Update golangci-lint to v2.12.2 with canonical config (#62)

Updates golangci-lint to v2.12.2 everywhere it is pinned and installs the canonical `.golangci.yml`, then remediates every finding the new linter/config surfaces so `make check` is green. ## Version bump - `Dockerfile` lint stage: `golangci/golangci-lint:v2.11.3-alpine` -> `v2.12.2-alpine` (digest-pinned, date comment updated) - `Makefile` `deps` target: `go install` moved from the old v1 module path at `@latest` to the pinned `github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2` - `.golangci.yml` replaced with the canonical config (v2 schema; settings under `linters.settings` so the thresholds actually apply; `default: all` with the standard six disables) - `script/bootstrap` installs golangci-lint via the system package manager and carries no version pin, so it is unchanged - CI (`.gitea/workflows/check.yml`) only runs `script/cibuild`, so it needed no change ## Lint remediation The canonical config surfaced ~3,300 findings across 56k lines. All are fixed, behavior-preserving; incorporates and supersedes the per-package mechanical passes already merged to `main` (refs #61). Highlights: - `err113`: dynamic errors replaced with package sentinels + `%w` wrapping; comparisons via `errors.Is` - `goprintffuncname`: printf-style helpers renamed with an `f` suffix (`ui.Writer` message methods, `cli.ReportErrorf`, `database.Fatalf`) and all call sites updated - `revive` stutter renames: `blob.Handler`, `blob.WithReader`, `blob.ChunkPosition`, `storage.URL`, `storage.Info`; missing doc comments added - `contextcheck`/`noctx`: `context.Context` threaded through `blob.Packer` and the scanner call sites; context-aware `exec`/`sql` variants - `funlen`/`cyclop`/`gocognit`/`dupl`: oversized and duplicated functions split into focused helpers (production and test code) - tests: `t.Parallel()` added where safe (global logger init kept in the serial phase for `-race`), `t.TempDir()`/`t.Helper()` adopted, several suites converted to external test packages - `gosec`: bounded integer conversions, `ReadHeaderTimeout` on the test HTTP server; remaining warnings suppressed per-site with justifications - remaining `nolint` directives are rare, targeted, and each carries a reason (e.g. `nilnil` not-found contract in the repository layer, fx module globals, on-disk snake_case struct tags) - removed the deprecated `log.LogOptions` alias (callers migrated to `log.Options`) `make check` (tests with `-race`, lint, fmt-check) passes. Co-authored-by: sneak <sneak@sneak.berlin> Reviewed-on: #62 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>
2026-08-07 23:22:48 +02:00
parent b87b72d4b9
commit cc58583130
126 changed files with 8145 additions and 5431 deletions
@@ -40,33 +40,20 @@ import (
 // originals; the sweeper must keep each blob alive until BOTH the
 // original AND every duplicate referencing its chunks have been
 // restored.
-func TestRestoreSweeperEvictsBlobs(t *testing.T) {
-	log.Initialize(log.Config{})
+// buildSweeperFixture writes the source layout for the sweeper test: 30
+// unique 1 MB random files plus 10 duplicates of a random subset. The
+// PRNG seed is fixed so failures are reproducible; the entropy is what
+// matters here — the FastCDC chunker needs realistic-looking data to
+// pick chunk boundaries naturally. Returns the expected content by
+// path.
+func buildSweeperFixture(
+	t *testing.T, fs afero.Fs, dataDir string, uniqueFiles, duplicateFiles int,
+) map[string][]byte {
+	t.Helper()

-	fs := afero.NewOsFs()
-	tempDir, err := os.MkdirTemp("", "vaultik-sweeper-")
-	require.NoError(t, err)
+	const fileSize = 1 * 1024 * 1024

-	defer func() { _ = os.RemoveAll(tempDir) }()
-
-	dataDir := filepath.Join(tempDir, "source")
-	storeDir := filepath.Join(tempDir, "remote")
-	restoreDir := filepath.Join(tempDir, "restored")
-	dbPath := filepath.Join(tempDir, "index.sqlite")
-
-	require.NoError(t, fs.MkdirAll(dataDir, 0o755))
-
-	// Generate 30 unique 1 MB random files. The PRNG seed is fixed so
-	// failures are reproducible; the entropy is what matters here — the
-	// FastCDC chunker needs realistic-looking data to pick chunk
-	// boundaries naturally.
-	const (
-		uniqueFiles    = 30
-		duplicateFiles = 10
-		fileSize       = 1 * 1024 * 1024
-	)
-
-	rng := rand.New(rand.NewSource(42))
+	rng := rand.New(rand.NewSource(42)) //nolint:gosec // G404: fixture data only

 	type sourceFile struct {
 		path string
@@ -87,33 +74,58 @@ func TestRestoreSweeperEvictsBlobs(t *testing.T) {
 		expected[path] = data
 	}

-	// Pick 10 of the originals and copy each to a fresh path so the
-	// chunker dedups them against the originals' blobs.
+	// Copy a subset of the originals to fresh paths so the chunker
+	// dedups them against the originals' blobs.
 	for i, idx := range rng.Perm(uniqueFiles)[:duplicateFiles] {
 		src := uniques[idx]
 		dstPath := filepath.Join(dataDir, fmt.Sprintf("dup-%02d.bin", i))
 		require.NoError(t, afero.WriteFile(fs, dstPath, src.data, 0o644))
+
 		expected[dstPath] = src.data
 	}

-	chunkSize := int64(64 * 1024)
-	maxBlobSize := int64(10 * 1024 * 1024)
+	return expected
+}

-	storer, err := storage.NewFileStorer(storeDir)
-	require.NoError(t, err)
+// verifySingleDownloadPerBlob asserts each blob on disk was fetched
+// exactly once. >1 means the sweeper evicted a still-needed blob; 0
+// means the cache silently stopped being consulted.
+func verifySingleDownloadPerBlob(
+	t *testing.T, counter *countingStorer, storeDir string,
+) {
+	t.Helper()

-	agePublicKey := "age1ezrjmfpwsc95svdg0y54mums3zevgzu0x0ecq2f7tp8a05gl0sjq9q9wjg"
-	ageSecretKey := "AGE-SECRET-KEY-19CR5YSFW59HM4TLD6GXVEDMZFTVVF7PPHKUT68TXSFPK7APHXA2QS2NJA5"
+	blobDownloads := 0

-	cfg := &config.Config{
-		AgeRecipients:    []string{agePublicKey},
-		AgeSecretKey:     ageSecretKey,
-		CompressionLevel: 3,
-		Hostname:         "test-host",
-		BlobSizeLimit:    config.Size(maxBlobSize),
+	for key, count := range counter.snapshot() {
+		if !strings.HasPrefix(key, "blobs/") {
+			continue
+		}
+
+		assert.Equalf(t, 1, count,
+			"blob %s should have been downloaded exactly once during "+
+				"restore, got %d", key, count)
+
+		blobDownloads++
 	}

-	ctx := context.Background()
+	blobCount := countBlobsOnDisk(t, storeDir)
+	assert.Equal(t, blobCount, blobDownloads,
+		"every blob on disk should have been fetched exactly once during restore")
+	t.Logf("restore downloaded %d blobs, each exactly once", blobDownloads)
+}
+
+// runSweeperBackup performs the backup half of the sweeper test and
+// closes the index database so the restore half runs from remote bytes
+// only. Returns the snapshot ID.
+func runSweeperBackup(
+	ctx context.Context, t *testing.T, fs afero.Fs,
+	storer *storage.FileStorer, cfg *config.Config,
+	dataDir, storeDir, dbPath string,
+	chunkSize, maxBlobSize int64,
+	uniqueFiles, duplicateFiles int,
+) string {
+	t.Helper()

 	db, err := database.New(ctx, dbPath)
 	require.NoError(t, err)
@@ -139,13 +151,15 @@ func TestRestoreSweeperEvictsBlobs(t *testing.T) {
 		Repositories:     repos,
 	})

-	snapshotID, err := sm.CreateSnapshotWithName(ctx, cfg.Hostname, "sweeper", "test-version", "test-git")
+	snapshotID, err := sm.CreateSnapshotWithName(
+		ctx, cfg.Hostname, "sweeper", "test-version", "test-git")
 	require.NoError(t, err)

 	scanResult, err := scanner.Scan(ctx, dataDir, snapshotID)
 	require.NoError(t, err)
 	require.Equal(t, uniqueFiles+duplicateFiles, scanResult.FilesScanned)
-	require.Greater(t, scanResult.BlobsCreated, 1, "30 MB of unique data at 10 MB blob size should yield multiple blobs")
+	require.Greater(t, scanResult.BlobsCreated, 1,
+		"30 MB of unique data at 10 MB blob size should yield multiple blobs")

 	require.NoError(t, sm.CompleteSnapshot(ctx, snapshotID))
 	require.NoError(t, sm.ExportSnapshotMetadata(ctx, dbPath, snapshotID))
@@ -161,6 +175,50 @@ func TestRestoreSweeperEvictsBlobs(t *testing.T) {
 	// as a real restore on a fresh machine would.
 	require.NoError(t, db.Close())

+	return snapshotID
+}
+
+func TestRestoreSweeperEvictsBlobs(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	fs := afero.NewOsFs()
+	tempDir := t.TempDir()
+
+	dataDir := filepath.Join(tempDir, "source")
+	storeDir := filepath.Join(tempDir, "remote")
+	restoreDir := filepath.Join(tempDir, "restored")
+	dbPath := filepath.Join(tempDir, "index.sqlite")
+
+	require.NoError(t, fs.MkdirAll(dataDir, 0o755))
+
+	const (
+		uniqueFiles    = 30
+		duplicateFiles = 10
+	)
+
+	expected := buildSweeperFixture(t, fs, dataDir, uniqueFiles, duplicateFiles)
+
+	chunkSize := int64(64 * 1024)
+	maxBlobSize := int64(10 * 1024 * 1024)
+
+	storer, err := storage.NewFileStorer(storeDir)
+	require.NoError(t, err)
+
+	cfg := &config.Config{
+		AgeRecipients:    []string{testAgePublicKey},
+		AgeSecretKey:     testAgeSecretKey,
+		CompressionLevel: 3,
+		Hostname:         testHostname,
+		BlobSizeLimit:    config.Size(maxBlobSize),
+	}
+
+	ctx := context.Background()
+
+	snapshotID := runSweeperBackup(ctx, t, fs, storer, cfg,
+		dataDir, storeDir, dbPath, chunkSize, maxBlobSize,
+		uniqueFiles, duplicateFiles)
+
 	counter := newCountingStorer(storer)

 	restoreVaultik := &vaultik.Vaultik{
@@ -186,25 +244,7 @@ func TestRestoreSweeperEvictsBlobs(t *testing.T) {
 		require.Equalf(t, want, got, "byte mismatch for %s", origPath)
 	}

-	// Each blob must have been downloaded exactly once. >1 means the
-	// sweeper evicted a still-needed blob; 0 means the cache silently
-	// stopped being consulted.
-	blobDownloads := 0
-
-	for key, count := range counter.snapshot() {
-		if !strings.HasPrefix(key, "blobs/") {
-			continue
-		}
-
-		assert.Equalf(t, 1, count,
-			"blob %s should have been downloaded exactly once during restore, got %d", key, count)
-
-		blobDownloads++
-	}
-
-	assert.Equal(t, blobCount, blobDownloads,
-		"every blob on disk should have been fetched exactly once during restore")
-	t.Logf("restore downloaded %d blobs, each exactly once", blobDownloads)
+	verifySingleDownloadPerBlob(t, counter, storeDir)
 }

 // countingStorer wraps a Storer and records the number of Get calls per
@@ -221,7 +261,9 @@ func newCountingStorer(inner storage.Storer) *countingStorer {
 	return &countingStorer{Storer: inner, counts: make(map[string]int)}
 }

-func (c *countingStorer) Get(ctx context.Context, key string) (io.ReadCloser, error) {
+func (c *countingStorer) Get(
+	ctx context.Context, key string,
+) (io.ReadCloser, error) {
 	c.mu.Lock()
 	c.counts[key]++
 	c.mu.Unlock()