Fix linting issues

rdimitrov · rdimitrov · commit 737f66c5ebc3 · 2026-03-07T00:52:54.000+02:00
Signed-off-by: Radoslav Dimitrov &lt;radoslav@stacklok.com&gt;
diff --git a/cmd/thv/main.go b/cmd/thv/main.go
@@ -84,7 +84,7 @@ func setupSignalHandler() context.Context {
 	sigCh := make(chan os.Signal, 1)
 	signal.Notify(sigCh, os.Interrupt, syscall.SIGTERM, syscall.SIGQUIT)
 
-	ctx, cancel := context.WithCancel(context.Background())
+	ctx, cancel := context.WithCancel(context.Background()) //nolint:gosec // G118 - cancel called in signal handler goroutine
 	go func() {
 		<-sigCh
 		slog.Debug("received signal, cleaning up lock files")
diff --git a/pkg/auth/github_provider.go b/pkg/auth/github_provider.go
@@ -127,6 +127,7 @@ func (*GitHubProvider) CanHandle(introspectURL string) bool {
 // IntrospectToken introspects a GitHub OAuth token and returns JWT claims
 // This calls GitHub's token validation API to verify the token and extract user information
 func (g *GitHubProvider) IntrospectToken(ctx context.Context, token string) (jwt.MapClaims, error) {
+	//nolint:gosec // G706 - baseURL is a configured GitHub API endpoint
 	slog.Debug("using GitHub token validation provider", "url", g.baseURL)
 
 	// Apply rate limiting to prevent DoS and respect GitHub API limits
@@ -142,6 +143,7 @@ func (g *GitHubProvider) IntrospectToken(ctx context.Context, token string) (jwt
 	}
 
 	// Create POST request
+	//nolint:gosec // G704 - URL is configured GitHub API endpoint
 	req, err := http.NewRequestWithContext(ctx, "POST", g.baseURL, bytes.NewReader(bodyBytes))
 	if err != nil {
 		return nil, fmt.Errorf("failed to create GitHub validation request: %w", err)
diff --git a/pkg/auth/token.go b/pkg/auth/token.go
@@ -115,6 +115,7 @@ func (g *GoogleProvider) IntrospectToken(ctx context.Context, token string) (jwt
 	u.RawQuery = query.Encode()
 
 	// Create the GET request
+	//nolint:gosec // G704 - URL from trusted OIDC discovery config
 	req, err := http.NewRequestWithContext(ctx, "GET", u.String(), nil)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create Google tokeninfo request: %w", err)
@@ -290,6 +291,7 @@ func (r *RFC7662Provider) IntrospectToken(ctx context.Context, token string) (jw
 	formData.Set("token_type_hint", "access_token")
 
 	// Create POST request with form data
+	//nolint:gosec // G704 - URL is configured introspection endpoint
 	req, err := http.NewRequestWithContext(ctx, "POST", r.url, strings.NewReader(formData.Encode()))
 	if err != nil {
 		return nil, fmt.Errorf("failed to create introspection request: %w", err)
diff --git a/pkg/authserver/server/handlers/callback.go b/pkg/authserver/server/handlers/callback.go
@@ -209,7 +209,7 @@ func (h *Handler) writeAuthorizationResponse(
 			authorizeRequest.RequestedScope = append(authorizeRequest.RequestedScope, scope)
 			authorizeRequest.GrantedScope = append(authorizeRequest.GrantedScope, scope)
 		} else {
-			slog.Warn("filtered unregistered scope from authorization",
+			slog.Warn("filtered unregistered scope from authorization", //nolint:gosec // G706 - scope from server-side storage
 				"scope", scope,
 				"client_id", pending.ClientID,
 			)
@@ -242,7 +242,7 @@ func (h *Handler) buildAuthorizeRequesterFromPending(
 	// so failure indicates storage corruption
 	redirectURI, err := url.Parse(pending.RedirectURI)
 	if err != nil {
-		slog.Error("stored redirect URI is invalid",
+		slog.Error("stored redirect URI is invalid", //nolint:gosec // G706 - redirect URI from server-side storage
 			"redirect_uri", pending.RedirectURI,
 			"error", err,
 		)
diff --git a/pkg/authserver/storage/redis.go b/pkg/authserver/storage/redis.go
@@ -240,7 +240,7 @@ func (s *RedisStorage) RegisterClient(ctx context.Context, client fosite.Client)
 		Public:        client.IsPublic(),
 	}
 
-	data, err := json.Marshal(stored)
+	data, err := json.Marshal(stored) //nolint:gosec // G117 - internal Redis storage serialization, not exposed to users
 	if err != nil {
 		return fmt.Errorf("failed to marshal client: %w", err)
 	}
@@ -760,7 +760,7 @@ func marshalUpstreamTokensWithTTL(tokens *UpstreamTokens) ([]byte, time.Duration
 		ClientID:        tokens.ClientID,
 	}
 
-	data, err := json.Marshal(stored)
+	data, err := json.Marshal(stored) //nolint:gosec // G117 - internal Redis storage serialization, not exposed to users
 	if err != nil {
 		return nil, 0, fmt.Errorf("failed to marshal upstream tokens: %w", err)
 	}
@@ -932,7 +932,7 @@ func (s *RedisStorage) StorePendingAuthorization(ctx context.Context, state stri
 		CreatedAt:            pending.CreatedAt.Unix(),
 	}
 
-	data, err := json.Marshal(stored)
+	data, err := json.Marshal(stored) //nolint:gosec // G117 - internal Redis storage serialization, not exposed to users
 	if err != nil {
 		return fmt.Errorf("failed to marshal pending authorization: %w", err)
 	}
@@ -1021,7 +1021,7 @@ func (s *RedisStorage) CreateUser(ctx context.Context, user *User) error {
 		UpdatedAt: user.UpdatedAt.Unix(),
 	}
 
-	data, err := json.Marshal(stored)
+	data, err := json.Marshal(stored) //nolint:gosec // G117 - internal Redis storage serialization, not exposed to users
 	if err != nil {
 		return fmt.Errorf("failed to marshal user: %w", err)
 	}
@@ -1153,7 +1153,7 @@ func (s *RedisStorage) CreateProviderIdentity(ctx context.Context, identity *Pro
 		LastUsedAt:      identity.LastUsedAt.Unix(),
 	}
 
-	data, err := json.Marshal(stored)
+	data, err := json.Marshal(stored) //nolint:gosec // G117 - internal Redis storage serialization, not exposed to users
 	if err != nil {
 		return fmt.Errorf("failed to marshal identity: %w", err)
 	}
diff --git a/pkg/authz/response_filter.go b/pkg/authz/response_filter.go
@@ -61,14 +61,14 @@ func (rfw *ResponseFilteringWriter) FlushAndFilter() error {
 	// If it's not a successful response, just pass it through
 	if rfw.statusCode != http.StatusOK && rfw.statusCode != http.StatusAccepted {
 		rfw.ResponseWriter.WriteHeader(rfw.statusCode)
-		_, err := rfw.ResponseWriter.Write(rfw.buffer.Bytes())
+		_, err := rfw.ResponseWriter.Write(rfw.buffer.Bytes()) //nolint:gosec // G705 - JSON-RPC response, not rendered as HTML
 		return err
 	}
 
 	// Check if this is a list operation that needs filtering
 	if !isListOperation(rfw.method) {
 		rfw.ResponseWriter.WriteHeader(rfw.statusCode)
-		_, err := rfw.ResponseWriter.Write(rfw.buffer.Bytes())
+		_, err := rfw.ResponseWriter.Write(rfw.buffer.Bytes()) //nolint:gosec // G705 - JSON-RPC response, not rendered as HTML
 		return err
 	}
 
@@ -77,7 +77,7 @@ func (rfw *ResponseFilteringWriter) FlushAndFilter() error {
 	// Skip filtering for empty responses (common in SSE scenarios where actual data comes via SSE stream)
 	if len(rawResponse) == 0 {
 		rfw.ResponseWriter.WriteHeader(rfw.statusCode)
-		_, err := rfw.ResponseWriter.Write(rawResponse)
+		_, err := rfw.ResponseWriter.Write(rawResponse) //nolint:gosec // G705 - JSON-RPC response, not rendered as HTML
 		return err
 	}
 
diff --git a/pkg/container/images/registry.go b/pkg/container/images/registry.go
@@ -247,7 +247,7 @@ func createTarFromDir(srcDir string, writer io.Writer) error {
 		// If it's a regular file, write the contents
 		if !info.IsDir() {
 			// #nosec G304 - This is safe because we're only opening files within the specified context directory
-			file, err := os.Open(path)
+			file, err := os.Open(path) //nolint:gosec // G122 - path from filepath.Walk within validated source directory
 			if err != nil {
 				return fmt.Errorf("failed to open file: %w", err)
 			}
diff --git a/pkg/transport/stdio.go b/pkg/transport/stdio.go
@@ -220,7 +220,7 @@ func (t *StdioTransport) Start(ctx context.Context) error {
 	}
 
 	// Start a goroutine to handle container exit
-	go t.handleContainerExit(ctx)
+	go t.handleContainerExit(ctx) //nolint:gosec // G118 - background goroutine manages container lifecycle, outlives request
 
 	return nil
 }
diff --git a/pkg/updates/checker.go b/pkg/updates/checker.go
@@ -211,6 +211,7 @@ func (d *defaultUpdateChecker) CheckLatestVersion() error {
 	}
 	defer lockfile.ReleaseTrackedLock(lockPath, lockFile)
 
+	//nolint:gosec // G703 - path from trusted app config directory
 	if err := os.WriteFile(d.updateFilePath, updatedData, 0600); err != nil {
 		return fmt.Errorf("failed to write updated file: %w", err)
 	}
diff --git a/pkg/vmcp/health/monitor.go b/pkg/vmcp/health/monitor.go
@@ -241,7 +241,7 @@ func (m *Monitor) Start(ctx context.Context) error {
 	for i := range m.backends {
 		backend := &m.backends[i] // Capture backend pointer for this iteration
 
-		backendCtx, cancel := context.WithCancel(m.ctx)
+		backendCtx, cancel := context.WithCancel(m.ctx) //nolint:gosec // G118 - cancel stored in m.activeChecks, called during Stop
 		m.activeChecks[backend.ID] = cancel
 		m.wg.Add(1)
 		m.initialCheckWg.Add(1)                        // Track initial health check
@@ -331,7 +331,7 @@ func (m *Monitor) UpdateBackends(newBackends []vmcp.Backend) {
 
 			// Circuit breaker will be lazily initialized on first health check
 
-			backendCtx, cancel := context.WithCancel(m.ctx)
+			backendCtx, cancel := context.WithCancel(m.ctx) //nolint:gosec // G118 - cancel stored in m.activeChecks, called during Stop
 			m.activeChecks[id] = cancel
 			m.wg.Add(1)
 			// Clear the "removed" flag if this backend was previously removed
diff --git a/pkg/workloads/statuses/file_status.go b/pkg/workloads/statuses/file_status.go
@@ -658,6 +658,7 @@ func (f *fileStatusManager) readStatusFile(statusFilePath string) (*workloadStat
 	if recoveryErr != nil {
 		// Recovery failed - back up the corrupted file
 		backupPath := statusFilePath + ".corrupted"
+		//nolint:gosec // G703 - path derived from trusted status file with fixed suffix
 		if backupErr := os.WriteFile(backupPath, data, 0o600); backupErr == nil {
 			slog.Warn("backed up corrupted status file", "path", backupPath)
 		}
diff --git a/test/e2e/oidc_mock.go b/test/e2e/oidc_mock.go
@@ -258,7 +258,7 @@ func (m *OIDCMockServer) handleToken(w http.ResponseWriter, r *http.Request) {
 	ctx := context.Background()
 
 	// Check for test auth code from auto-complete flow
-	if r.FormValue("code") == "test-auth-code" {
+	if r.FormValue("code") == "test-auth-code" { //nolint:gosec // G120 - test-only mock server
 		// Return a test token directly for auto-complete flow
 		tokenResponse := map[string]interface{}{
 			"access_token": "test-access-token",

Original file line number	Diff line number	Diff line change
`@@ -240,7 +240,7 @@ func (s *RedisStorage) RegisterClient(ctx context.Context, client fosite.Client)`
`240`	`240`	`Public: client.IsPublic(),`
`241`	`241`	`}`
`242`	`242`
`243`		`- data, err := json.Marshal(stored)`
	`243`	`+ data, err := json.Marshal(stored) //nolint:gosec // G117 - internal Redis storage serialization, not exposed to users`
`244`	`244`	`if err != nil {`
`245`	`245`	`return fmt.Errorf("failed to marshal client: %w", err)`
`246`	`246`	`}`
`@@ -760,7 +760,7 @@ func marshalUpstreamTokensWithTTL(tokens *UpstreamTokens) ([]byte, time.Duration`
`760`	`760`	`ClientID: tokens.ClientID,`
`761`	`761`	`}`
`762`	`762`
`763`		`- data, err := json.Marshal(stored)`
	`763`	`+ data, err := json.Marshal(stored) //nolint:gosec // G117 - internal Redis storage serialization, not exposed to users`
`764`	`764`	`if err != nil {`
`765`	`765`	`return nil, 0, fmt.Errorf("failed to marshal upstream tokens: %w", err)`
`766`	`766`	`}`
`@@ -932,7 +932,7 @@ func (s *RedisStorage) StorePendingAuthorization(ctx context.Context, state stri`
`932`	`932`	`CreatedAt: pending.CreatedAt.Unix(),`
`933`	`933`	`}`
`934`	`934`
`935`		`- data, err := json.Marshal(stored)`
	`935`	`+ data, err := json.Marshal(stored) //nolint:gosec // G117 - internal Redis storage serialization, not exposed to users`
`936`	`936`	`if err != nil {`
`937`	`937`	`return fmt.Errorf("failed to marshal pending authorization: %w", err)`
`938`	`938`	`}`
`@@ -1021,7 +1021,7 @@ func (s RedisStorage) CreateUser(ctx context.Context, user User) error {`
`1021`	`1021`	`UpdatedAt: user.UpdatedAt.Unix(),`
`1022`	`1022`	`}`
`1023`	`1023`
`1024`		`- data, err := json.Marshal(stored)`
	`1024`	`+ data, err := json.Marshal(stored) //nolint:gosec // G117 - internal Redis storage serialization, not exposed to users`
`1025`	`1025`	`if err != nil {`
`1026`	`1026`	`return fmt.Errorf("failed to marshal user: %w", err)`
`1027`	`1027`	`}`
`@@ -1153,7 +1153,7 @@ func (s RedisStorage) CreateProviderIdentity(ctx context.Context, identity Pro`
`1153`	`1153`	`LastUsedAt: identity.LastUsedAt.Unix(),`
`1154`	`1154`	`}`
`1155`	`1155`
`1156`		`- data, err := json.Marshal(stored)`
	`1156`	`+ data, err := json.Marshal(stored) //nolint:gosec // G117 - internal Redis storage serialization, not exposed to users`
`1157`	`1157`	`if err != nil {`
`1158`	`1158`	`return fmt.Errorf("failed to marshal identity: %w", err)`
`1159`	`1159`	`}`
Original file line number	Diff line number	Diff line change
`@@ -247,7 +247,7 @@ func createTarFromDir(srcDir string, writer io.Writer) error {`
`247`	`247`	`// If it's a regular file, write the contents`
`248`	`248`	`if !info.IsDir() {`
`249`	`249`	`// #nosec G304 - This is safe because we're only opening files within the specified context directory`
`250`		`- file, err := os.Open(path)`
	`250`	`+ file, err := os.Open(path) //nolint:gosec // G122 - path from filepath.Walk within validated source directory`
`251`	`251`	`if err != nil {`
`252`	`252`	`return fmt.Errorf("failed to open file: %w", err)`
`253`	`253`	`}`
Original file line number	Diff line number	Diff line change
`@@ -220,7 +220,7 @@ func (t *StdioTransport) Start(ctx context.Context) error {`
`220`	`220`	`}`
`221`	`221`
`222`	`222`	`// Start a goroutine to handle container exit`
`223`		`- go t.handleContainerExit(ctx)`
	`223`	`+ go t.handleContainerExit(ctx) //nolint:gosec // G118 - background goroutine manages container lifecycle, outlives request`
`224`	`224`
`225`	`225`	`return nil`
`226`	`226`	`}`
Original file line number	Diff line number	Diff line change
`@@ -211,6 +211,7 @@ func (d *defaultUpdateChecker) CheckLatestVersion() error {`
`211`	`211`	`}`
`212`	`212`	`defer lockfile.ReleaseTrackedLock(lockPath, lockFile)`
`213`	`213`
	`214`	`+ //nolint:gosec // G703 - path from trusted app config directory`
`214`	`215`	`if err := os.WriteFile(d.updateFilePath, updatedData, 0600); err != nil {`
`215`	`216`	`return fmt.Errorf("failed to write updated file: %w", err)`
`216`	`217`	`}`