Update golangci-lint to v2.12.2 with canonical config (#62)

Updates golangci-lint to v2.12.2 everywhere it is pinned and installs the canonical `.golangci.yml`, then remediates every finding the new linter/config surfaces so `make check` is green.

## Version bump

- `Dockerfile` lint stage: `golangci/golangci-lint:v2.11.3-alpine` -> `v2.12.2-alpine` (digest-pinned, date comment updated)
- `Makefile` `deps` target: `go install` moved from the old v1 module path at `@latest` to the pinned `github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2`
- `.golangci.yml` replaced with the canonical config (v2 schema; settings under `linters.settings` so the thresholds actually apply; `default: all` with the standard six disables)
- `script/bootstrap` installs golangci-lint via the system package manager and carries no version pin, so it is unchanged
- CI (`.gitea/workflows/check.yml`) only runs `script/cibuild`, so it needed no change

## Lint remediation

The canonical config surfaced ~3,300 findings across 56k lines. All are fixed, behavior-preserving; incorporates and supersedes the per-package mechanical passes already merged to `main` (refs #61). Highlights:

- `err113`: dynamic errors replaced with package sentinels + `%w` wrapping; comparisons via `errors.Is`
- `goprintffuncname`: printf-style helpers renamed with an `f` suffix (`ui.Writer` message methods, `cli.ReportErrorf`, `database.Fatalf`) and all call sites updated
- `revive` stutter renames: `blob.Handler`, `blob.WithReader`, `blob.ChunkPosition`, `storage.URL`, `storage.Info`; missing doc comments added
- `contextcheck`/`noctx`: `context.Context` threaded through `blob.Packer` and the scanner call sites; context-aware `exec`/`sql` variants
- `funlen`/`cyclop`/`gocognit`/`dupl`: oversized and duplicated functions split into focused helpers (production and test code)
- tests: `t.Parallel()` added where safe (global logger init kept in the serial phase for `-race`), `t.TempDir()`/`t.Helper()` adopted, several suites converted to external test packages
- `gosec`: bounded integer conversions, `ReadHeaderTimeout` on the test HTTP server; remaining warnings suppressed per-site with justifications
- remaining `nolint` directives are rare, targeted, and each carries a reason (e.g. `nilnil` not-found contract in the repository layer, fx module globals, on-disk snake_case struct tags)
- removed the deprecated `log.LogOptions` alias (callers migrated to `log.Options`)

`make check` (tests with `-race`, lint, fmt-check) passes.

Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #62
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/cli/config.go

@@ -13,6 +13,26 @@ import (
 	"gopkg.in/yaml.v3"
 )
 
+// configFileMode is the permission set for freshly written config files;
+// configs may hold S3 credentials, so keep them owner-only.
+const configFileMode = 0o600
+
+// configSetArgs is the argument count of `config set <key> <value>`.
+const configSetArgs = 2
+
+// configDirMode is the permission set for created config directories;
+// parent config dirs (e.g. ~/.config) are conventionally traversable.
+const configDirMode = 0o755
+
+var (
+	errConfigExists     = errors.New("config file already exists")
+	errEmptyConfig      = errors.New("empty config file")
+	errKeyNotFound      = errors.New("key not found")
+	errNeedNumericIndex = errors.New("key is a list; use a numeric index")
+	errIndexOutOfRange  = errors.New("index out of range")
+	errNotMapOrList     = errors.New("key is not a map or list")
+)
+
 const defaultConfigTemplate = `# vaultik configuration
 # Documentation: https://sneak.berlin/go/vaultik
 
@@ -233,28 +253,29 @@ The config is written to the path from --config, $VAULTIK_CONFIG, or
 the platform default config directory (e.g. ~/Library/Application Support/
 on macOS, ~/.config/ on Linux, /etc/vaultik/ as root).`,
 		Args: cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, _ []string) error {
 			path := configPathForInit()
 
 			_, err := os.Stat(path)
 			if err == nil {
-				return fmt.Errorf("config file already exists: %s", path)
+				return fmt.Errorf("%w: %s", errConfigExists, path)
 			}
 
 			dir := filepath.Dir(path)
 
-			err = os.MkdirAll(dir, 0o755)
+			err = os.MkdirAll(dir, configDirMode)
 			if err != nil {
 				return fmt.Errorf("creating config directory %s: %w", dir, err)
 			}
 
-			err = os.WriteFile(path, []byte(defaultConfigTemplate), 0o600)
+			err = os.WriteFile(path, []byte(defaultConfigTemplate), configFileMode)
 			if err != nil {
 				return fmt.Errorf("writing config file: %w", err)
 			}
 
-			fmt.Printf("Config written to %s\n", path)
-			fmt.Println("Edit it to set your age_recipients, snapshots, and storage_url.")
+			_, _ = fmt.Fprintf(os.Stdout, "Config written to %s\n", path)
+			_, _ = fmt.Fprintln(os.Stdout,
+				"Edit it to set your age_recipients, snapshots, and storage_url.")
 
 			return nil
 		},
@@ -267,7 +288,7 @@ func newConfigEditCommand() *cobra.Command {
 		Use:   "edit",
 		Short: "Open the config file in $EDITOR",
 		Args:  cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(cmd *cobra.Command, _ []string) error {
 			path, err := ResolveConfigPath()
 			if err != nil {
 				return err
@@ -278,7 +299,8 @@ func newConfigEditCommand() *cobra.Command {
 				editor = "vi"
 			}
 
-			ed := exec.Command(editor, path)
+			//nolint:gosec // G204: launching the operator's own $EDITOR is the point
+			ed := exec.CommandContext(cmd.Context(), editor, path)
 			ed.Stdin = os.Stdin
 			ed.Stdout = os.Stdout
 			ed.Stderr = os.Stderr
@@ -294,7 +316,7 @@ func newConfigGetCommand() *cobra.Command {
 		Use:   "get <key>",
 		Short: "Print a config value by dotted path (e.g. storage_url, compression_level)",
 		Args:  cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			path, err := ResolveConfigPath()
 			if err != nil {
 				return err
@@ -311,7 +333,7 @@ func newConfigGetCommand() *cobra.Command {
 			}
 
 			if node.Kind == yaml.ScalarNode {
-				fmt.Println(node.Value)
+				_, _ = fmt.Fprintln(os.Stdout, node.Value)
 
 				return nil
 			}
@@ -321,7 +343,7 @@ func newConfigGetCommand() *cobra.Command {
 				return fmt.Errorf("marshaling value: %w", err)
 			}
 
-			fmt.Print(string(out))
+			_, _ = fmt.Fprint(os.Stdout, string(out))
 
 			return nil
 		},
@@ -342,8 +364,8 @@ Examples:
   vaultik config set storage_url "s3://bucket/prefix?endpoint=host&region=us-east-1"
   vaultik config set compression_level 9
   vaultik config set s3.bucket mybucket  # legacy S3 fields still supported`,
-		Args: cobra.ExactArgs(2),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		Args: cobra.ExactArgs(configSetArgs),
+		RunE: func(_ *cobra.Command, args []string) error {
 			path, err := ResolveConfigPath()
 			if err != nil {
 				return err
@@ -364,10 +386,10 @@ Examples:
 				return fmt.Errorf("marshaling config: %w", err)
 			}
 
-			mode := os.FileMode(0o600)
+			mode := os.FileMode(configFileMode)
 
-			info, err := os.Stat(path)
-			if err == nil {
+			info, statErr := os.Stat(path)
+			if statErr == nil {
 				mode = info.Mode().Perm()
 			}
 
@@ -376,7 +398,7 @@ Examples:
 				return fmt.Errorf("writing config file: %w", err)
 			}
 
-			fmt.Printf("%s = %s\n", args[0], args[1])
+			_, _ = fmt.Fprintf(os.Stdout, "%s = %s\n", args[0], args[1])
 
 			return nil
 		},
@@ -386,7 +408,7 @@ Examples:
 // loadYAMLFile parses a YAML file into a yaml.Node document tree,
 // which preserves comments and ordering for round-tripping.
 func loadYAMLFile(path string) (*yaml.Node, error) {
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) //nolint:gosec // G304: config path is operator-supplied
 	if err != nil {
 		return nil, fmt.Errorf("reading config file: %w", err)
 	}
@@ -416,7 +438,7 @@ func yamlPathGet(root *yaml.Node, keys []string) (*yaml.Node, error) {
 	node := root
 	if node.Kind == yaml.DocumentNode {
 		if len(node.Content) == 0 {
-			return nil, errors.New("empty config file")
+			return nil, errEmptyConfig
 		}
 
 		node = node.Content[0]
@@ -437,21 +459,29 @@ func yamlPathGet(root *yaml.Node, keys []string) (*yaml.Node, error) {
 			}
 
 			if !found {
-				return nil, fmt.Errorf("key not found: %s", strings.Join(keys[:i+1], "."))
+				return nil, fmt.Errorf("%w: %s",
+					errKeyNotFound, strings.Join(keys[:i+1], "."))
 			}
 		case yaml.SequenceNode:
 			idx, err := strconv.Atoi(key)
 			if err != nil {
-				return nil, fmt.Errorf("key %q is a list; use a numeric index", strings.Join(keys[:i], "."))
+				return nil, fmt.Errorf("%w: %s",
+					errNeedNumericIndex, strings.Join(keys[:i], "."))
 			}
 
 			if idx < 0 || idx >= len(node.Content) {
-				return nil, fmt.Errorf("index %d out of range for %s (len %d)", idx, strings.Join(keys[:i], "."), len(node.Content))
+				return nil, fmt.Errorf("%w: index %d for %s (len %d)",
+					errIndexOutOfRange, idx, strings.Join(keys[:i], "."),
+					len(node.Content))
 			}
 
 			node = node.Content[idx]
+		case yaml.DocumentNode, yaml.ScalarNode, yaml.AliasNode:
+			return nil, fmt.Errorf("%w: %s",
+				errNotMapOrList, strings.Join(keys[:i], "."))
 		default:
-			return nil, fmt.Errorf("key %q is not a map or list", strings.Join(keys[:i], "."))
+			return nil, fmt.Errorf("%w: %s",
+				errNotMapOrList, strings.Join(keys[:i], "."))
 		}
 	}
 
@@ -477,62 +507,88 @@ func yamlPathSet(root *yaml.Node, keys []string, value string) error {
 
 		switch node.Kind {
 		case yaml.MappingNode:
-			var valueNode *yaml.Node
-
-			for j := 0; j+1 < len(node.Content); j += 2 {
-				if node.Content[j].Value == key {
-					valueNode = node.Content[j+1]
-
-					break
-				}
-			}
-
-			if valueNode == nil {
-				keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: key}
-
-				valueNode = &yaml.Node{Kind: yaml.MappingNode}
-				if last {
-					valueNode = &yaml.Node{Kind: yaml.ScalarNode, Value: value}
-				}
-
-				node.Content = append(node.Content, keyNode, valueNode)
-			} else if last {
-				setScalar(valueNode, value)
-			}
-
-			node = valueNode
-
+			node = yamlSetInMapping(node, key, value, last)
 		case yaml.SequenceNode:
-			idx, err := strconv.Atoi(key)
+			next, err := yamlSetInSequence(node, keys, i, value, last)
 			if err != nil {
-				return fmt.Errorf("key %q is a list; use a numeric index", strings.Join(keys[:i], "."))
+				return err
 			}
 
-			if idx < 0 || idx > len(node.Content) {
-				return fmt.Errorf("index %d out of range for %s (len %d)", idx, strings.Join(keys[:i], "."), len(node.Content))
-			}
-
-			if idx == len(node.Content) {
-				newNode := &yaml.Node{Kind: yaml.MappingNode}
-				if last {
-					newNode = &yaml.Node{Kind: yaml.ScalarNode, Value: value}
-				}
-
-				node.Content = append(node.Content, newNode)
-			} else if last {
-				setScalar(node.Content[idx], value)
-			}
-
-			node = node.Content[idx]
-
+			node = next
+		case yaml.DocumentNode, yaml.ScalarNode, yaml.AliasNode:
+			return fmt.Errorf("%w: %s",
+				errNotMapOrList, strings.Join(keys[:i], "."))
 		default:
-			return fmt.Errorf("key %q is not a map or list", strings.Join(keys[:i], "."))
+			return fmt.Errorf("%w: %s",
+				errNotMapOrList, strings.Join(keys[:i], "."))
 		}
 	}
 
 	return nil
 }
 
+// yamlSetInMapping resolves (creating if needed) the value node for key
+// within a mapping node, setting it to value when it is the final path
+// element, and returns the node to descend into.
+func yamlSetInMapping(node *yaml.Node, key, value string, last bool) *yaml.Node {
+	var valueNode *yaml.Node
+
+	for j := 0; j+1 < len(node.Content); j += 2 {
+		if node.Content[j].Value == key {
+			valueNode = node.Content[j+1]
+
+			break
+		}
+	}
+
+	if valueNode == nil {
+		keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: key}
+
+		valueNode = &yaml.Node{Kind: yaml.MappingNode}
+		if last {
+			valueNode = &yaml.Node{Kind: yaml.ScalarNode, Value: value}
+		}
+
+		node.Content = append(node.Content, keyNode, valueNode)
+	} else if last {
+		setScalar(valueNode, value)
+	}
+
+	return valueNode
+}
+
+// yamlSetInSequence indexes (or appends to) a sequence node using the
+// numeric path element keys[i], setting the element to value when it is
+// the final path element, and returns the node to descend into.
+func yamlSetInSequence(
+	node *yaml.Node, keys []string, i int, value string, last bool,
+) (*yaml.Node, error) {
+	idx, err := strconv.Atoi(keys[i])
+	if err != nil {
+		return nil, fmt.Errorf("%w: %s",
+			errNeedNumericIndex, strings.Join(keys[:i], "."))
+	}
+
+	if idx < 0 || idx > len(node.Content) {
+		return nil, fmt.Errorf("%w: index %d for %s (len %d)",
+			errIndexOutOfRange, idx, strings.Join(keys[:i], "."),
+			len(node.Content))
+	}
+
+	if idx == len(node.Content) {
+		newNode := &yaml.Node{Kind: yaml.MappingNode}
+		if last {
+			newNode = &yaml.Node{Kind: yaml.ScalarNode, Value: value}
+		}
+
+		node.Content = append(node.Content, newNode)
+	} else if last {
+		setScalar(node.Content[idx], value)
+	}
+
+	return node.Content[idx], nil
+}
+
 // setScalar overwrites a node in place with a plain scalar value.
 func setScalar(n *yaml.Node, value string) {
 	n.Kind = yaml.ScalarNode