error) {
+// getSecretValue retrieves the value of a secret using the appropriate
+// unlocker
+func (cli *Instance) getSecretValue(
+	vlt *vault.Vault, secretObj *secret.Secret,
+) (*memguard.LockedBuffer, error) {
 	if os.Getenv(secret.EnvMnemonic) != "" {
 		return secretObj.GetValue(nil)
 	}