Update golangci-lint to v2.12.2 with canonical config (#62)

Updates golangci-lint to v2.12.2 everywhere it is pinned and installs the canonical `.golangci.yml`, then remediates every finding the new linter/config surfaces so `make check` is green.

## Version bump

- `Dockerfile` lint stage: `golangci/golangci-lint:v2.11.3-alpine` -> `v2.12.2-alpine` (digest-pinned, date comment updated)
- `Makefile` `deps` target: `go install` moved from the old v1 module path at `@latest` to the pinned `github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2`
- `.golangci.yml` replaced with the canonical config (v2 schema; settings under `linters.settings` so the thresholds actually apply; `default: all` with the standard six disables)
- `script/bootstrap` installs golangci-lint via the system package manager and carries no version pin, so it is unchanged
- CI (`.gitea/workflows/check.yml`) only runs `script/cibuild`, so it needed no change

## Lint remediation

The canonical config surfaced ~3,300 findings across 56k lines. All are fixed, behavior-preserving; incorporates and supersedes the per-package mechanical passes already merged to `main` (refs #61). Highlights:

- `err113`: dynamic errors replaced with package sentinels + `%w` wrapping; comparisons via `errors.Is`
- `goprintffuncname`: printf-style helpers renamed with an `f` suffix (`ui.Writer` message methods, `cli.ReportErrorf`, `database.Fatalf`) and all call sites updated
- `revive` stutter renames: `blob.Handler`, `blob.WithReader`, `blob.ChunkPosition`, `storage.URL`, `storage.Info`; missing doc comments added
- `contextcheck`/`noctx`: `context.Context` threaded through `blob.Packer` and the scanner call sites; context-aware `exec`/`sql` variants
- `funlen`/`cyclop`/`gocognit`/`dupl`: oversized and duplicated functions split into focused helpers (production and test code)
- tests: `t.Parallel()` added where safe (global logger init kept in the serial phase for `-race`), `t.TempDir()`/`t.Helper()` adopted, several suites converted to external test packages
- `gosec`: bounded integer conversions, `ReadHeaderTimeout` on the test HTTP server; remaining warnings suppressed per-site with justifications
- remaining `nolint` directives are rare, targeted, and each carries a reason (e.g. `nilnil` not-found contract in the repository layer, fx module globals, on-disk snake_case struct tags)
- removed the deprecated `log.LogOptions` alias (callers migrated to `log.Options`)

`make check` (tests with `-race`, lint, fmt-check) passes.

Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #62
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/snapshot/file_change_test.go

@@ -2,7 +2,6 @@ package snapshot_test
 
 import (
 	"context"
-	"database/sql"
 	"testing"
 	"time"
 
@@ -15,11 +14,55 @@ import (
 	"sneak.berlin/go/vaultik/internal/types"
 )
 
+// verifyChunkChange checks that after a content change the file references
+// the new chunk, the old chunk still exists, and the old chunk no longer
+// maps to the modified file.
+func verifyChunkChange(
+	ctx context.Context,
+	t *testing.T,
+	repos *database.Repositories,
+	oldChunkHash, newChunkHash types.ChunkHash,
+) {
+	t.Helper()
+
+	// Verify the chunk hashes are different
+	assert.NotEqual(t, oldChunkHash, newChunkHash,
+		"Chunk hash should change when content changes")
+
+	// Get chunk files from second scan
+	chunkFiles2, err := repos.ChunkFiles.GetByFilePath(ctx, "/test.txt")
+	require.NoError(t, err)
+	assert.Len(t, chunkFiles2, 1)
+	assert.Equal(t, newChunkHash, chunkFiles2[0].ChunkHash)
+
+	// Verify old chunk still exists (it's still valid data)
+	oldChunk, err := repos.Chunks.GetByHash(ctx, oldChunkHash.String())
+	require.NoError(t, err)
+	assert.NotNil(t, oldChunk)
+
+	// Verify new chunk exists
+	newChunk, err := repos.Chunks.GetByHash(ctx, newChunkHash.String())
+	require.NoError(t, err)
+	assert.NotNil(t, newChunk)
+
+	// Verify that chunk_files for old chunk no longer references this file
+	oldChunkFiles, err := repos.ChunkFiles.GetByChunkHash(ctx, oldChunkHash)
+	require.NoError(t, err)
+
+	for _, cf := range oldChunkFiles {
+		file, err := repos.Files.GetByID(ctx, cf.FileID)
+		require.NoError(t, err)
+		assert.NotEqual(t, "/data/test.txt", file.Path,
+			"Old chunk should not be associated with the modified file")
+	}
+}
+
 // TestFileContentChange verifies that when a file's content changes,
 // the old chunks are properly disassociated
 func TestFileContentChange(t *testing.T) {
 	// Initialize logger for tests
 	log.Initialize(log.Config{})
+	t.Parallel()
 
 	// Create in-memory filesystem
 	fs := afero.NewMemMapFs()
@@ -48,23 +91,13 @@ func TestFileContentChange(t *testing.T) {
 		Repositories:     repos,
 		MaxBlobSize:      int64(1024 * 1024), // 1MB blobs
 		CompressionLevel: 3,
-		AgeRecipients:    []string{"age1ezrjmfpwsc95svdg0y54mums3zevgzu0x0ecq2f7tp8a05gl0sjq9q9wjg"}, // Test public key
+		AgeRecipients:    []string{testAgePublicKey},
 	})
 
 	// Create first snapshot
 	ctx := context.Background()
 	snapshotID1 := "snapshot1"
-	err = repos.WithTx(ctx, func(ctx context.Context, tx *sql.Tx) error {
-		snapshot := &database.Snapshot{
-			ID:             types.SnapshotID(snapshotID1),
-			Hostname:       "test-host",
-			VaultikVersion: "test",
-			StartedAt:      time.Now(),
-		}
-
-		return repos.Snapshots.Create(ctx, tx, snapshot)
-	})
-	require.NoError(t, err)
+	createSnapshotRecord(ctx, t, repos, snapshotID1)
 
 	// First scan - should create chunks for initial content
 	result1, err := scanner.Scan(ctx, "/", snapshotID1)
@@ -85,22 +118,13 @@ func TestFileContentChange(t *testing.T) {
 	// Modify the file
 	time.Sleep(10 * time.Millisecond) // Ensure mtime changes
 
-	err = afero.WriteFile(fs, "/test.txt", []byte("Modified content with different data"), 0644)
+	err = afero.WriteFile(fs, "/test.txt",
+		[]byte("Modified content with different data"), 0644)
 	require.NoError(t, err)
 
 	// Create second snapshot
 	snapshotID2 := "snapshot2"
-	err = repos.WithTx(ctx, func(ctx context.Context, tx *sql.Tx) error {
-		snapshot := &database.Snapshot{
-			ID:             types.SnapshotID(snapshotID2),
-			Hostname:       "test-host",
-			VaultikVersion: "test",
-			StartedAt:      time.Now(),
-		}
-
-		return repos.Snapshots.Create(ctx, tx, snapshot)
-	})
-	require.NoError(t, err)
+	createSnapshotRecord(ctx, t, repos, snapshotID2)
 
 	// Second scan - should create new chunks and remove old associations
 	result2, err := scanner.Scan(ctx, "/", snapshotID2)
@@ -113,40 +137,14 @@ func TestFileContentChange(t *testing.T) {
 	assert.Len(t, fileChunks2, 1) // Still 1 chunk but different hash
 	newChunkHash := fileChunks2[0].ChunkHash
 
-	// Verify the chunk hashes are different
-	assert.NotEqual(t, oldChunkHash, newChunkHash, "Chunk hash should change when content changes")
-
-	// Get chunk files from second scan
-	chunkFiles2, err := repos.ChunkFiles.GetByFilePath(ctx, "/test.txt")
-	require.NoError(t, err)
-	assert.Len(t, chunkFiles2, 1)
-	assert.Equal(t, newChunkHash, chunkFiles2[0].ChunkHash)
-
-	// Verify old chunk still exists (it's still valid data)
-	oldChunk, err := repos.Chunks.GetByHash(ctx, oldChunkHash.String())
-	require.NoError(t, err)
-	assert.NotNil(t, oldChunk)
-
-	// Verify new chunk exists
-	newChunk, err := repos.Chunks.GetByHash(ctx, newChunkHash.String())
-	require.NoError(t, err)
-	assert.NotNil(t, newChunk)
-
-	// Verify that chunk_files for old chunk no longer references this file
-	oldChunkFiles, err := repos.ChunkFiles.GetByChunkHash(ctx, oldChunkHash)
-	require.NoError(t, err)
-
-	for _, cf := range oldChunkFiles {
-		file, err := repos.Files.GetByID(ctx, cf.FileID)
-		require.NoError(t, err)
-		assert.NotEqual(t, "/data/test.txt", file.Path, "Old chunk should not be associated with the modified file")
-	}
+	verifyChunkChange(ctx, t, repos, oldChunkHash, newChunkHash)
 }
 
 // TestMultipleFileChanges verifies handling of multiple file changes in one scan
 func TestMultipleFileChanges(t *testing.T) {
 	// Initialize logger for tests
 	log.Initialize(log.Config{})
+	t.Parallel()
 
 	// Create in-memory filesystem
 	fs := afero.NewMemMapFs()
@@ -183,23 +181,13 @@ func TestMultipleFileChanges(t *testing.T) {
 		Repositories:     repos,
 		MaxBlobSize:      int64(1024 * 1024), // 1MB blobs
 		CompressionLevel: 3,
-		AgeRecipients:    []string{"age1ezrjmfpwsc95svdg0y54mums3zevgzu0x0ecq2f7tp8a05gl0sjq9q9wjg"}, // Test public key
+		AgeRecipients:    []string{testAgePublicKey},
 	})
 
 	// Create first snapshot
 	ctx := context.Background()
 	snapshotID1 := "snapshot1"
-	err = repos.WithTx(ctx, func(ctx context.Context, tx *sql.Tx) error {
-		snapshot := &database.Snapshot{
-			ID:             types.SnapshotID(snapshotID1),
-			Hostname:       "test-host",
-			VaultikVersion: "test",
-			StartedAt:      time.Now(),
-		}
-
-		return repos.Snapshots.Create(ctx, tx, snapshot)
-	})
-	require.NoError(t, err)
+	createSnapshotRecord(ctx, t, repos, snapshotID1)
 
 	// First scan
 	result1, err := scanner.Scan(ctx, "/", snapshotID1)
@@ -217,17 +205,7 @@ func TestMultipleFileChanges(t *testing.T) {
 
 	// Create second snapshot
 	snapshotID2 := "snapshot2"
-	err = repos.WithTx(ctx, func(ctx context.Context, tx *sql.Tx) error {
-		snapshot := &database.Snapshot{
-			ID:             types.SnapshotID(snapshotID2),
-			Hostname:       "test-host",
-			VaultikVersion: "test",
-			StartedAt:      time.Now(),
-		}
-
-		return repos.Snapshots.Create(ctx, tx, snapshot)
-	})
-	require.NoError(t, err)
+	createSnapshotRecord(ctx, t, repos, snapshotID2)
 
 	// Second scan
 	result2, err := scanner.Scan(ctx, "/", snapshotID2)
@@ -240,10 +218,12 @@ func TestMultipleFileChanges(t *testing.T) {
 	for path := range files {
 		fileChunks, err := repos.FileChunks.GetByPath(ctx, path)
 		require.NoError(t, err)
-		assert.Len(t, fileChunks, 1, "File %s should have exactly 1 chunk association", path)
+		assert.Len(t, fileChunks, 1,
+			"File %s should have exactly 1 chunk association", path)
 
 		chunkFiles, err := repos.ChunkFiles.GetByFilePath(ctx, path)
 		require.NoError(t, err)
-		assert.Len(t, chunkFiles, 1, "File %s should have exactly 1 chunk-file association", path)
+		assert.Len(t, chunkFiles, 1,
+			"File %s should have exactly 1 chunk-file association", path)
 	}
 }