Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/waf/rulefiles_test.go

@@ -48,7 +48,10 @@ func TestEachRuleAction(t *testing.T) {
 	wantRuleIDs(t, line, "noted", "probe")
 
 	if line.BanExpires != requestlog.FormatTime(start.Add(7*24*time.Hour)) {
-		t.Errorf("log line has ban_expires %q, want seven days on", line.BanExpires)
+		t.Errorf(
+			"log line has ban_expires %q, want seven days on",
+			line.BanExpires,
+		)
 	}
 
 	netblock := netip.MustParsePrefix(client + "/32")
@@ -83,15 +86,26 @@ func TestEachRuleAction(t *testing.T) {
 	// against the rules, and makes the ban permanent.
 	clk.advance(time.Hour)
 
-	line = s.get(client, http.StatusTooManyRequests, requestlog.ActionPermanentlyBanned)
+	line = s.get(
+		client,
+		http.StatusTooManyRequests,
+		requestlog.ActionPermanentlyBanned,
+	)
 	wantRuleIDs(t, line)
 
 	if line.BanExpires != permanent {
-		t.Errorf("log line has ban_expires %q, want permanent", line.BanExpires)
+		t.Errorf(
+			"log line has ban_expires %q, want permanent",
+			line.BanExpires,
+		)
 	}
 
 	clk.advance(365 * 24 * time.Hour)
-	s.get(client, http.StatusTooManyRequests, requestlog.ActionPermanentlyBanned)
+	s.get(
+		client,
+		http.StatusTooManyRequests,
+		requestlog.ActionPermanentlyBanned,
+	)
 }
 
 func TestEachRuleActionAddsTheExploitSignatureTag(t *testing.T) {
@@ -101,8 +115,11 @@ func TestEachRuleActionAddsTheExploitSignatureTag(t *testing.T) {
 		rulesDir: writeRules(t, "noted path log ^/noted$\n"+testRules),
 	})
 
-	wantTags(t, s.request(client, "/noted", http.StatusOK, requestlog.ActionForward),
-		"exploitsignature")
+	wantTags(
+		t,
+		s.request(client, "/noted", http.StatusOK, requestlog.ActionForward),
+		"exploitsignature",
+	)
 	wantTags(t, s.request(client, "/blocked", http.StatusForbidden,
 		requestlog.ActionBlockedByBlockRule), "exploitsignature")
 	wantTags(t, s.get(client, http.StatusOK, requestlog.ActionForward))
@@ -117,11 +134,21 @@ func TestRuleRefusalNamesItsHeuristicAndTheRule(t *testing.T) {
 
 	line := s.request(client, "/blocked", http.StatusForbidden,
 		requestlog.ActionBlockedByBlockRule)
-	wantHeuristic(t, line, "rule_files", `{"rule_id": "blocked", "rule_action": "block"}`)
+	wantHeuristic(
+		t,
+		line,
+		"rule_files",
+		`{"rule_id": "blocked", "rule_action": "block"}`,
+	)
 
 	line = s.request(client, "/.env", http.StatusForbidden,
 		requestlog.ActionTemporarilyBanned)
-	wantHeuristic(t, line, "rule_files", `{"rule_id": "probe", "rule_action": "ban"}`)
+	wantHeuristic(
+		t,
+		line,
+		"rule_files",
+		`{"rule_id": "probe", "rule_action": "ban"}`,
+	)
 }
 
 func TestNextClearSignOfAttackAfterABanBansPermanently(t *testing.T) {
@@ -136,7 +163,10 @@ func TestNextClearSignOfAttackAfterABanBansPermanently(t *testing.T) {
 	line := s.request(client, "/.env", http.StatusForbidden,
 		requestlog.ActionTemporarilyBanned)
 	if line.BanExpires != requestlog.FormatTime(clk.Now().Add(time.Hour)) {
-		t.Errorf("log line has ban_expires %q, want an hour on", line.BanExpires)
+		t.Errorf(
+			"log line has ban_expires %q, want an hour on",
+			line.BanExpires,
+		)
 	}
 
 	// Once that ban has run out without a request, the client is served,
@@ -147,7 +177,10 @@ func TestNextClearSignOfAttackAfterABanBansPermanently(t *testing.T) {
 	line = s.request(client, "/.env", http.StatusForbidden,
 		requestlog.ActionPermanentlyBanned)
 	if line.BanExpires != permanent {
-		t.Errorf("log line has ban_expires %q, want permanent", line.BanExpires)
+		t.Errorf(
+			"log line has ban_expires %q, want permanent",
+			line.BanExpires,
+		)
 	}
 }
 
@@ -167,7 +200,12 @@ func TestRulesComeAfterTheOtherChecks(t *testing.T) {
 	})
 
 	// A client in SWW_ALLOW_NETS is not checked.
-	line := s.request(allowed, "/.env", http.StatusOK, requestlog.ActionForward)
+	line := s.request(
+		allowed,
+		"/.env",
+		http.StatusOK,
+		requestlog.ActionForward,
+	)
 	wantRuleIDs(t, line)
 
 	// A probe over the rate limit breaks the limit before any rule sees
@@ -184,7 +222,12 @@ func TestRulesComeAfterTheOtherChecks(t *testing.T) {
 
 	// A client the rate limits do not apply to is still checked.
 	s.get(exempt, http.StatusOK, requestlog.ActionForward)
-	s.request(exempt, "/.env", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.request(
+		exempt,
+		"/.env",
+		http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned,
+	)
 }
 
 func TestObserveModeLogsWhatTheRulesWouldDo(t *testing.T) {
@@ -195,11 +238,21 @@ func TestObserveModeLogsWhatTheRulesWouldDo(t *testing.T) {
 		mode:     observe,
 	})
 
-	line := s.request(client, "/blocked", http.StatusOK, requestlog.ActionForward)
+	line := s.request(
+		client,
+		"/blocked",
+		http.StatusOK,
+		requestlog.ActionForward,
+	)
 	wantWouldAction(t, line, requestlog.ActionBlockedByBlockRule)
 	wantRuleIDs(t, line, "blocked")
 
-	line = s.request(client, "/.env", http.StatusOK, requestlog.ActionForward)
+	line = s.request(
+		client,
+		"/.env",
+		http.StatusOK,
+		requestlog.ActionForward,
+	)
 	wantWouldAction(t, line, requestlog.ActionTemporarilyBanned)
 	wantRuleIDs(t, line, "probe")
 
@@ -226,22 +279,55 @@ func TestMetricsCountRuleMatchesAndBansForAnAttack(t *testing.T) {
 
 	s.request(client, "/blocked", http.StatusForbidden,
 		requestlog.ActionBlockedByBlockRule)
-	s.request(client, "/.env", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.request(
+		client,
+		"/.env",
+		http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned,
+	)
 	s.get(client, http.StatusForbidden, requestlog.ActionPermanentlyBanned)
 
 	metrics := s.scrape()
-	wantMetric(t, metrics,
-		`sww_rule_matches_total{action="block",instance="app",rule_id="blocked"}`, 1)
-	wantMetric(t, metrics,
-		`sww_rule_matches_total{action="ban",instance="app",rule_id="probe"}`, 1)
+	wantMetric(
+		t,
+		metrics,
+		`sww_rule_matches_total{action="block",instance="app",rule_id="blocked"}`,
+		1,
+	)
+	wantMetric(
+		t,
+		metrics,
+		`sww_rule_matches_total{action="ban",instance="app",rule_id="probe"}`,
+		1,
+	)
 	wantMetric(t, metrics, `sww_rules_loaded{instance="app"}`, 2)
-	wantMetric(t, metrics, `sww_requests_total{action="blocked_by_block_rule",`+
-		`instance="app",status_class="4xx"}`, 1)
+	wantMetric(
+		t,
+		metrics,
+		`sww_requests_total{action="blocked_by_block_rule",`+
+			`instance="app",status_class="4xx"}`,
+		1,
+	)
 	wantMetric(t, metrics,
 		`sww_offences_total{instance="app",kind="blocked_by_block_rule"}`, 1)
-	wantMetric(t, metrics, `sww_offences_total{instance="app",kind="attack"}`, 1)
-	wantMetric(t, metrics, `sww_bans_made_total{cause="attack",instance="app"}`, 1)
-	wantMetric(t, metrics, `sww_bans_made_total{cause="limit",instance="app"}`, 0)
+	wantMetric(
+		t,
+		metrics,
+		`sww_offences_total{instance="app",kind="attack"}`,
+		1,
+	)
+	wantMetric(
+		t,
+		metrics,
+		`sww_bans_made_total{cause="attack",instance="app"}`,
+		1,
+	)
+	wantMetric(
+		t,
+		metrics,
+		`sww_bans_made_total{cause="limit",instance="app"}`,
+		0,
+	)
 	wantMetric(t, metrics, `sww_permanent_bans{instance="app"}`, 1)
 }
 
@@ -252,7 +338,11 @@ func writeRules(t *testing.T, content string) string {
 
 	dir := t.TempDir()
 
-	err := os.WriteFile(filepath.Join(dir, "test.rules"), []byte(content), 0o600)
+	err := os.WriteFile(
+		filepath.Join(dir, "test.rules"),
+		[]byte(content),
+		0o600,
+	)
 	if err != nil {
 		t.Fatalf("write the rule file: %v", err)
 	}