Adopt canonical .golangci.yml and golangci-lint v2.12.2 #30

New Issue

2026-08-09T03:33:49+02:00

clawbot commented

2026-08-09 03:33:49 +02:00

Tracking issue for the lint-toolchain upgrade already implemented on branch golangci-v2.12.2 (PR #29). Filed retroactively so the work is tracked here, which is authoritative.

Background

The repo carried a bespoke .golangci.yml: an enable-only list of roughly 20 linters, lll at 120, tests: false, and a blanket exclusion of internal/macse. Org policy (REPO_POLICIES.md) requires the canonical standardized config, which an agent must never modify:

> .golangci.yml is standardized and must NEVER be modified by an agent, only manually by the user. Fetch from https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml.

Definition of done

.golangci.yml is byte-identical to the canonical org config, sha256 021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb.
The Dockerfile lint stage pins golangci-lint v2.12.2 by tag and sha256 digest, with the version-and-date comment above the reference that policy requires.
Every finding the stricter config surfaces is fixed. No new //nolint without a written reason on the same line.
No behavior change. This is a secrets-handling tool: the refactor must not alter key material lifetime, error paths, ordering of zeroization, or any user-visible string beyond what is explicitly enumerated in the PR body.
make check green, and CI green on the PR head.
TODO.md updated in the same commit as the work.

Implementation requirements

Behavior preservation is the whole risk surface here. Helper extraction driven by funlen/cyclop/dupl must be provably behavior-preserving, especially anywhere a memguard.LockedBuffer is created, passed, or destroyed — an extraction that changes when a buffer goes out of scope changes how long key material lives in memory.
noctx fixes that convert exec.Command to exec.CommandContext must not introduce a context that can cancel a gpg or security invocation mid-write and leave a partially written vault file.
err113 sentinel-error refactors must preserve errors.Is/errors.As behavior for every caller, and must not widen or narrow which errors a caller treats as fatal.
paralleltest additions must not add t.Parallel() to any test that shares a state directory, mutates the process environment, or depends on memguard global state.

Notes

This is a prerequisite for the rest of the 1.0.0 milestone: it touches 59 files across all of internal/ and pkg/, so every security fix filed under this milestone will conflict with it until it lands. It goes through the gate first.

Tracking issue for the lint-toolchain upgrade already implemented on branch `golangci-v2.12.2` (PR #29). Filed retroactively so the work is tracked here, which is authoritative. ## Background The repo carried a bespoke `.golangci.yml`: an enable-only list of roughly 20 linters, `lll` at 120, `tests: false`, and a blanket exclusion of `internal/macse`. Org policy (`REPO_POLICIES.md`) requires the canonical standardized config, which an agent must never modify: > `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only manually by the user. Fetch from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`. ## Definition of done - `.golangci.yml` is byte-identical to the canonical org config, sha256 `021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb`. - The `Dockerfile` lint stage pins golangci-lint v2.12.2 by tag **and** sha256 digest, with the version-and-date comment above the reference that policy requires. - Every finding the stricter config surfaces is fixed. No new `//nolint` without a written reason on the same line. - No behavior change. This is a secrets-handling tool: the refactor must not alter key material lifetime, error paths, ordering of zeroization, or any user-visible string beyond what is explicitly enumerated in the PR body. - `make check` green, and CI green on the PR head. - `TODO.md` updated in the same commit as the work. ## Implementation requirements - Behavior preservation is the whole risk surface here. Helper extraction driven by `funlen`/`cyclop`/`dupl` must be provably behavior-preserving, especially anywhere a `memguard.LockedBuffer` is created, passed, or destroyed — an extraction that changes when a buffer goes out of scope changes how long key material lives in memory. - `noctx` fixes that convert `exec.Command` to `exec.CommandContext` must not introduce a context that can cancel a `gpg` or `security` invocation mid-write and leave a partially written vault file. - `err113` sentinel-error refactors must preserve `errors.Is`/`errors.As` behavior for every caller, and must not widen or narrow which errors a caller treats as fatal. - `paralleltest` additions must not add `t.Parallel()` to any test that shares a state directory, mutates the process environment, or depends on memguard global state. ## Notes This is a prerequisite for the rest of the 1.0.0 milestone: it touches 59 files across all of `internal/` and `pkg/`, so every security fix filed under this milestone will conflict with it until it lands. It goes through the gate first.

clawbot added this to the 1.0.0 milestone 2026-08-09 03:33:49 +02:00

clawbot referenced this issue

2026-08-09 03:34:39 +02:00

Update golangci-lint to v2.12.2 with canonical config #29

clawbot referenced this issue

2026-08-09 03:44:35 +02:00

Update golangci-lint to v2.12.2 with canonical config #29

clawbot referenced this issue

2026-08-09 03:45:28 +02:00

Update golangci-lint to v2.12.2 with canonical config #29

clawbot referenced this issue from a commit

2026-08-09 04:04:35 +02:00