Update golangci-lint to v2.12.2 with canonical config (#62)

Updates golangci-lint to v2.12.2 everywhere it is pinned and installs the canonical `.golangci.yml`, then remediates every finding the new linter/config surfaces so `make check` is green.

## Version bump

- `Dockerfile` lint stage: `golangci/golangci-lint:v2.11.3-alpine` -> `v2.12.2-alpine` (digest-pinned, date comment updated)
- `Makefile` `deps` target: `go install` moved from the old v1 module path at `@latest` to the pinned `github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2`
- `.golangci.yml` replaced with the canonical config (v2 schema; settings under `linters.settings` so the thresholds actually apply; `default: all` with the standard six disables)
- `script/bootstrap` installs golangci-lint via the system package manager and carries no version pin, so it is unchanged
- CI (`.gitea/workflows/check.yml`) only runs `script/cibuild`, so it needed no change

## Lint remediation

The canonical config surfaced ~3,300 findings across 56k lines. All are fixed, behavior-preserving; incorporates and supersedes the per-package mechanical passes already merged to `main` (refs #61). Highlights:

- `err113`: dynamic errors replaced with package sentinels + `%w` wrapping; comparisons via `errors.Is`
- `goprintffuncname`: printf-style helpers renamed with an `f` suffix (`ui.Writer` message methods, `cli.ReportErrorf`, `database.Fatalf`) and all call sites updated
- `revive` stutter renames: `blob.Handler`, `blob.WithReader`, `blob.ChunkPosition`, `storage.URL`, `storage.Info`; missing doc comments added
- `contextcheck`/`noctx`: `context.Context` threaded through `blob.Packer` and the scanner call sites; context-aware `exec`/`sql` variants
- `funlen`/`cyclop`/`gocognit`/`dupl`: oversized and duplicated functions split into focused helpers (production and test code)
- tests: `t.Parallel()` added where safe (global logger init kept in the serial phase for `-race`), `t.TempDir()`/`t.Helper()` adopted, several suites converted to external test packages
- `gosec`: bounded integer conversions, `ReadHeaderTimeout` on the test HTTP server; remaining warnings suppressed per-site with justifications
- remaining `nolint` directives are rare, targeted, and each carries a reason (e.g. `nilnil` not-found contract in the repository layer, fx module globals, on-disk snake_case struct tags)
- removed the deprecated `log.LogOptions` alias (callers migrated to `log.Options`)

`make check` (tests with `-race`, lint, fmt-check) passes.

Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #62
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/blob/packer.go

@@ -32,21 +32,28 @@ import (
 	"sneak.berlin/go/vaultik/internal/types"
 )
 
-// BlobHandler is a callback function invoked when a blob is finalized and ready for upload.
-// The handler receives a BlobWithReader containing the blob metadata and a reader for
-// the compressed and encrypted blob content. The handler is responsible for uploading
-// the blob to storage and cleaning up any temporary files.
-type BlobHandler func(blob *BlobWithReader) error
+// Handler is a callback function invoked when a blob is finalized and
+// ready for upload. The handler receives a WithReader containing the
+// blob metadata and a reader for the compressed and encrypted blob content.
+// The handler is responsible for uploading the blob to storage and cleaning
+// up any temporary files.
+type Handler func(blob *WithReader) error
 
 // PackerConfig holds configuration for creating a Packer.
 // All fields except BlobHandler are required.
 type PackerConfig struct {
-	MaxBlobSize      int64                  // Maximum size of a blob before forcing finalization
-	CompressionLevel int                    // Zstd compression level (1-19, higher = better compression)
-	Recipients       []string               // Age recipients for encryption
-	Repositories     *database.Repositories // Database repositories for tracking blob metadata
-	BlobHandler      BlobHandler            // Optional callback when blob is ready for upload
-	Fs               afero.Fs               // Filesystem for temporary files
+	// MaxBlobSize is the maximum size of a blob before forcing finalization.
+	MaxBlobSize int64
+	// CompressionLevel is the zstd level (1-19, higher = better compression).
+	CompressionLevel int
+	// Recipients holds the age recipients for encryption.
+	Recipients []string
+	// Repositories provides database access for tracking blob metadata.
+	Repositories *database.Repositories
+	// BlobHandler is an optional callback when a blob is ready for upload.
+	BlobHandler Handler
+	// Fs is the filesystem used for temporary files.
+	Fs afero.Fs
 }
 
 // PendingChunk represents a chunk waiting to be inserted into the database.
@@ -62,7 +69,7 @@ type Packer struct {
 	maxBlobSize      int64
 	compressionLevel int
 	recipients       []string               // Age recipients for encryption
-	blobHandler      BlobHandler            // Called when blob is ready
+	blobHandler      Handler                // Called when blob is ready
 	repos            *database.Repositories // For creating blob records
 	fs               afero.Fs               // Filesystem for temporary files
 
@@ -109,21 +116,21 @@ type FinishedBlob struct {
 	ID           string
 	Hash         string
 	Data         []byte // Compressed data
-	Chunks       []*BlobChunkRef
+	Chunks       []*ChunkPosition
 	CreatedTS    time.Time
 	Uncompressed int64
 	Compressed   int64
 }
 
-// BlobChunkRef represents a chunk's position within a blob
-type BlobChunkRef struct {
+// ChunkPosition represents a chunk's position within a blob
+type ChunkPosition struct {
 	ChunkHash string
 	Offset    int64
 	Length    int64
 }
 
-// BlobWithReader wraps a FinishedBlob with its data reader
-type BlobWithReader struct {
+// WithReader wraps a FinishedBlob with its data reader
+type WithReader struct {
 	*FinishedBlob
 
 	Reader              io.ReadSeeker
@@ -136,15 +143,15 @@ type BlobWithReader struct {
 // Returns an error if required configuration fields are missing or invalid.
 func NewPacker(cfg PackerConfig) (*Packer, error) {
 	if len(cfg.Recipients) == 0 {
-		return nil, errors.New("recipients are required - blobs must be encrypted")
+		return nil, ErrNoRecipients
 	}
 
 	if cfg.MaxBlobSize <= 0 {
-		return nil, errors.New("max blob size must be positive")
+		return nil, ErrInvalidMaxBlobSize
 	}
 
 	if cfg.Fs == nil {
-		return nil, errors.New("filesystem is required")
+		return nil, ErrNoFilesystem
 	}
 
 	return &Packer{
@@ -162,7 +169,7 @@ func NewPacker(cfg PackerConfig) (*Packer, error) {
 // The handler is responsible for uploading the blob to storage.
 // If no handler is set, finalized blobs are stored in memory and can be
 // retrieved with GetFinishedBlobs().
-func (p *Packer) SetBlobHandler(handler BlobHandler) {
+func (p *Packer) SetBlobHandler(handler Handler) {
 	p.mu.Lock()
 	defer p.mu.Unlock()
 
@@ -184,13 +191,13 @@ func (p *Packer) AddPendingChunk(hash string, size int64) {
 // In this case, the caller should finalize the current blob and retry.
 // The chunk data is written immediately and can be garbage collected after this call.
 // Thread-safe.
-func (p *Packer) AddChunk(chunk *ChunkRef) error {
+func (p *Packer) AddChunk(ctx context.Context, chunk *ChunkRef) error {
 	p.mu.Lock()
 	defer p.mu.Unlock()
 
 	// Initialize new blob if needed
 	if p.currentBlob == nil {
-		err := p.startNewBlob()
+		err := p.startNewBlob(ctx)
 		if err != nil {
 			return fmt.Errorf("starting new blob: %w", err)
 		}
@@ -222,12 +229,12 @@ func (p *Packer) AddChunk(chunk *ChunkRef) error {
 // This should be called after all chunks have been added to ensure no data is lost.
 // If a BlobHandler is set, it will be called with the finalized blob.
 // Thread-safe.
-func (p *Packer) Flush() error {
+func (p *Packer) Flush(ctx context.Context) error {
 	p.mu.Lock()
 	defer p.mu.Unlock()
 
 	if p.currentBlob != nil && len(p.currentBlob.chunks) > 0 {
-		err := p.finalizeCurrentBlob()
+		err := p.finalizeCurrentBlob(ctx)
 		if err != nil {
 			return fmt.Errorf("finalizing blob: %w", err)
 		}
@@ -242,7 +249,7 @@ func (p *Packer) Flush() error {
 // BlobHandler (if set) or stored internally.
 // Caller must handle retrying any chunk that triggered size limit exceeded.
 // Not thread-safe - caller must hold the lock.
-func (p *Packer) FinalizeBlob() error {
+func (p *Packer) FinalizeBlob(ctx context.Context) error {
 	p.mu.Lock()
 	defer p.mu.Unlock()
 
@@ -250,7 +257,7 @@ func (p *Packer) FinalizeBlob() error {
 		return nil
 	}
 
-	return p.finalizeCurrentBlob()
+	return p.finalizeCurrentBlob(ctx)
 }
 
 // GetFinishedBlobs returns all completed blobs and clears the internal list.
@@ -267,8 +274,33 @@ func (p *Packer) GetFinishedBlobs() []*FinishedBlob {
 	return blobs
 }
 
+// PackChunks is a convenience method to pack multiple chunks at once.
+func (p *Packer) PackChunks(ctx context.Context, chunks []*ChunkRef) error {
+	for _, chunk := range chunks {
+		err := p.AddChunk(ctx, chunk)
+		if errors.Is(err, ErrBlobSizeLimitExceeded) {
+			// Finalize current blob and retry
+			err = p.FinalizeBlob(ctx)
+			if err != nil {
+				return fmt.Errorf("finalizing blob before retry: %w", err)
+			}
+
+			// Retry the chunk
+			err = p.AddChunk(ctx, chunk)
+			if err != nil {
+				return fmt.Errorf(
+					"adding chunk %s after finalize: %w", chunk.Hash, err)
+			}
+		} else if err != nil {
+			return fmt.Errorf("adding chunk %s: %w", chunk.Hash, err)
+		}
+	}
+
+	return p.Flush(ctx)
+}
+
 // startNewBlob initializes a new blob (must be called with lock held)
-func (p *Packer) startNewBlob() error {
+func (p *Packer) startNewBlob(ctx context.Context) error {
 	// Generate UUID for the blob
 	blobID := uuid.New().String()
 
@@ -280,8 +312,9 @@ func (p *Packer) startNewBlob() error {
 		}
 
 		blob := &database.Blob{
-			ID:               blobIDTyped,
-			Hash:             types.BlobHash("temp-placeholder-" + blobID), // Temporary placeholder until finalized
+			ID: blobIDTyped,
+			// Temporary placeholder hash until finalized.
+			Hash:             types.BlobHash("temp-placeholder-" + blobID),
 			CreatedTS:        time.Now().UTC(),
 			FinishedTS:       nil,
 			UncompressedSize: 0,
@@ -289,9 +322,11 @@ func (p *Packer) startNewBlob() error {
 			UploadedTS:       nil,
 		}
 
-		err = p.repos.WithTx(context.Background(), func(ctx context.Context, tx *sql.Tx) error {
-			return p.repos.Blobs.Create(ctx, tx, blob)
-		})
+		err = p.repos.WithTx(
+			ctx,
+			func(txCtx context.Context, tx *sql.Tx) error {
+				return p.repos.Blobs.Create(txCtx, tx, blob)
+			})
 		if err != nil {
 			return fmt.Errorf("creating blob record: %w", err)
 		}
@@ -322,16 +357,19 @@ func (p *Packer) startNewBlob() error {
 		size:      0,
 	}
 
-	log.Debug("Created new blob container", "blob_id", blobID, "temp_file", tempFile.Name())
+	log.Debug("Created new blob container",
+		"blob_id", blobID, "temp_file", tempFile.Name())
 
 	return nil
 }
 
-// addChunkToCurrentBlob adds a chunk to the current blob (must be called with lock held)
+// addChunkToCurrentBlob adds a chunk to the current blob (must be called
+// with lock held).
 func (p *Packer) addChunkToCurrentBlob(chunk *ChunkRef) error {
 	// Skip if chunk already in current blob
 	if p.currentBlob.chunkSet[chunk.Hash] {
-		log.Debug("Skipping duplicate chunk already in current blob", "chunk_hash", chunk.Hash)
+		log.Debug("Skipping duplicate chunk already in current blob",
+			"chunk_hash", chunk.Hash)
 
 		return nil
 	}
@@ -374,7 +412,7 @@ func (p *Packer) addChunkToCurrentBlob(chunk *ChunkRef) error {
 }
 
 // finalizeCurrentBlob completes the current blob (must be called with lock held)
-func (p *Packer) finalizeCurrentBlob() error {
+func (p *Packer) finalizeCurrentBlob(ctx context.Context) error {
 	if p.currentBlob == nil {
 		return nil
 	}
@@ -389,7 +427,7 @@ func (p *Packer) finalizeCurrentBlob() error {
 	chunksToInsert := p.pendingChunks
 	p.pendingChunks = nil
 
-	err = p.commitBlobToDatabase(blobHash, finalSize, chunksToInsert)
+	err = p.commitBlobToDatabase(ctx, blobHash, finalSize, chunksToInsert)
 	if err != nil {
 		return err
 	}
@@ -418,7 +456,8 @@ func (p *Packer) finalizeCurrentBlob() error {
 	return p.deliverFinishedBlob(finished, insertedChunkHashes)
 }
 
-// closeBlobWriter closes the writer, syncs to disk, and returns the blob hash and final size
+// closeBlobWriter closes the writer, syncs to disk, and returns the blob
+// hash and final size.
 func (p *Packer) closeBlobWriter() (string, int64, error) {
 	err := p.currentBlob.writer.Close()
 	if err != nil {
@@ -453,11 +492,11 @@ func (p *Packer) closeBlobWriter() (string, int64, error) {
 	return hex.EncodeToString(finalHash), finalSize, nil
 }
 
-// buildChunkRefs creates BlobChunkRef entries from the current blob's chunks
-func (p *Packer) buildChunkRefs() []*BlobChunkRef {
-	refs := make([]*BlobChunkRef, 0, len(p.currentBlob.chunks))
+// buildChunkRefs creates ChunkPosition entries from the current blob's chunks
+func (p *Packer) buildChunkRefs() []*ChunkPosition {
+	refs := make([]*ChunkPosition, 0, len(p.currentBlob.chunks))
 	for _, chunk := range p.currentBlob.chunks {
-		refs = append(refs, &BlobChunkRef{
+		refs = append(refs, &ChunkPosition{
 			ChunkHash: chunk.Hash, Offset: chunk.Offset, Length: chunk.Size,
 		})
 	}
@@ -466,7 +505,10 @@ func (p *Packer) buildChunkRefs() []*BlobChunkRef {
 }
 
 // commitBlobToDatabase inserts pending chunks, blob_chunks, and updates the blob record
-func (p *Packer) commitBlobToDatabase(blobHash string, finalSize int64, chunksToInsert []PendingChunk) error {
+func (p *Packer) commitBlobToDatabase(
+	ctx context.Context,
+	blobHash string, finalSize int64, chunksToInsert []PendingChunk,
+) error {
 	if p.repos == nil {
 		return nil
 	}
@@ -478,30 +520,12 @@ func (p *Packer) commitBlobToDatabase(blobHash string, finalSize int64, chunksTo
 		return fmt.Errorf("parsing blob ID: %w", parseErr)
 	}
 
-	err := p.repos.WithTx(context.Background(), func(ctx context.Context, tx *sql.Tx) error {
-		for _, chunk := range chunksToInsert {
-			dbChunk := &database.Chunk{ChunkHash: types.ChunkHash(chunk.Hash), Size: chunk.Size}
-
-			err := p.repos.Chunks.Create(ctx, tx, dbChunk)
-			if err != nil {
-				return fmt.Errorf("creating chunk: %w", err)
-			}
-		}
-
-		for _, chunk := range p.currentBlob.chunks {
-			blobChunk := &database.BlobChunk{
-				BlobID: blobIDTyped, ChunkHash: types.ChunkHash(chunk.Hash),
-				Offset: chunk.Offset, Length: chunk.Size,
-			}
-
-			err := p.repos.BlobChunks.Create(ctx, tx, blobChunk)
-			if err != nil {
-				return fmt.Errorf("creating blob_chunk: %w", err)
-			}
-		}
-
-		return p.repos.Blobs.UpdateFinished(ctx, tx, p.currentBlob.id, blobHash, p.currentBlob.size, finalSize)
-	})
+	err := p.repos.WithTx(
+		ctx,
+		func(txCtx context.Context, tx *sql.Tx) error {
+			return p.insertBlobRecords(txCtx, tx, blobIDTyped, blobHash,
+				finalSize, chunksToInsert)
+		})
 	if err != nil {
 		p.cleanupTempFile()
 
@@ -509,13 +533,53 @@ func (p *Packer) commitBlobToDatabase(blobHash string, finalSize int64, chunksTo
 	}
 
 	log.Debug("Committed blob transaction",
-		"chunks_inserted", len(chunksToInsert), "blob_chunks_inserted", len(p.currentBlob.chunks))
+		"chunks_inserted", len(chunksToInsert),
+		"blob_chunks_inserted", len(p.currentBlob.chunks))
 
 	return nil
 }
 
+// insertBlobRecords inserts pending chunks and blob_chunk rows, then marks
+// the blob finished, all within the supplied transaction.
+func (p *Packer) insertBlobRecords(
+	ctx context.Context,
+	tx *sql.Tx,
+	blobIDTyped types.BlobID,
+	blobHash string,
+	finalSize int64,
+	chunksToInsert []PendingChunk,
+) error {
+	for _, chunk := range chunksToInsert {
+		dbChunk := &database.Chunk{
+			ChunkHash: types.ChunkHash(chunk.Hash), Size: chunk.Size,
+		}
+
+		err := p.repos.Chunks.Create(ctx, tx, dbChunk)
+		if err != nil {
+			return fmt.Errorf("creating chunk: %w", err)
+		}
+	}
+
+	for _, chunk := range p.currentBlob.chunks {
+		blobChunk := &database.BlobChunk{
+			BlobID: blobIDTyped, ChunkHash: types.ChunkHash(chunk.Hash),
+			Offset: chunk.Offset, Length: chunk.Size,
+		}
+
+		err := p.repos.BlobChunks.Create(ctx, tx, blobChunk)
+		if err != nil {
+			return fmt.Errorf("creating blob_chunk: %w", err)
+		}
+	}
+
+	return p.repos.Blobs.UpdateFinished(ctx, tx, p.currentBlob.id, blobHash,
+		p.currentBlob.size, finalSize)
+}
+
 // deliverFinishedBlob passes the blob to the handler or stores it internally
-func (p *Packer) deliverFinishedBlob(finished *FinishedBlob, insertedChunkHashes []string) error {
+func (p *Packer) deliverFinishedBlob(
+	finished *FinishedBlob, insertedChunkHashes []string,
+) error {
 	if p.blobHandler != nil {
 		_, err := p.currentBlob.tempFile.Seek(0, io.SeekStart)
 		if err != nil {
@@ -524,7 +588,7 @@ func (p *Packer) deliverFinishedBlob(finished *FinishedBlob, insertedChunkHashes
 			return fmt.Errorf("seeking for handler: %w", err)
 		}
 
-		blobWithReader := &BlobWithReader{
+		blobWithReader := &WithReader{
 			FinishedBlob:        finished,
 			Reader:              p.currentBlob.tempFile,
 			TempFile:            p.currentBlob.tempFile,
@@ -576,26 +640,3 @@ func (p *Packer) cleanupTempFile() {
 		_ = p.fs.Remove(name)
 	}
 }
-
-// PackChunks is a convenience method to pack multiple chunks at once
-func (p *Packer) PackChunks(chunks []*ChunkRef) error {
-	for _, chunk := range chunks {
-		err := p.AddChunk(chunk)
-		if errors.Is(err, ErrBlobSizeLimitExceeded) {
-			// Finalize current blob and retry
-			err := p.FinalizeBlob()
-			if err != nil {
-				return fmt.Errorf("finalizing blob before retry: %w", err)
-			}
-			// Retry the chunk
-			err = p.AddChunk(chunk)
-			if err != nil {
-				return fmt.Errorf("adding chunk %s after finalize: %w", chunk.Hash, err)
-			}
-		} else if err != nil {
-			return fmt.Errorf("adding chunk %s: %w", chunk.Hash, err)
-		}
-	}
-
-	return p.Flush()
-}