Update golangci-lint to v2.12.2 with canonical config

Bump golangci-lint from v2.10.1 to v2.12.2 in the Dockerfile lint
stage (tag+digest pin) and script/bootstrap release-archive pins
(linux amd64/arm64 sha256s). Replace .golangci.yml with the canonical
v2-layout config so linter settings (lll 88, funlen 80/50, cyclop 15,
dupl 100) actually apply.

Fix all findings surfaced by the new linter and config:

- noctx: use httptest.NewRequestWithContext in all tests
- gosec G710/G703: route app redirects through a path-escaping
  redirectToApp helper; annotate internal log path usage
- goconst: introduce shared constants for template/JSON keys and
  repeated test literals
- lll: wrap lines to the 88-column limit
- dupl: extract shared helpers (generic findAllByAppID in models,
  deleteAppResource in handlers, parsePush in webhook payloads,
  table-driven/helper-based test dedup)
- nolintlint: drop nolint directives made obsolete by the new limits

Record the change in TODO.md; make check is green.

internal/service/webhook/payloads.go

@@ -98,88 +98,77 @@ type GitLabPushPayload struct {
 func ParsePushPayload(source Source, payload []byte) (*PushEvent, error) {
 	switch source {
 	case SourceGitHub:
-		return parseGitHubPush(payload)
+		return parsePush(payload, githubPushEvent)
 	case SourceGitLab:
-		return parseGitLabPush(payload)
+		return parsePush(payload, gitlabPushEvent)
 	case SourceGitea, SourceUnknown:
 		// Gitea and unknown both use Gitea format for backward compatibility.
-		return parseGiteaPush(payload)
+		return parsePush(payload, giteaPushEvent)
 	}
 
 	// Unreachable for known source values, but satisfies exhaustive checker.
-	return parseGiteaPush(payload)
+	return parsePush(payload, giteaPushEvent)
 }
 
-func parseGiteaPush(payload []byte) (*PushEvent, error) {
-	var p GiteaPushPayload
+// parsePush unmarshals payload into P and converts it into a normalized
+// PushEvent via build.
+func parsePush[P any](payload []byte, build func(P) *PushEvent) (*PushEvent, error) {
+	var p P
 
 	unmarshalErr := json.Unmarshal(payload, &p)
 	if unmarshalErr != nil {
 		return nil, unmarshalErr
 	}
 
-	commitURL := extractGiteaCommitURL(p)
-
-	return &PushEvent{
-		Source:    SourceGitea,
-		Ref:       p.Ref,
-		Before:    p.Before,
-		After:     p.After,
-		Branch:    extractBranch(p.Ref),
-		RepoName:  p.Repository.FullName,
-		CloneURL:  p.Repository.CloneURL,
-		HTMLURL:   p.Repository.HTMLURL,
-		CommitURL: commitURL,
-		Pusher:    p.Pusher.Username,
-	}, nil
+	return build(p), nil
 }
 
-func parseGitHubPush(payload []byte) (*PushEvent, error) {
-	var p GitHubPushPayload
-
-	unmarshalErr := json.Unmarshal(payload, &p)
-	if unmarshalErr != nil {
-		return nil, unmarshalErr
-	}
-
-	commitURL := extractGitHubCommitURL(p)
-
+// basePushEvent builds a PushEvent populated with the fields shared by all
+// webhook sources.
+func basePushEvent(source Source, ref, before, after string) *PushEvent {
 	return &PushEvent{
-		Source:    SourceGitHub,
-		Ref:       p.Ref,
-		Before:    p.Before,
-		After:     p.After,
-		Branch:    extractBranch(p.Ref),
-		RepoName:  p.Repository.FullName,
-		CloneURL:  p.Repository.CloneURL,
-		HTMLURL:   p.Repository.HTMLURL,
-		CommitURL: commitURL,
-		Pusher:    p.Pusher.Name,
-	}, nil
+		Source: source,
+		Ref:    ref,
+		Before: before,
+		After:  after,
+		Branch: extractBranch(ref),
+	}
 }
 
-func parseGitLabPush(payload []byte) (*PushEvent, error) {
-	var p GitLabPushPayload
+// giteaPushEvent converts a Gitea push payload to a normalized PushEvent.
+func giteaPushEvent(p GiteaPushPayload) *PushEvent {
+	event := basePushEvent(SourceGitea, p.Ref, p.Before, p.After)
+	event.RepoName = p.Repository.FullName
+	event.CloneURL = p.Repository.CloneURL
+	event.HTMLURL = p.Repository.HTMLURL
+	event.CommitURL = extractGiteaCommitURL(p)
+	event.Pusher = p.Pusher.Username
 
-	unmarshalErr := json.Unmarshal(payload, &p)
-	if unmarshalErr != nil {
-		return nil, unmarshalErr
-	}
+	return event
+}
 
-	commitURL := extractGitLabCommitURL(p)
+// gitlabPushEvent converts a GitLab push payload to a normalized PushEvent.
+func gitlabPushEvent(p GitLabPushPayload) *PushEvent {
+	event := basePushEvent(SourceGitLab, p.Ref, p.Before, p.After)
+	event.RepoName = p.Project.PathWithNamespace
+	event.CloneURL = p.Project.GitHTTPURL
+	event.HTMLURL = p.Project.WebURL
+	event.CommitURL = extractGitLabCommitURL(p)
+	event.Pusher = p.UserName
 
-	return &PushEvent{
-		Source:    SourceGitLab,
-		Ref:       p.Ref,
-		Before:    p.Before,
-		After:     p.After,
-		Branch:    extractBranch(p.Ref),
-		RepoName:  p.Project.PathWithNamespace,
-		CloneURL:  p.Project.GitHTTPURL,
-		HTMLURL:   p.Project.WebURL,
-		CommitURL: commitURL,
-		Pusher:    p.UserName,
-	}, nil
+	return event
+}
+
+// githubPushEvent converts a GitHub push payload to a normalized PushEvent.
+func githubPushEvent(p GitHubPushPayload) *PushEvent {
+	event := basePushEvent(SourceGitHub, p.Ref, p.Before, p.After)
+	event.RepoName = p.Repository.FullName
+	event.CloneURL = p.Repository.CloneURL
+	event.HTMLURL = p.Repository.HTMLURL
+	event.CommitURL = extractGitHubCommitURL(p)
+	event.Pusher = p.Pusher.Name
+
+	return event
 }
 
 // extractBranch extracts the branch name from a git ref.