Apply mechanical lint fixes for golangci-lint v2.12.2 rollout

Auto-remediate style-only findings (wsl_v5, nlreturn, noinlineerr,
modernize, intrange, perfsprint, usetesting, unconvert, errorlint,
gocritic, testifylint) and rename printf-style helpers to f-suffixed
names (goprintffuncname): ui.Writer message methods, cli.ReportErrorf,
database.Fatalf, vaultik stdoutf.

internal/blobgen/compress.go

@@ -28,6 +28,7 @@ func CompressData(data []byte, compressionLevel int, recipients []string) (*Comp
 	// Write data
 	if _, err := w.Write(data); err != nil {
 		_ = w.Close()
+
 		return nil, fmt.Errorf("writing data: %w", err)
 	}
 
@@ -68,6 +69,7 @@ func CompressStream(dst io.Writer, src io.Reader, compressionLevel int, recipien
 	if err := w.Close(); err != nil {
 		return 0, "", fmt.Errorf("closing writer: %w", err)
 	}
+
 	closed = true
 
 	return w.BytesWritten(), hex.EncodeToString(w.Sum256()), nil

internal/blobgen/compress_test.go

@@ -20,13 +20,14 @@ const testRecipient = "age1cplgrwj77ta54dnmydvvmzn64ltk83ankxl5sww04mrtmu62kv3s8
 // cause a double close.
 func TestCompressStreamNoDoubleClose(t *testing.T) {
 	input := []byte("regression test data for issue #28 double-close fix")
+
 	var buf bytes.Buffer
 
 	written, hash, err := CompressStream(&buf, bytes.NewReader(input), 3, []string{testRecipient})
 	require.NoError(t, err, "CompressStream should not return an error")
-	assert.True(t, written > 0, "expected bytes written > 0")
+	assert.Positive(t, written, "expected bytes written > 0")
 	assert.NotEmpty(t, hash, "expected non-empty hash")
-	assert.True(t, buf.Len() > 0, "expected non-empty output")
+	assert.Positive(t, buf.Len(), "expected non-empty output")
 }
 
 // TestCompressStreamLargeInput exercises CompressStream with a larger payload
@@ -37,9 +38,10 @@ func TestCompressStreamLargeInput(t *testing.T) {
 	require.NoError(t, err)
 
 	var buf bytes.Buffer
+
 	written, hash, err := CompressStream(&buf, bytes.NewReader(data), 3, []string{testRecipient})
 	require.NoError(t, err)
-	assert.True(t, written > 0)
+	assert.Positive(t, written)
 	assert.NotEmpty(t, hash)
 }
 
@@ -47,6 +49,7 @@ func TestCompressStreamLargeInput(t *testing.T) {
 // without double-close issues.
 func TestCompressStreamEmptyInput(t *testing.T) {
 	var buf bytes.Buffer
+
 	_, hash, err := CompressStream(&buf, strings.NewReader(""), 3, []string{testRecipient})
 	require.NoError(t, err)
 	assert.NotEmpty(t, hash)
@@ -58,7 +61,7 @@ func TestCompressDataNoDoubleClose(t *testing.T) {
 	input := []byte("CompressData regression test for double-close")
 	result, err := CompressData(input, 3, []string{testRecipient})
 	require.NoError(t, err)
-	assert.True(t, result.CompressedSize > 0)
-	assert.True(t, result.UncompressedSize == int64(len(input)))
+	assert.Positive(t, result.CompressedSize)
+	assert.Equal(t, result.UncompressedSize, int64(len(input)))
 	assert.NotEmpty(t, result.SHA256)
 }

internal/blobgen/reader.go

@@ -53,12 +53,14 @@ func NewReader(r io.Reader, identity age.Identity) (*Reader, error) {
 func (r *Reader) Read(p []byte) (n int, err error) {
 	n, err = r.teeReader.Read(p)
 	r.bytesRead += int64(n)
+
 	return n, err
 }
 
 // Close closes the decompressor
 func (r *Reader) Close() error {
 	r.decompressor.Close()
+
 	return nil
 }
 

internal/blobgen/writer.go

@@ -36,11 +36,13 @@ func NewWriter(w io.Writer, compressionLevel int, recipients []string) (*Writer,
 
 	// Parse recipients
 	var ageRecipients []age.Recipient
+
 	for _, recipient := range recipients {
 		r, err := age.ParseX25519Recipient(recipient)
 		if err != nil {
 			return nil, fmt.Errorf("parsing recipient %s: %w", recipient, err)
 		}
+
 		ageRecipients = append(ageRecipients, r)
 	}
 
@@ -51,10 +53,7 @@ func NewWriter(w io.Writer, compressionLevel int, recipients []string) (*Writer,
 	}
 
 	// Calculate compression concurrency: CPUs - 2, minimum 1
-	concurrency := runtime.NumCPU() - 2
-	if concurrency < 1 {
-		concurrency = 1
-	}
+	concurrency := max(runtime.NumCPU()-2, 1)
 
 	// Create compression writer with encryption as destination
 	compressor, err := zstd.NewWriter(encWriter,
@@ -63,6 +62,7 @@ func NewWriter(w io.Writer, compressionLevel int, recipients []string) (*Writer,
 	)
 	if err != nil {
 		_ = encWriter.Close()
+
 		return nil, fmt.Errorf("creating compression writer: %w", err)
 	}
 
@@ -82,18 +82,21 @@ func NewWriter(w io.Writer, compressionLevel int, recipients []string) (*Writer,
 func (w *Writer) Write(p []byte) (n int, err error) {
 	n, err = w.teeWriter.Write(p)
 	w.bytesWritten += int64(n)
+
 	return n, err
 }
 
 // Close closes all layers and returns any errors
 func (w *Writer) Close() error {
 	// Close compressor first
-	if err := w.compressor.Close(); err != nil {
+	err := w.compressor.Close()
+	if err != nil {
 		return fmt.Errorf("closing compressor: %w", err)
 	}
 
 	// Then close encryptor
-	if err := w.encryptor.Close(); err != nil {
+	err = w.encryptor.Close()
+	if err != nil {
 		return fmt.Errorf("closing encryptor: %w", err)
 	}
 
@@ -109,6 +112,7 @@ func (w *Writer) Sum256() []byte {
 	firstHash := w.hasher.Sum(nil)
 	// Second hash: SHA256(firstHash) - this is the blob ID
 	secondHash := sha256.Sum256(firstHash)
+
 	return secondHash[:]
 }
 
@@ -123,5 +127,6 @@ func validateCompressionLevel(level int) error {
 	if level < 1 || level > 19 {
 		return fmt.Errorf("invalid compression level %d: must be between 1 and 19", level)
 	}
+
 	return nil
 }