sneak/secret
1
0
Fork 0
Code Issues 22 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Adopt canonical .golangci.yml and golangci-lint v2.12.2 #30

New Issue
Closed
opened 2026-08-09 03:33:49 +02:00 by clawbot · 0 comments
clawbot commented 2026-08-09 03:33:49 +02:00
Collaborator
Copy Link

Tracking issue for the lint-toolchain upgrade already implemented on branch golangci-v2.12.2 (PR #29). Filed retroactively so the work is tracked here, which is authoritative.

Background

The repo carried a bespoke .golangci.yml: an enable-only list of roughly 20 linters, lll at 120, tests: false, and a blanket exclusion of internal/macse. Org policy (REPO_POLICIES.md) requires the canonical standardized config, which an agent must never modify:

> .golangci.yml is standardized and must NEVER be modified by an agent, only manually by the user. Fetch from https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml.

Definition of done

  • .golangci.yml is byte-identical to the canonical org config, sha256 021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb.
  • The Dockerfile lint stage pins golangci-lint v2.12.2 by tag and sha256 digest, with the version-and-date comment above the reference that policy requires.
  • Every finding the stricter config surfaces is fixed. No new //nolint without a written reason on the same line.
  • No behavior change. This is a secrets-handling tool: the refactor must not alter key material lifetime, error paths, ordering of zeroization, or any user-visible string beyond what is explicitly enumerated in the PR body.
  • make check green, and CI green on the PR head.
  • TODO.md updated in the same commit as the work.

Implementation requirements

  • Behavior preservation is the whole risk surface here. Helper extraction driven by funlen/cyclop/dupl must be provably behavior-preserving, especially anywhere a memguard.LockedBuffer is created, passed, or destroyed — an extraction that changes when a buffer goes out of scope changes how long key material lives in memory.
  • noctx fixes that convert exec.Command to exec.CommandContext must not introduce a context that can cancel a gpg or security invocation mid-write and leave a partially written vault file.
  • err113 sentinel-error refactors must preserve errors.Is/errors.As behavior for every caller, and must not widen or narrow which errors a caller treats as fatal.
  • paralleltest additions must not add t.Parallel() to any test that shares a state directory, mutates the process environment, or depends on memguard global state.

Notes

This is a prerequisite for the rest of the 1.0.0 milestone: it touches 59 files across all of internal/ and pkg/, so every security fix filed under this milestone will conflict with it until it lands. It goes through the gate first.

Tracking issue for the lint-toolchain upgrade already implemented on branch `golangci-v2.12.2` (PR #29). Filed retroactively so the work is tracked here, which is authoritative. ## Background The repo carried a bespoke `.golangci.yml`: an enable-only list of roughly 20 linters, `lll` at 120, `tests: false`, and a blanket exclusion of `internal/macse`. Org policy (`REPO_POLICIES.md`) requires the canonical standardized config, which an agent must never modify: > `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only manually by the user. Fetch from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`. ## Definition of done - `.golangci.yml` is byte-identical to the canonical org config, sha256 `021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb`. - The `Dockerfile` lint stage pins golangci-lint v2.12.2 by tag **and** sha256 digest, with the version-and-date comment above the reference that policy requires. - Every finding the stricter config surfaces is fixed. No new `//nolint` without a written reason on the same line. - No behavior change. This is a secrets-handling tool: the refactor must not alter key material lifetime, error paths, ordering of zeroization, or any user-visible string beyond what is explicitly enumerated in the PR body. - `make check` green, and CI green on the PR head. - `TODO.md` updated in the same commit as the work. ## Implementation requirements - Behavior preservation is the whole risk surface here. Helper extraction driven by `funlen`/`cyclop`/`dupl` must be provably behavior-preserving, especially anywhere a `memguard.LockedBuffer` is created, passed, or destroyed — an extraction that changes when a buffer goes out of scope changes how long key material lives in memory. - `noctx` fixes that convert `exec.Command` to `exec.CommandContext` must not introduce a context that can cancel a `gpg` or `security` invocation mid-write and leave a partially written vault file. - `err113` sentinel-error refactors must preserve `errors.Is`/`errors.As` behavior for every caller, and must not widen or narrow which errors a caller treats as fatal. - `paralleltest` additions must not add `t.Parallel()` to any test that shares a state directory, mutates the process environment, or depends on memguard global state. ## Notes This is a prerequisite for the rest of the 1.0.0 milestone: it touches 59 files across all of `internal/` and `pkg/`, so every security fix filed under this milestone will conflict with it until it lands. It goes through the gate first.
clawbot added this to the 1.0.0 milestone 2026-08-09 03:33:49 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
merge-ready
needs-checks
needs-rebase
needs-review
needs-rework
No Label
Milestone
No items
No Milestone 1.0.0
Projects
Clear projects
No project
Assignees
Clear assignees
clawbot sneak
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/secret#30
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?