fix: add nolint comments for necessary global variables in internal/secret

Add nolint:gochecknoglobals comments for legitimate global variables:
- debugEnabled and debugLogger: Package-wide debug state management
- GPGEncryptFunc and GPGDecryptFunc: Required for test mocking
- getCurrentVaultFunc: Required to break import cycle between packages

internal/secret/debug.go

@@ -13,8 +13,8 @@ import (
 )
 
 var (
-	debugEnabled bool
-	debugLogger  *slog.Logger
+	debugEnabled bool         //nolint:gochecknoglobals // Package-wide debug state is necessary
+	debugLogger  *slog.Logger //nolint:gochecknoglobals // Package-wide logger instance is necessary
 )
 
 func init() {

internal/secret/pgpunlocker.go

@@ -20,11 +20,11 @@ import (
 var (
 	// GPGEncryptFunc is the function used for GPG encryption
 	// Can be overridden in tests to provide a non-interactive implementation
-	GPGEncryptFunc = gpgEncryptDefault
+	GPGEncryptFunc = gpgEncryptDefault //nolint:gochecknoglobals // Required for test mocking
 
 	// GPGDecryptFunc is the function used for GPG decryption
 	// Can be overridden in tests to provide a non-interactive implementation
-	GPGDecryptFunc = gpgDecryptDefault
+	GPGDecryptFunc = gpgDecryptDefault //nolint:gochecknoglobals // Required for test mocking
 
 	// gpgKeyIDRegex validates GPG key IDs
 	// Allows either:

internal/secret/secret.go

@@ -286,7 +286,7 @@ func GetCurrentVault(fs afero.Fs, stateDir string) (VaultInterface, error) {
 
 // getCurrentVaultFunc is a function variable that will be set by the vault package
 // to implement the actual GetCurrentVault functionality
-var getCurrentVaultFunc func(fs afero.Fs, stateDir string) (VaultInterface, error)
+var getCurrentVaultFunc func(fs afero.Fs, stateDir string) (VaultInterface, error) //nolint:gochecknoglobals // Required to break import cycle
 
 // RegisterGetCurrentVaultFunc allows the vault package to register its implementation
 // of GetCurrentVault to break the import cycle