Update golangci-lint to v2.12.2 with canonical config

- Replace .golangci.yml with the canonical strict config (all linters
  enabled except the standard disable list; lll 88, funlen 80/50,
  cyclop 15, dupl 100; test files now linted)
- Pin the Dockerfile lint stage to golangci/golangci-lint:v2.12.2 by
  tag and digest (Debian-based)
- Fix all ~1550 findings surfaced by the new config: line wrapping,
  wsl_v5/nlreturn blank lines, noinlineerr splits, err113 sentinel
  errors, perfsprint/modernize rewrites, goconst constants, thelper,
  testifylint, noctx CommandContext, testpackage conversions,
  t.Parallel() where safe, and complexity/dupl helper extraction
- Record the change and follow-up items in TODO.md

internal/vault/vault_test.go

@@ -1,268 +1,301 @@
-package vault
+package vault_test
 
 import (
 	"path/filepath"
+	"slices"
 	"testing"
 
 	"git.eeqj.de/sneak/secret/internal/secret"
+	"git.eeqj.de/sneak/secret/internal/vault"
 	"git.eeqj.de/sneak/secret/pkg/agehd"
 	"github.com/awnumar/memguard"
 	"github.com/spf13/afero"
 )
 
+// testMnemonic is the shared BIP39 test mnemonic for tests in this package.
+//
+//nolint:dupword // BIP39 test mnemonic intentionally repeats a word
+const testMnemonic = "abandon abandon abandon abandon abandon abandon abandon " +
+	"abandon abandon abandon abandon about"
+
+// Shared fixtures for tests in this package.
+const (
+	testStateDir   = "/test/state"
+	testVaultName  = "test-vault"
+	testSecretName = "test-secret"
+	testPassphrase = "test-passphrase"
+)
+
+//nolint:paralleltest // t.Setenv and order-dependent subtests forbid parallel
 func TestVaultOperations(t *testing.T) {
 	// Test environment will be cleaned up automatically by t.Setenv
-
-	// Set test environment variables
-	testMnemonic := "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"
 	t.Setenv(secret.EnvMnemonic, testMnemonic)
-	t.Setenv(secret.EnvUnlockPassphrase, "test-passphrase")
+	t.Setenv(secret.EnvUnlockPassphrase, testPassphrase)
 
 	// Use in-memory filesystem
 	fs := afero.NewMemMapFs()
-	stateDir := "/test/state"
 
-	// Test vault creation
 	t.Run("CreateVault", func(t *testing.T) {
-		vlt, err := CreateVault(fs, stateDir, "test-vault")
-		if err != nil {
-			t.Fatalf("Failed to create vault: %v", err)
-		}
-
-		if vlt.GetName() != "test-vault" {
-			t.Errorf("Expected vault name 'test-vault', got '%s'", vlt.GetName())
-		}
-
-		// Check vault directory exists
-		vaultDir, err := vlt.GetDirectory()
-		if err != nil {
-			t.Fatalf("Failed to get vault directory: %v", err)
-		}
-
-		exists, err := afero.DirExists(fs, vaultDir)
-		if err != nil {
-			t.Fatalf("Failed to check vault directory: %v", err)
-		}
-
-		if !exists {
-			t.Errorf("Vault directory should exist")
-		}
+		testCreateVault(t, fs)
 	})
 
-	// Test vault listing
 	t.Run("ListVaults", func(t *testing.T) {
-		vaults, err := ListVaults(fs, stateDir)
-		if err != nil {
-			t.Fatalf("Failed to list vaults: %v", err)
-		}
-
-		found := false
-		for _, vault := range vaults {
-			if vault == "test-vault" {
-				found = true
-				break
-			}
-		}
-
-		if !found {
-			t.Errorf("Expected to find 'test-vault' in vault list")
-		}
+		testListVaults(t, fs)
 	})
 
-	// Test vault selection
 	t.Run("SelectVault", func(t *testing.T) {
-		err := SelectVault(fs, stateDir, "test-vault")
-		if err != nil {
-			t.Fatalf("Failed to select vault: %v", err)
-		}
-
-		// Test getting current vault
-		currentVault, err := GetCurrentVault(fs, stateDir)
-		if err != nil {
-			t.Fatalf("Failed to get current vault: %v", err)
-		}
-
-		if currentVault.GetName() != "test-vault" {
-			t.Errorf("Expected current vault 'test-vault', got '%s'", currentVault.GetName())
-		}
+		testSelectVault(t, fs)
 	})
 
-	// Test secret operations
 	t.Run("SecretOperations", func(t *testing.T) {
-		vlt, err := GetCurrentVault(fs, stateDir)
-		if err != nil {
-			t.Fatalf("Failed to get current vault: %v", err)
-		}
-
-		// First, derive the long-term key from the test mnemonic
-		ltIdentity, err := agehd.DeriveIdentity(testMnemonic, 0)
-		if err != nil {
-			t.Fatalf("Failed to derive long-term key: %v", err)
-		}
-
-		// Get the public key from the derived identity
-		ltPublicKey := ltIdentity.Recipient().String()
-
-		// Get the vault directory
-		vaultDir, err := vlt.GetDirectory()
-		if err != nil {
-			t.Fatalf("Failed to get vault directory: %v", err)
-		}
-
-		// Write the correct public key to the pub.age file
-		pubKeyPath := filepath.Join(vaultDir, "pub.age")
-		err = afero.WriteFile(fs, pubKeyPath, []byte(ltPublicKey), secret.FilePerms)
-		if err != nil {
-			t.Fatalf("Failed to write long-term public key: %v", err)
-		}
-
-		// Unlock the vault with the derived identity
-		vlt.Unlock(ltIdentity)
-
-		// Now add a secret
-		secretName := "test/secret"
-		secretValue := []byte("test-secret-value")
-		expectedValue := make([]byte, len(secretValue))
-		copy(expectedValue, secretValue)
-
-		secretBuffer := memguard.NewBufferFromBytes(secretValue)
-		defer secretBuffer.Destroy()
-
-		err = vlt.AddSecret(secretName, secretBuffer, false)
-		if err != nil {
-			t.Fatalf("Failed to add secret: %v", err)
-		}
-
-		// List secrets
-		secrets, err := vlt.ListSecrets()
-		if err != nil {
-			t.Fatalf("Failed to list secrets: %v", err)
-		}
-
-		found := false
-		for _, secret := range secrets {
-			if secret == secretName {
-				found = true
-				break
-			}
-		}
-
-		if !found {
-			t.Errorf("Expected to find secret '%s' in list", secretName)
-		}
-
-		// Get secret value
-		retrievedValue, err := vlt.GetSecret(secretName)
-		if err != nil {
-			t.Fatalf("Failed to get secret: %v", err)
-		}
-
-		if string(retrievedValue) != string(expectedValue) {
-			t.Errorf("Expected secret value '%s', got '%s'", string(expectedValue), string(retrievedValue))
-		}
+		testSecretOperations(t, fs)
 	})
 
-	// Test NumSecrets
 	t.Run("NumSecrets", func(t *testing.T) {
-		vlt, err := GetCurrentVault(fs, stateDir)
-		if err != nil {
-			t.Fatalf("Failed to get current vault: %v", err)
-		}
-
-		numSecrets, err := vlt.NumSecrets()
-		if err != nil {
-			t.Fatalf("Failed to count secrets: %v", err)
-		}
-
-		// We added one secret in SecretOperations
-		if numSecrets != 1 {
-			t.Errorf("Expected 1 secret, got %d", numSecrets)
-		}
+		testNumSecrets(t, fs)
 	})
 
-	// Test unlocker operations
 	t.Run("UnlockerOperations", func(t *testing.T) {
-		vlt, err := GetCurrentVault(fs, stateDir)
-		if err != nil {
-			t.Fatalf("Failed to get current vault: %v", err)
-		}
-
-		// Test vault unlocking (should happen automatically via mnemonic)
-		if vlt.Locked() {
-			_, err := vlt.UnlockVault()
-			if err != nil {
-				t.Fatalf("Failed to unlock vault: %v", err)
-			}
-		}
-
-		// Create a passphrase unlocker
-		passphraseBuffer := memguard.NewBufferFromBytes([]byte("test-passphrase"))
-		defer passphraseBuffer.Destroy()
-		passphraseUnlocker, err := vlt.CreatePassphraseUnlocker(passphraseBuffer)
-		if err != nil {
-			t.Fatalf("Failed to create passphrase unlocker: %v", err)
-		}
-
-		// List unlockers
-		unlockers, err := vlt.ListUnlockers()
-		if err != nil {
-			t.Fatalf("Failed to list unlockers: %v", err)
-		}
-
-		if len(unlockers) == 0 {
-			t.Errorf("Expected at least one unlocker")
-		}
-
-		// Check key type
-		keyFound := false
-		for _, key := range unlockers {
-			if key.Type == "passphrase" {
-				keyFound = true
-				break
-			}
-		}
-
-		if !keyFound {
-			t.Errorf("Expected to find passphrase unlocker")
-		}
-
-		// Test selecting unlocker
-		err = vlt.SelectUnlocker(passphraseUnlocker.GetID())
-		if err != nil {
-			t.Fatalf("Failed to select unlocker: %v", err)
-		}
-
-		// Test getting current unlocker
-		currentUnlocker, err := vlt.GetCurrentUnlocker()
-		if err != nil {
-			t.Fatalf("Failed to get current unlocker: %v", err)
-		}
-
-		if currentUnlocker.GetID() != passphraseUnlocker.GetID() {
-			t.Errorf("Expected current unlocker ID '%s', got '%s'", passphraseUnlocker.GetID(), currentUnlocker.GetID())
-		}
+		testUnlockerOperations(t, fs)
 	})
 }
 
+func testCreateVault(t *testing.T, fs afero.Fs) {
+	t.Helper()
+
+	vlt, err := vault.CreateVault(fs, testStateDir, testVaultName)
+	if err != nil {
+		t.Fatalf("Failed to create vault: %v", err)
+	}
+
+	if vlt.GetName() != testVaultName {
+		t.Errorf("Expected vault name '%s', got '%s'", testVaultName, vlt.GetName())
+	}
+
+	// Check vault directory exists
+	vaultDir, err := vlt.GetDirectory()
+	if err != nil {
+		t.Fatalf("Failed to get vault directory: %v", err)
+	}
+
+	exists, err := afero.DirExists(fs, vaultDir)
+	if err != nil {
+		t.Fatalf("Failed to check vault directory: %v", err)
+	}
+
+	if !exists {
+		t.Errorf("Vault directory should exist")
+	}
+}
+
+func testListVaults(t *testing.T, fs afero.Fs) {
+	t.Helper()
+
+	vaults, err := vault.ListVaults(fs, testStateDir)
+	if err != nil {
+		t.Fatalf("Failed to list vaults: %v", err)
+	}
+
+	if !slices.Contains(vaults, testVaultName) {
+		t.Errorf("Expected to find '%s' in vault list", testVaultName)
+	}
+}
+
+func testSelectVault(t *testing.T, fs afero.Fs) {
+	t.Helper()
+
+	err := vault.SelectVault(fs, testStateDir, testVaultName)
+	if err != nil {
+		t.Fatalf("Failed to select vault: %v", err)
+	}
+
+	// Test getting current vault
+	currentVault, err := vault.GetCurrentVault(fs, testStateDir)
+	if err != nil {
+		t.Fatalf("Failed to get current vault: %v", err)
+	}
+
+	if currentVault.GetName() != testVaultName {
+		t.Errorf("Expected current vault '%s', got '%s'",
+			testVaultName, currentVault.GetName())
+	}
+}
+
+func testSecretOperations(t *testing.T, fs afero.Fs) {
+	t.Helper()
+
+	vlt, err := vault.GetCurrentVault(fs, testStateDir)
+	if err != nil {
+		t.Fatalf("Failed to get current vault: %v", err)
+	}
+
+	// First, derive the long-term key from the test mnemonic
+	ltIdentity, err := agehd.DeriveIdentity(testMnemonic, 0)
+	if err != nil {
+		t.Fatalf("Failed to derive long-term key: %v", err)
+	}
+
+	// Get the public key from the derived identity
+	ltPublicKey := ltIdentity.Recipient().String()
+
+	// Get the vault directory
+	vaultDir, err := vlt.GetDirectory()
+	if err != nil {
+		t.Fatalf("Failed to get vault directory: %v", err)
+	}
+
+	// Write the correct public key to the pub.age file
+	pubKeyPath := filepath.Join(vaultDir, "pub.age")
+
+	err = afero.WriteFile(fs, pubKeyPath, []byte(ltPublicKey), secret.FilePerms)
+	if err != nil {
+		t.Fatalf("Failed to write long-term public key: %v", err)
+	}
+
+	// Unlock the vault with the derived identity
+	vlt.Unlock(ltIdentity)
+
+	// Now add a secret
+	secretName := "test/secret"
+	secretValue := []byte("test-secret-value")
+	expectedValue := make([]byte, len(secretValue))
+	copy(expectedValue, secretValue)
+
+	secretBuffer := memguard.NewBufferFromBytes(secretValue)
+	defer secretBuffer.Destroy()
+
+	err = vlt.AddSecret(secretName, secretBuffer, false)
+	if err != nil {
+		t.Fatalf("Failed to add secret: %v", err)
+	}
+
+	// List secrets
+	secrets, err := vlt.ListSecrets()
+	if err != nil {
+		t.Fatalf("Failed to list secrets: %v", err)
+	}
+
+	if !slices.Contains(secrets, secretName) {
+		t.Errorf("Expected to find secret '%s' in list", secretName)
+	}
+
+	// Get secret value
+	retrievedValue, err := vlt.GetSecret(secretName)
+	if err != nil {
+		t.Fatalf("Failed to get secret: %v", err)
+	}
+
+	if string(retrievedValue) != string(expectedValue) {
+		t.Errorf("Expected secret value '%s', got '%s'",
+			string(expectedValue), string(retrievedValue))
+	}
+}
+
+func testNumSecrets(t *testing.T, fs afero.Fs) {
+	t.Helper()
+
+	vlt, err := vault.GetCurrentVault(fs, testStateDir)
+	if err != nil {
+		t.Fatalf("Failed to get current vault: %v", err)
+	}
+
+	numSecrets, err := vlt.NumSecrets()
+	if err != nil {
+		t.Fatalf("Failed to count secrets: %v", err)
+	}
+
+	// We added one secret in SecretOperations
+	if numSecrets != 1 {
+		t.Errorf("Expected 1 secret, got %d", numSecrets)
+	}
+}
+
+func testUnlockerOperations(t *testing.T, fs afero.Fs) {
+	t.Helper()
+
+	vlt, err := vault.GetCurrentVault(fs, testStateDir)
+	if err != nil {
+		t.Fatalf("Failed to get current vault: %v", err)
+	}
+
+	// Test vault unlocking (should happen automatically via mnemonic)
+	if vlt.Locked() {
+		_, err := vlt.UnlockVault()
+		if err != nil {
+			t.Fatalf("Failed to unlock vault: %v", err)
+		}
+	}
+
+	// Create a passphrase unlocker
+	passphraseBuffer := memguard.NewBufferFromBytes([]byte(testPassphrase))
+	defer passphraseBuffer.Destroy()
+
+	passphraseUnlocker, err := vlt.CreatePassphraseUnlocker(passphraseBuffer)
+	if err != nil {
+		t.Fatalf("Failed to create passphrase unlocker: %v", err)
+	}
+
+	// List unlockers
+	unlockers, err := vlt.ListUnlockers()
+	if err != nil {
+		t.Fatalf("Failed to list unlockers: %v", err)
+	}
+
+	if len(unlockers) == 0 {
+		t.Errorf("Expected at least one unlocker")
+	}
+
+	// Check key type
+	keyFound := false
+
+	for _, key := range unlockers {
+		if key.Type == "passphrase" {
+			keyFound = true
+
+			break
+		}
+	}
+
+	if !keyFound {
+		t.Errorf("Expected to find passphrase unlocker")
+	}
+
+	// Test selecting unlocker
+	err = vlt.SelectUnlocker(passphraseUnlocker.GetID())
+	if err != nil {
+		t.Fatalf("Failed to select unlocker: %v", err)
+	}
+
+	// Test getting current unlocker
+	currentUnlocker, err := vlt.GetCurrentUnlocker()
+	if err != nil {
+		t.Fatalf("Failed to get current unlocker: %v", err)
+	}
+
+	if currentUnlocker.GetID() != passphraseUnlocker.GetID() {
+		t.Errorf("Expected current unlocker ID '%s', got '%s'",
+			passphraseUnlocker.GetID(), currentUnlocker.GetID())
+	}
+}
+
 func TestListUnlockers_SkipsMissingMetadata(t *testing.T) {
 	// Set test environment variables
-	testMnemonic := "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"
 	t.Setenv(secret.EnvMnemonic, testMnemonic)
-	t.Setenv(secret.EnvUnlockPassphrase, "test-passphrase")
+	t.Setenv(secret.EnvUnlockPassphrase, testPassphrase)
 
 	// Use in-memory filesystem
 	fs := afero.NewMemMapFs()
-	stateDir := "/test/state"
 
 	// Create vault
-	vlt, err := CreateVault(fs, stateDir, "test-vault")
+	vlt, err := vault.CreateVault(fs, testStateDir, testVaultName)
 	if err != nil {
 		t.Fatalf("Failed to create vault: %v", err)
 	}
 
 	// Create a passphrase unlocker so we have at least one valid unlocker
-	passphraseBuffer := memguard.NewBufferFromBytes([]byte("test-passphrase"))
+	passphraseBuffer := memguard.NewBufferFromBytes([]byte(testPassphrase))
 	defer passphraseBuffer.Destroy()
+
 	_, err = vlt.CreatePassphraseUnlocker(passphraseBuffer)
 	if err != nil {
 		t.Fatalf("Failed to create passphrase unlocker: %v", err)
@@ -273,7 +306,9 @@ func TestListUnlockers_SkipsMissingMetadata(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Failed to get vault directory: %v", err)
 	}
+
 	bogusDir := filepath.Join(vaultDir, "unlockers.d", "bogus-no-metadata")
+
 	err = fs.MkdirAll(bogusDir, 0o700)
 	if err != nil {
 		t.Fatalf("Failed to create bogus directory: %v", err)
@@ -282,7 +317,8 @@ func TestListUnlockers_SkipsMissingMetadata(t *testing.T) {
 	// ListUnlockers should succeed, skipping the bogus directory
 	unlockers, err := vlt.ListUnlockers()
 	if err != nil {
-		t.Fatalf("ListUnlockers returned error when it should have skipped bad directory: %v", err)
+		t.Fatalf("ListUnlockers returned error when it should have skipped "+
+			"bad directory: %v", err)
 	}
 
 	// Should still have the valid passphrase unlocker