Update golangci-lint to v2.12.2 with canonical config (#62)

Updates golangci-lint to v2.12.2 everywhere it is pinned and installs the canonical `.golangci.yml`, then remediates every finding the new linter/config surfaces so `make check` is green.

## Version bump

- `Dockerfile` lint stage: `golangci/golangci-lint:v2.11.3-alpine` -> `v2.12.2-alpine` (digest-pinned, date comment updated)
- `Makefile` `deps` target: `go install` moved from the old v1 module path at `@latest` to the pinned `github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2`
- `.golangci.yml` replaced with the canonical config (v2 schema; settings under `linters.settings` so the thresholds actually apply; `default: all` with the standard six disables)
- `script/bootstrap` installs golangci-lint via the system package manager and carries no version pin, so it is unchanged
- CI (`.gitea/workflows/check.yml`) only runs `script/cibuild`, so it needed no change

## Lint remediation

The canonical config surfaced ~3,300 findings across 56k lines. All are fixed, behavior-preserving; incorporates and supersedes the per-package mechanical passes already merged to `main` (refs #61). Highlights:

- `err113`: dynamic errors replaced with package sentinels + `%w` wrapping; comparisons via `errors.Is`
- `goprintffuncname`: printf-style helpers renamed with an `f` suffix (`ui.Writer` message methods, `cli.ReportErrorf`, `database.Fatalf`) and all call sites updated
- `revive` stutter renames: `blob.Handler`, `blob.WithReader`, `blob.ChunkPosition`, `storage.URL`, `storage.Info`; missing doc comments added
- `contextcheck`/`noctx`: `context.Context` threaded through `blob.Packer` and the scanner call sites; context-aware `exec`/`sql` variants
- `funlen`/`cyclop`/`gocognit`/`dupl`: oversized and duplicated functions split into focused helpers (production and test code)
- tests: `t.Parallel()` added where safe (global logger init kept in the serial phase for `-race`), `t.TempDir()`/`t.Helper()` adopted, several suites converted to external test packages
- `gosec`: bounded integer conversions, `ReadHeaderTimeout` on the test HTTP server; remaining warnings suppressed per-site with justifications
- remaining `nolint` directives are rare, targeted, and each carries a reason (e.g. `nilnil` not-found contract in the repository layer, fx module globals, on-disk snake_case struct tags)
- removed the deprecated `log.LogOptions` alias (callers migrated to `log.Options`)

`make check` (tests with `-race`, lint, fmt-check) passes.

Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #62
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/database/files.go

@@ -12,14 +12,20 @@ import (
 	"sneak.berlin/go/vaultik/internal/types"
 )
 
+// FileRepository provides access to the files table, which stores file
+// metadata (path, times, permissions, ownership, symlink targets).
 type FileRepository struct {
 	db *DB
 }
 
+// NewFileRepository creates a FileRepository backed by db.
 func NewFileRepository(db *DB) *FileRepository {
 	return &FileRepository{db: db}
 }
 
+// Create inserts or updates a file row (upsert on path), using tx when
+// non-nil. The file's ID is generated when zero and updated from the
+// database's RETURNING clause.
 func (r *FileRepository) Create(ctx context.Context, tx *sql.Tx, file *File) error {
 	// Generate UUID if not provided
 	if file.ID.IsZero() {
@@ -46,10 +52,19 @@ func (r *FileRepository) Create(ctx context.Context, tx *sql.Tx, file *File) err
 	)
 
 	if tx != nil {
-		LogSQL("Execute", query, file.ID.String(), file.Path.String(), file.SourcePath.String(), file.MTime.Unix(), file.Size, file.Mode, file.UID, file.GID, file.LinkTarget.String())
-		err = tx.QueryRowContext(ctx, query, file.ID.String(), file.Path.String(), file.SourcePath.String(), file.MTime.Unix(), file.Size, file.Mode, file.UID, file.GID, file.LinkTarget.String()).Scan(&idStr)
+		LogSQL("Execute", query,
+			file.ID.String(), file.Path.String(), file.SourcePath.String(),
+			file.MTime.Unix(), file.Size, file.Mode, file.UID, file.GID,
+			file.LinkTarget.String())
+		err = tx.QueryRowContext(ctx, query,
+			file.ID.String(), file.Path.String(), file.SourcePath.String(),
+			file.MTime.Unix(), file.Size, file.Mode, file.UID, file.GID,
+			file.LinkTarget.String()).Scan(&idStr)
 	} else {
-		err = r.db.QueryRowWithLog(ctx, query, file.ID.String(), file.Path.String(), file.SourcePath.String(), file.MTime.Unix(), file.Size, file.Mode, file.UID, file.GID, file.LinkTarget.String()).Scan(&idStr)
+		err = r.db.QueryRowWithLog(ctx, query,
+			file.ID.String(), file.Path.String(), file.SourcePath.String(),
+			file.MTime.Unix(), file.Size, file.Mode, file.UID, file.GID,
+			file.LinkTarget.String()).Scan(&idStr)
 	}
 
 	if err != nil {
@@ -65,6 +80,8 @@ func (r *FileRepository) Create(ctx context.Context, tx *sql.Tx, file *File) err
 	return nil
 }
 
+// GetByPath returns the file at the given path, or nil if the path is not
+// in the index.
 func (r *FileRepository) GetByPath(ctx context.Context, path string) (*File, error) {
 	query := `
 		SELECT id, path, source_path, mtime, size, mode, uid, gid, link_target
@@ -74,7 +91,7 @@ func (r *FileRepository) GetByPath(ctx context.Context, path string) (*File, err
 
 	file, err := r.scanFile(r.db.conn.QueryRowContext(ctx, query, path))
 	if errors.Is(err, sql.ErrNoRows) {
-		return nil, nil
+		return nil, nil //nolint:nilnil // nil,nil signals not-found; callers check nil
 	}
 
 	if err != nil {
@@ -94,7 +111,7 @@ func (r *FileRepository) GetByID(ctx context.Context, id types.FileID) (*File, e
 
 	file, err := r.scanFile(r.db.conn.QueryRowContext(ctx, query, id.String()))
 	if errors.Is(err, sql.ErrNoRows) {
-		return nil, nil
+		return nil, nil //nolint:nilnil // nil,nil signals not-found; callers check nil
 	}
 
 	if err != nil {
@@ -104,7 +121,11 @@ func (r *FileRepository) GetByID(ctx context.Context, id types.FileID) (*File, e
 	return file, nil
 }
 
-func (r *FileRepository) GetByPathTx(ctx context.Context, tx *sql.Tx, path string) (*File, error) {
+// GetByPathTx returns the file at the given path within a transaction, or
+// nil if the path is not in the index.
+func (r *FileRepository) GetByPathTx(
+	ctx context.Context, tx *sql.Tx, path string,
+) (*File, error) {
 	query := `
 		SELECT id, path, source_path, mtime, size, mode, uid, gid, link_target
 		FROM files
@@ -116,7 +137,7 @@ func (r *FileRepository) GetByPathTx(ctx context.Context, tx *sql.Tx, path strin
 	LogSQL("GetByPathTx Scan complete", query, path)
 
 	if errors.Is(err, sql.ErrNoRows) {
-		return nil, nil
+		return nil, nil //nolint:nilnil // nil,nil signals not-found; callers check nil
 	}
 
 	if err != nil {
@@ -126,87 +147,16 @@ func (r *FileRepository) GetByPathTx(ctx context.Context, tx *sql.Tx, path strin
 	return file, nil
 }
 
-// scanFile is a helper that scans a single file row
-func (r *FileRepository) scanFile(row *sql.Row) (*File, error) {
-	var (
-		file                          File
-		idStr, pathStr, sourcePathStr string
-		mtimeUnix                     int64
-		linkTarget                    sql.NullString
-	)
-
-	err := row.Scan(
-		&idStr,
-		&pathStr,
-		&sourcePathStr,
-		&mtimeUnix,
-		&file.Size,
-		&file.Mode,
-		&file.UID,
-		&file.GID,
-		&linkTarget,
-	)
-	if err != nil {
-		return nil, err
-	}
-
-	file.ID, err = types.ParseFileID(idStr)
-	if err != nil {
-		return nil, fmt.Errorf("parsing file ID: %w", err)
-	}
-
-	file.Path = types.FilePath(pathStr)
-	file.SourcePath = types.SourcePath(sourcePathStr)
-
-	file.MTime = time.Unix(mtimeUnix, 0).UTC()
-	if linkTarget.Valid {
-		file.LinkTarget = types.FilePath(linkTarget.String)
-	}
-
-	return &file, nil
+// fileRowScanner abstracts *sql.Row and *sql.Rows for scanning a file row.
+type fileRowScanner interface {
+	Scan(dest ...any) error
 }
 
-// scanFileRows is a helper that scans a file row from rows iterator
-func (r *FileRepository) scanFileRows(rows *sql.Rows) (*File, error) {
-	var (
-		file                          File
-		idStr, pathStr, sourcePathStr string
-		mtimeUnix                     int64
-		linkTarget                    sql.NullString
-	)
-
-	err := rows.Scan(
-		&idStr,
-		&pathStr,
-		&sourcePathStr,
-		&mtimeUnix,
-		&file.Size,
-		&file.Mode,
-		&file.UID,
-		&file.GID,
-		&linkTarget,
-	)
-	if err != nil {
-		return nil, err
-	}
-
-	file.ID, err = types.ParseFileID(idStr)
-	if err != nil {
-		return nil, fmt.Errorf("parsing file ID: %w", err)
-	}
-
-	file.Path = types.FilePath(pathStr)
-	file.SourcePath = types.SourcePath(sourcePathStr)
-
-	file.MTime = time.Unix(mtimeUnix, 0).UTC()
-	if linkTarget.Valid {
-		file.LinkTarget = types.FilePath(linkTarget.String)
-	}
-
-	return &file, nil
-}
-
-func (r *FileRepository) ListModifiedSince(ctx context.Context, since time.Time) ([]*File, error) {
+// ListModifiedSince returns all files whose recorded mtime is at or after
+// since, ordered by path.
+func (r *FileRepository) ListModifiedSince(
+	ctx context.Context, since time.Time,
+) ([]*File, error) {
 	query := `
 		SELECT id, path, source_path, mtime, size, mode, uid, gid, link_target
 		FROM files
@@ -234,6 +184,7 @@ func (r *FileRepository) ListModifiedSince(ctx context.Context, since time.Time)
 	return files, rows.Err()
 }
 
+// Delete removes the file row at the given path, using tx when non-nil.
 func (r *FileRepository) Delete(ctx context.Context, tx *sql.Tx, path string) error {
 	query := `DELETE FROM files WHERE path = ?`
 
@@ -252,7 +203,9 @@ func (r *FileRepository) Delete(ctx context.Context, tx *sql.Tx, path string) er
 }
 
 // DeleteByID deletes a file by its UUID
-func (r *FileRepository) DeleteByID(ctx context.Context, tx *sql.Tx, id types.FileID) error {
+func (r *FileRepository) DeleteByID(
+	ctx context.Context, tx *sql.Tx, id types.FileID,
+) error {
 	query := `DELETE FROM files WHERE id = ?`
 
 	var err error
@@ -269,7 +222,11 @@ func (r *FileRepository) DeleteByID(ctx context.Context, tx *sql.Tx, id types.Fi
 	return nil
 }
 
-func (r *FileRepository) ListByPrefix(ctx context.Context, prefix string) ([]*File, error) {
+// ListByPrefix returns all files whose path starts with prefix, ordered by
+// path.
+func (r *FileRepository) ListByPrefix(
+	ctx context.Context, prefix string,
+) ([]*File, error) {
 	query := `
 		SELECT id, path, source_path, mtime, size, mode, uid, gid, link_target
 		FROM files
@@ -327,12 +284,17 @@ func (r *FileRepository) ListAll(ctx context.Context) ([]*File, error) {
 
 // CreateBatch inserts or updates multiple files in a single statement for efficiency.
 // File IDs must be pre-generated before calling this method.
-func (r *FileRepository) CreateBatch(ctx context.Context, tx *sql.Tx, files []*File) error {
+func (r *FileRepository) CreateBatch(
+	ctx context.Context, tx *sql.Tx, files []*File,
+) error {
 	if len(files) == 0 {
 		return nil
 	}
 
-	// Each File has 9 values, so batch at 100 to be safe with SQLite's variable limit
+	// Each files row binds this many SQL variables.
+	const fileCols = 9
+
+	// Batch at 100 rows to be safe with SQLite's variable limit.
 	const batchSize = 100
 
 	for i := 0; i < len(files); i += batchSize {
@@ -340,9 +302,11 @@ func (r *FileRepository) CreateBatch(ctx context.Context, tx *sql.Tx, files []*F
 
 		batch := files[i:end]
 
-		query := `INSERT INTO files (id, path, source_path, mtime, size, mode, uid, gid, link_target) VALUES `
+		query := `INSERT INTO files
+			(id, path, source_path, mtime, size, mode, uid, gid, link_target)
+			VALUES `
 
-		args := make([]any, 0, len(batch)*9)
+		args := make([]any, 0, len(batch)*fileCols)
 
 		var querySb325 strings.Builder
 
@@ -353,10 +317,13 @@ func (r *FileRepository) CreateBatch(ctx context.Context, tx *sql.Tx, files []*F
 
 			querySb325.WriteString("(?, ?, ?, ?, ?, ?, ?, ?, ?)")
 
-			args = append(args, f.ID.String(), f.Path.String(), f.SourcePath.String(), f.MTime.Unix(), f.Size, f.Mode, f.UID, f.GID, f.LinkTarget.String())
+			args = append(args,
+				f.ID.String(), f.Path.String(), f.SourcePath.String(),
+				f.MTime.Unix(), f.Size, f.Mode, f.UID, f.GID,
+				f.LinkTarget.String())
 		}
 
-		query += querySb325.String()
+		query += querySb325.String() //nolint:gosec // G202: appends "?" placeholders only
 
 		query += ` ON CONFLICT(path) DO UPDATE SET
 			source_path = excluded.source_path,
@@ -404,3 +371,53 @@ func (r *FileRepository) DeleteOrphaned(ctx context.Context) error {
 
 	return nil
 }
+
+// scanFile is a helper that scans a single file row
+func (r *FileRepository) scanFile(row *sql.Row) (*File, error) {
+	return r.scanFileFrom(row)
+}
+
+// scanFileRows is a helper that scans a file row from rows iterator
+func (r *FileRepository) scanFileRows(rows *sql.Rows) (*File, error) {
+	return r.scanFileFrom(rows)
+}
+
+// scanFileFrom scans one file row from any row scanner.
+func (r *FileRepository) scanFileFrom(row fileRowScanner) (*File, error) {
+	var (
+		file                          File
+		idStr, pathStr, sourcePathStr string
+		mtimeUnix                     int64
+		linkTarget                    sql.NullString
+	)
+
+	err := row.Scan(
+		&idStr,
+		&pathStr,
+		&sourcePathStr,
+		&mtimeUnix,
+		&file.Size,
+		&file.Mode,
+		&file.UID,
+		&file.GID,
+		&linkTarget,
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	file.ID, err = types.ParseFileID(idStr)
+	if err != nil {
+		return nil, fmt.Errorf("parsing file ID: %w", err)
+	}
+
+	file.Path = types.FilePath(pathStr)
+	file.SourcePath = types.SourcePath(sourcePathStr)
+
+	file.MTime = time.Unix(mtimeUnix, 0).UTC()
+	if linkTarget.Valid {
+		file.LinkTarget = types.FilePath(linkTarget.String)
+	}
+
+	return &file, nil
+}