Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/sww/sww.go

@@ -79,7 +79,11 @@ func Main(version string) int {
 		syscall.SIGTERM, os.Interrupt)
 	defer stop()
 
-	params := Params{Version: version, LookupEnv: os.LookupEnv, Stdout: os.Stdout}
+	params := Params{
+		Version:   version,
+		LookupEnv: os.LookupEnv,
+		Stdout:    os.Stdout,
+	}
 
 	switch args[0] {
 	case "rproxy":
@@ -111,9 +115,7 @@ func RunWAF(ctx context.Context, params Params) int {
 
 	cfg, err := config.FromEnvironment(params.LookupEnv)
 	if err != nil {
-		processLog.Error("invalid setting", "error", err.Error())
-
-		return 1
+		return cannotStart(processLog, "invalid setting", err)
 	}
 
 	// While SWW_LOG_REMOTE_URL is set, every line on stdout from here on
@@ -127,13 +129,38 @@ func RunWAF(ctx context.Context, params Params) int {
 		stdout = io.MultiWriter(params.Stdout, remote)
 	}
 
-	processLog = requestlog.NewProcessLogger(stdout, cfg.InstanceName, cfg.LogLevel)
+	processLog = requestlog.NewProcessLogger(
+		stdout,
+		cfg.InstanceName,
+		cfg.LogLevel,
+	)
 
 	if remote != nil {
 		stopSending := startSending(ctx, remote, processLog)
 		defer stopSending()
 	}
 
+	return runWAFWithSettings(
+		ctx,
+		params.Version,
+		cfg,
+		stdout,
+		remote,
+		processLog,
+	)
+}
+
+// runWAFWithSettings is the rest of RunWAF once the settings are read and
+// the process log goes where they say. remote is nil unless
+// SWW_LOG_REMOTE_URL is set.
+func runWAFWithSettings(
+	ctx context.Context,
+	version string,
+	cfg *config.Config,
+	stdout io.Writer,
+	remote *remotelog.Sender,
+	processLog *slog.Logger,
+) int {
 	// The state files and the alerts give times in UTC.
 	now := func() time.Time { return time.Now().UTC() }
 
@@ -146,23 +173,25 @@ func RunWAF(ctx context.Context, params Params) int {
 		Alerts:     alertQueue,
 	})
 	if err != nil {
-		processLog.Error("cannot use the rule files", "error", err.Error())
-
-		return 1
+		return cannotStart(processLog, "cannot use the rule files", err)
 	}
 
 	crs, err := waf.NewCoreRuleSet(cfg)
 	if err != nil {
-		processLog.Error("cannot use the Core Rule Set", "error", err.Error())
-
-		return 1
+		return cannotStart(processLog, "cannot use the Core Rule Set", err)
 	}
 
-	server, err := newServer(cfg, stdout, processLog, now, ruleFiles, alertQueue, crs)
+	server, err := newServer(
+		cfg,
+		stdout,
+		processLog,
+		now,
+		ruleFiles,
+		alertQueue,
+		crs,
+	)
 	if err != nil {
-		processLog.Error("cannot use the lookup database", "error", err.Error())
-
-		return 1
+		return cannotStart(processLog, "cannot use the lookup database", err)
 	}
 
 	if remote != nil {
@@ -171,24 +200,43 @@ func RunWAF(ctx context.Context, params Params) int {
 
 	files, err := loadStateFiles(cfg, server, alertQueue, now, processLog)
 	if err != nil {
-		processLog.Error("cannot use the state and cache files", "error", err.Error())
-
-		return 1
+		return cannotStart(
+			processLog,
+			"cannot use the state and cache files",
+			err,
+		)
 	}
 
 	listener, err := (&net.ListenConfig{}).Listen(ctx, "tcp", cfg.ListenAddr)
 	if err != nil {
-		processLog.Error("cannot listen on SWW_LISTEN_ADDR", "error", err.Error())
-
-		return 1
+		return cannotStart(
+			processLog,
+			"cannot listen on SWW_LISTEN_ADDR",
+			err,
+		)
 	}
 
 	processLog.Info("starting",
-		"version", params.Version,
+		"version", version,
 		"address", listener.Addr().String(),
 		"settings", cfg)
 
-	return serve(ctx, server, listener, files, ruleFiles, alertQueue, processLog)
+	return serve(
+		ctx,
+		server,
+		listener,
+		files,
+		ruleFiles,
+		alertQueue,
+		processLog,
+	)
+}
+
+// cannotStart logs why waf cannot start, and returns its exit status.
+func cannotStart(processLog *slog.Logger, message string, err error) int {
+	processLog.Error(message, "error", err.Error())
+
+	return 1
 }
 
 // newServer returns the server waf runs, with the metrics of the alerts,
@@ -230,7 +278,10 @@ func newServer(
 	server.Metrics.AddAlerts(alertQueue)
 
 	if lookupFile != nil {
-		server.Metrics.AddLookupFile(lookupFile.LastRead, lookupFile.ReadFailures)
+		server.Metrics.AddLookupFile(
+			lookupFile.LastRead,
+			lookupFile.ReadFailures,
+		)
 	}
 
 	return server, nil
@@ -395,7 +446,11 @@ func serve(
 
 	err = files.WriteAll()
 	if err != nil {
-		processLog.Error("writing the state and cache files failed", "error", err.Error())
+		processLog.Error(
+			"writing the state and cache files failed",
+			"error",
+			err.Error(),
+		)
 
 		return 1
 	}