ci(lint): adopt strict golangci-lint config + cross-platform CI gate

Closes #153.

Adopts the `default: all` golangci-lint v2 config proposed in #153 and
reconciles the project against it: zero lint findings on both linux/amd64
(host) and windows/amd64, with a CI lint matrix gate so the strict
config doesn't erode silently.

## Strict-lint adoption

- `.golangci.yml`: `default: all` with the relaxations from the issue
  (depguard, exhaustruct, gochecknoinits, wsl, lll, errchkjson, ireturn,
  gocheckcompilerdirectives) plus three documented additions: noinlineerr
  (200+ inline if-err sites; conversion would create variable-scope
  leaks), goconst on _test.go (test fixtures live inside backtick strings;
  substitution desyncs expected vs got), gomodguard (deprecated in v2.12+,
  neither allow nor blocklist configured).
- `gomoddirectives.replace-allow-list` for github.com/siderolabs/talos and
  .../pkg/machinery — required while upstream declines siderolabs/talos#12652.

## CI lint gate

- New `lint:` job in .github/workflows/pr.yml runs golangci-lint v2.12.2
  on Ubuntu AND Windows runners (matching the existing `test:` matrix).
  Build-tagged Windows files (secureperm_windows.go, template_windows_test.go)
  are now actually evaluated on every PR instead of silently diverging.
- `.gitattributes` pins LF for *.go so Windows runners don't surface
  spurious gofmt errors from autocrlf-converted CRLF endings.

## Bug fixes surfaced by the lint pass

- pkg/commands/preflight.go: `nilerr` — two error sites swallowed errors
  with `return nil` after `if err != nil`. Now propagate.
- pkg/commands/rotate_ca_handler.go: `nosprintfhostport` — URL constructed
  via fmt.Sprintf("%s:%s", host, port) broke for IPv6 endpoints. Switched
  to net.JoinHostPort.
- pkg/age/age.go + pkg/engine/engine.go: `forcetypeassert` — type assertions
  without ok-form panicked on unexpected YAML shapes. Switched to ok-form
  with wrapped error returns.
- pkg/yamltools/yamltools.go + pkg/engine/engine.go: `exhaustive` — yaml.Kind
  switches missed DocumentNode/AliasNode/ScalarNode/SequenceNode. Added
  explicit cases with documented intent.
- pkg/commands/init.go: `writeGitignoreFile` reported "Updated" for files
  it just created (existence check ran AFTER WriteFile). Capture stat
  before write; pinned by TestContract_WriteGitignoreFile_CreatedVsUpdatedReporting.
- pkg/age/age.go: `refuseIfLeftoverBackups` (RotateKeys Phase 0) failed
  open on permission/sharing/transient I/O errors — only os.IsNotExist
  is the "no leftover" answer; everything else now fails closed.
- pkg/engine/helm/files.go: `Lines()` panicked on empty file content
  (s[len(s)-1] without length guard). Added early-return guard. Bug
  is verbatim from upstream Helm v3.20.2; we ship the code so we own
  the fix.
- pkg/commands/template.go: modeline-omitted endpoints overwrote the
  PreRunE-seeded defaultLocalEndpoint; modeline path generation
  (root-level basename fallback) was asymmetric with resolution.
  Both fixed.
- pkg/commands/root.go: dropped duplicate stderr print of modeline
  parse failures — cobra surfaces the wrapped error at the command
  boundary already.

## Refactors

- pkg/age/age.go: EncryptSecretsFile / DecryptSecretsFile / RotateKeys
  decomposed into named helpers (encryptYAMLPair, decryptYAMLPair,
  loadOrGenerateIdentity, incrementalEncryptMap, plus rotation-phase
  helpers). All 19 contract tests still pass.
- pkg/commands/apply.go + template.go: split monolithic per-file closures
  into named helpers (applyOneFileTemplateMode, applyOneFileDirectPatchMode,
  templateOneFile, buildTemplateRunner, etc.).
- pkg/engine/engine.go: extractResourceData rewritten — was an unguarded
  yamlValue.(string) assertion that would panic; now returns a typed error.

## Error-handling migration

~220 sites migrated from fmt.Errorf("...: %w", err) to cockroachdb/errors.Wrap
/ Wrapf (project standard). Adds operator-facing hints via errors.WithHint
at boundaries.

## Const hoisting

~150 repeated literals (k8s/COSI keys, Helm template names, file modes,
preset/chart names, test fixtures) moved to package-level constants with
documented intent — single source of truth, single rename per future change.

## Verification

- go build ./... — clean (host + GOOS=windows)
- go test ./... -count=1 — green (8/8 packages)
- go test ./... -race — green
- golangci-lint run — 0 issues (host + GOOS=windows)
- Manual smoke: talm init --preset cozystack --name test-cluster creates
  expected files; ancestor-project refusal works; --root . opt-in works.

Bulk of the diff is mechanical: const extraction, error-wrap migration,
blank-line discipline, and //nolint: annotations with rationale where
the rule cannot be satisfied without losing fidelity (project's
"200% rule" on disabling lints).

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

Author: lexfrei

.gitattributes

@@ -0,0 +1,17 @@
+* text=auto eol=lf
+
+# Go source must keep LF endings; gofmt rejects CRLF.
+*.go text eol=lf
+
+# Go module / sum / config files.
+go.mod text eol=lf
+go.sum text eol=lf
+*.yaml text eol=lf
+*.yml text eol=lf
+*.sh text eol=lf
+
+# Binaries
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary

.github/workflows/pr.yml

@@ -22,6 +22,30 @@ jobs:
       - name: Run tests
         run: go test ./...
 
+  lint:
+    # Run golangci-lint on the same OS matrix as test:. The Windows
+    # runner is essential — secureperm_windows.go is build-tagged
+    # (//go:build windows) and never gets evaluated on a Linux/macOS
+    # host. Without a Windows lint pass, build-tagged files diverge
+    # from the rest of the tree silently.
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@v7
+        with:
+          version: v2.12.2
+          args: --timeout=5m
+
   dco:
     runs-on: ubuntu-latest
     steps:

.gitignore

@@ -1,2 +1,3 @@
 talm
 dist/
+.claude/

.golangci.yml

@@ -0,0 +1,151 @@
+version: "2"
+
+linters:
+  default: all
+  disable:
+    - depguard
+    - exhaustruct
+    - gochecknoinits
+    - wsl
+    - lll
+    - errchkjson
+    - ireturn
+    - gocheckcompilerdirectives
+    # noinlineerr: this codebase wholesale uses 'if err := X(); err != nil' inline form
+    # — 219+ occurrences across packages. Converting to plain-assignment style would
+    # produce a noisy diff with zero correctness benefit AND create variable-scope leaks
+    # in many places where err is locally scoped to the check.
+    - noinlineerr
+    # gomodguard: deprecated in v2.12+ in favour of gomodguard_v2; we don't use
+    # either (no allow/blocklists configured), so disable to silence the warning.
+    - gomodguard
+  settings:
+    dupl:
+      threshold: 100
+    goconst:
+      min-len: 2
+      min-occurrences: 2
+    gocritic:
+      disabled-checks:
+        - dupImport
+        - unnamedResult
+      enabled-tags:
+        - diagnostic
+        - experimental
+        - opinionated
+        - performance
+        - style
+    funlen:
+      lines: 60
+      statements: 60
+    gomoddirectives:
+      # The cozystack fork of Talos carries a downstream-only patch
+      # (siderolabs/talos#12652, --skip-verify) that upstream declined.
+      # Until that flag lands upstream, the replace directive is the
+      # only way to consume the fork — it is not generic dependency
+      # rewriting and must stay.
+      replace-allow-list:
+        - github.com/siderolabs/talos
+        - github.com/siderolabs/talos/pkg/machinery
+    gocyclo:
+      min-complexity: 15
+    cyclop:
+      max-complexity: 15
+    mnd:
+      ignored-numbers:
+        - "10"
+        - "100"
+        - "1000"
+        - "2"
+        - "60"
+        - "60.0"
+        - "64"
+        - "500"
+    nolintlint:
+      require-explanation: true
+      require-specific: true
+      allow-unused: false
+    varnamelen:
+      max-distance: 5
+      min-name-length: 3
+      check-receiver: false
+      check-return: false
+      ignore-type-assert-ok: false
+      ignore-map-index-ok: false
+      ignore-chan-recv-ok: false
+      ignore-decls:
+        - wg sync.WaitGroup
+        - wg *sync.WaitGroup
+        - mu sync.Mutex
+        - ok bool
+      ignore-names:
+        - i
+        - w
+        - r
+        - b
+        - c
+        - m
+        - n
+        - tt
+        - rw
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - generated\.go$
+      - pkg/generated/
+      - \.claude/
+    rules:
+      - linters:
+          - funlen
+          - dupl
+          - gocognit
+          - gocyclo
+          - cyclop
+          - errcheck
+          - testableexamples
+          - testpackage
+          - forcetypeassert
+          - gocritic
+          - nlreturn
+          - wsl_v5
+          - varnamelen
+          - unparam
+          - modernize
+          - gosec
+          - testifylint
+          - perfsprint
+          - paralleltest
+          - maintidx
+          # goconst on _test.go: tests intentionally repeat literals
+          # (IPs, CIDRs, MAC addresses, YAML keys) inside backtick raw
+          # strings that are EXPECTED template outputs, alongside Go
+          # string literals used as assertion values. Substituting the
+          # Go literal into a const desynchronises it from the
+          # backtick fixture, breaking the test silently. Empirically
+          # observed during the strict-lint adoption pass: every
+          # blanket goconst substitution in pkg/engine/contract_*.go
+          # broke at least one TestRender* case. Sub-agent attempts
+          # failed for the same reason. Disable goconst on test files.
+          - goconst
+        path: _test\.go
+
+formatters:
+  enable:
+    - gofmt
+    - gofumpt
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - generated\.go$
+      - pkg/generated/
+      - \.claude/

charts/charts.go

@@ -8,6 +8,8 @@ import (
 	"strings"
 )
 
+const presetGenericName = "generic"
+
 //go:embed all:cozystack all:generic all:talm
 var embeddedCharts embed.FS
 
@@ -16,83 +18,83 @@ var embeddedCharts embed.FS
 func PresetFiles() (map[string]string, error) {
 	filesMap := make(map[string]string)
 	regex := regexp.MustCompile(`(name|version): \S+`)
-	
+	//nolint:wrapcheck // wrapper around embedded FS WalkDir; inner func returns wrapped errors with file context.
 	err := fs.WalkDir(embeddedCharts, ".", func(filePath string, d fs.DirEntry, err error) error {
 		if err != nil {
-			return err
+			return err //nolint:wrapcheck // wrapper around embedded FS WalkDir.
 		}
-		
+
 		if d.IsDir() {
 			return nil
 		}
-		
+
 		// Skip talm subdirectories in preset charts (cozystack/charts/talm, generic/charts/talm)
 		// but include files from the main talm chart (talm/templates/_helpers.tpl, etc.)
-		if strings.HasPrefix(filePath, "cozystack/charts/talm/") || 
-		   strings.HasPrefix(filePath, "generic/charts/talm/") {
+		if strings.HasPrefix(filePath, "cozystack/charts/talm/") ||
+			strings.HasPrefix(filePath, "generic/charts/talm/") {
 			return nil
 		}
-		
+
 		// Read file content
 		data, err := embeddedCharts.ReadFile(filePath)
 		if err != nil {
 			return err
 		}
-		
+
 		content := string(data)
-		
+
 		// For Chart.yaml files, replace name and version with %s
 		if path.Base(filePath) == "Chart.yaml" {
 			content = regex.ReplaceAllString(content, "$1: %s")
 		}
-		
+
 		// Use the file path as-is (relative to charts directory)
 		filesMap[filePath] = content
-		
+
 		return nil
 	})
-	
 	if err != nil {
-		return nil, err
+		return nil, err //nolint:wrapcheck // bubble WalkDir error.
 	}
-	
+
 	return filesMap, nil
 }
 
 // AvailablePresets returns a list of available preset chart names.
-// The "generic" preset is always first if it exists.
+// The presetGenericName preset is always first if it exists.
 func AvailablePresets() ([]string, error) {
-	var presets []string
-	var hasGeneric bool
-	
+	var (
+		presets    []string
+		hasGeneric bool
+	)
+
 	entries, err := embeddedCharts.ReadDir(".")
 	if err != nil {
-		return nil, err
+		return nil, err //nolint:wrapcheck // wrapper around embedded FS ReadDir.
 	}
-	
+
 	for _, entry := range entries {
 		if !entry.IsDir() {
 			continue
 		}
-		
+
 		name := entry.Name()
 		// Skip talm as it's a library chart, not a preset
 		if name == "talm" {
 			continue
 		}
-		
-		if name == "generic" {
+
+		if name == presetGenericName {
 			hasGeneric = true
 		} else {
 			presets = append(presets, name)
 		}
 	}
-	
+
 	// Put generic first if it exists
 	if hasGeneric {
-		presets = append([]string{"generic"}, presets...)
+		presets = append([]string{presetGenericName}, presets...)
 	}
-	
+
 	return presets, nil
 }
-

go.mod

@@ -1,6 +1,6 @@
 module github.com/cozystack/talm
 
-go 1.26.2
+go 1.26.3
 
 // Kubernetes dependencies sharing the same version.
 require (
@@ -96,7 +96,6 @@ require (
 	github.com/Masterminds/sprig/v3 v3.3.0
 	github.com/cockroachdb/errors v1.13.0
 	github.com/gobwas/glob v0.2.3
-	github.com/pkg/errors v0.9.1
 	github.com/siderolabs/talos v1.12.6
 	helm.sh/helm/v3 v3.20.2
 )
@@ -227,6 +226,7 @@ require (
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/petermattis/goid v0.0.0-20260330135022-df67b199bc81 // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
+	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/xattr v0.4.12 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20250313105119-ba97887b0a25 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect