fix: address preflight lint findings (gosec, goconst, stale nolint) (#99)

Co-authored-by: Jon Gallant <[email protected]>
Co-authored-by: Copilot <[email protected]>

Author: 3 people

env/loader.go

@@ -21,7 +21,7 @@ type DefaultCommandRunner struct{}
 
 // Run executes a command and returns its output.
 func (r *DefaultCommandRunner) Run(ctx context.Context, name string, args ...string) ([]byte, error) {
-	cmd := exec.CommandContext(ctx, name, args...)
+	cmd := exec.CommandContext(ctx, name, args...) // #nosec G204 -- Command name is caller-controlled, not user input
 	return cmd.Output()
 }
 

fileutil/fileutil.go

@@ -155,7 +155,7 @@ func AtomicWriteFile(path string, data []byte, perm os.FileMode) error {
 // ReadJSON reads JSON from a file into the target interface.
 // Returns nil error if file doesn't exist (target unchanged).
 func ReadJSON(path string, target any) error {
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) // #nosec G304 -- Path provided by internal callers, not direct user input
 	if err != nil {
 		if errors.Is(err, fs.ErrNotExist) {
 			return nil // File doesn't exist, not an error
@@ -322,7 +322,7 @@ func (m CacheMetadata) IsCacheValid(opts CacheOptions) bool {
 //	    // Rebuild cache
 //	}
 func LoadCacheJSON(path string, target any, opts CacheOptions) (valid bool, err error) {
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) // #nosec G304 -- Cache path constructed internally, not from user input
 	if err != nil {
 		if errors.Is(err, fs.ErrNotExist) {
 			return false, nil // Cache doesn't exist, not an error

healthcheck/checker.go

@@ -435,7 +435,7 @@ func (c *HealthChecker) tryCustomHealthCheck(ctx context.Context, config *Health
 // performHTTPCheck performs a direct HTTP health check to a specific URL.
 func (c *HealthChecker) performHTTPCheck(ctx context.Context, urlStr string) *httpHealthCheckResult {
 	startTime := time.Now()
-	req, err := http.NewRequestWithContext(ctx, "GET", urlStr, nil)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, urlStr, nil)
 	if err != nil {
 		return &httpHealthCheckResult{
 			Endpoint: urlStr,
@@ -497,7 +497,7 @@ func (c *HealthChecker) performCommandCheck(ctx context.Context, args []string,
 		ResponseTime: 0,
 	}
 
-	cmd := exec.CommandContext(ctx, args[0], args[1:]...)
+	cmd := exec.CommandContext(ctx, args[0], args[1:]...) // #nosec G204 -- Args from Docker HEALTHCHECK config, not user input
 	err := cmd.Run()
 	result.ResponseTime = time.Since(startTime)
 
@@ -521,9 +521,9 @@ func (c *HealthChecker) performShellCheck(ctx context.Context, command string, s
 
 	var cmd *exec.Cmd
 	if runtime.GOOS == "windows" {
-		cmd = exec.CommandContext(ctx, "cmd", "/C", command)
+		cmd = exec.CommandContext(ctx, "cmd", "/C", command) // #nosec G204 -- Command from Docker HEALTHCHECK CMD-SHELL config
 	} else {
-		cmd = exec.CommandContext(ctx, "sh", "-c", command)
+		cmd = exec.CommandContext(ctx, "sh", "-c", command) // #nosec G204 -- Command from Docker HEALTHCHECK CMD-SHELL config
 	}
 
 	err := cmd.Run()
@@ -607,7 +607,7 @@ func (c *HealthChecker) checkSingleEndpoint(ctx context.Context, port int, endpo
 	url := fmt.Sprintf("http://localhost:%d%s", port, endpoint)
 
 	startTime := time.Now()
-	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {
 		return nil
 	}

httpclient/client.go

@@ -201,7 +201,8 @@ func (c *Client) Execute(ctx context.Context, opts RequestOptions) (*Response, e
 	for attempt := 0; attempt <= maxRetries; attempt++ {
 		if attempt > 0 {
 			// Exponential backoff: 1s, 2s, 4s, etc.
-			backoff := time.Duration(1<<uint(attempt-1)) * time.Second //nolint:gosec // G115: safe conversion, attempt count is small
+			shift := min(attempt-1, 30) // cap to prevent overflow
+backoff := time.Duration(1<<uint(shift)) * time.Second
 			select {
 			case <-ctx.Done():
 				return nil, fmt.Errorf("request canceled: %w", ctx.Err())

httpclient/formatter.go

@@ -19,6 +19,7 @@ const (
 	FormatJSON    OutputFormat = "json"
 	FormatRaw     OutputFormat = "raw"
 	redactedValue              = "***REDACTED***"
+	bearerPrefix               = "Bearer "
 )
 
 // Formatter handles response formatting and output
@@ -131,12 +132,12 @@ func RedactSensitiveHeader(key, value string) string {
 
 	if keyLower == "authorization" {
 		if strings.HasPrefix(strings.ToLower(value), "bearer ") {
-			token := strings.TrimPrefix(value, "Bearer ")
+			token := strings.TrimPrefix(value, bearerPrefix)
 			token = strings.TrimPrefix(token, "bearer ")
 			if len(token) > 12 {
-				return "Bearer " + token[:6] + "..." + token[len(token)-6:]
+				return bearerPrefix + token[:6] + "..." + token[len(token)-6:]
 			}
-			return "Bearer " + redactedValue
+			return bearerPrefix + redactedValue
 		}
 		return redactedValue
 	}