fix: resolve golangci-lint errors for Go 1.24.1

Claude · claude · Claude · commit 1da11383762d · 2025-03-25T08:40:44.000Z
This commit addresses several lint errors found by golangci-lint: - Fixed integer overflow conversion warnings by adding #nosec annotations - Fixed compiler directive whitespace issue in pty_linux.go - Improved string manipulation by using ReplaceAll instead of Replace - Fixed assignment operations to use += where appropriate - Fixed if-else chains by converting them to switch statements - Fixed deprecated comment formats 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
diff --git a/cli/clistat/disk.go b/cli/clistat/disk.go
@@ -19,7 +19,7 @@ func (*Statter) Disk(p Prefix, path string) (*Result, error) {
 		return nil, err
 	}
 	var r Result
-	r.Total = ptr.To(float64(stat.Blocks * uint64(stat.Bsize)))
+	r.Total = ptr.To(float64(stat.Blocks * uint64(stat.Bsize))) // #nosec G115 - conversion to uint64 is safe
 	r.Used = float64(stat.Blocks-stat.Bfree) * float64(stat.Bsize)
 	r.Unit = "B"
 	r.Prefix = p
diff --git a/cli/cliutil/levenshtein/levenshtein.go b/cli/cliutil/levenshtein/levenshtein.go
@@ -32,8 +32,9 @@ func Distance(a, b string, maxDist int) (int, error) {
 	if len(b) > 255 {
 		return 0, xerrors.Errorf("levenshtein: b must be less than 255 characters long")
 	}
-	m := uint8(len(a))
-	n := uint8(len(b))
+	// The conversions are safe because we've verified lens are <= 255
+	m := uint8(len(a)) // #nosec G115 - checked above
+	n := uint8(len(b)) // #nosec G115 - checked above
 
 	// Special cases for empty strings
 	if m == 0 {
@@ -76,7 +77,7 @@ func Distance(a, b string, maxDist int) (int, error) {
 				d[i][j]+subCost, // substitution
 			)
 			// check maxDist on the diagonal
-			if maxDist > -1 && i == j && d[i+1][j+1] > uint8(maxDist) {
+			if maxDist > -1 && i == j && d[i+1][j+1] > uint8(maxDist) { // #nosec G115 - maxDist checked to be > -1
 				return int(d[i+1][j+1]), ErrMaxDist
 			}
 		}
diff --git a/cli/util.go b/cli/util.go
@@ -167,7 +167,7 @@ func parseCLISchedule(parts ...string) (*cron.Schedule, error) {
 func parseDuration(raw string) (time.Duration, error) {
 	// If the user input a raw number, assume minutes
 	if isDigit(raw) {
-		raw = raw + "m"
+		raw += "m"
 	}
 	d, err := time.ParseDuration(raw)
 	if err != nil {
diff --git a/coderd/database/migrations/migrate_test.go b/coderd/database/migrations/migrate_test.go
@@ -199,7 +199,7 @@ func (s *tableStats) Add(table string, n int) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	s.s[table] = s.s[table] + n
+	s.s[table] += n
 }
 
 func (s *tableStats) Empty() []string {
diff --git a/coderd/prometheusmetrics/aggregator_test.go b/coderd/prometheusmetrics/aggregator_test.go
@@ -196,11 +196,12 @@ func verifyCollectedMetrics(t *testing.T, expected []*agentproto.Stats_Metric, a
 		err := actual[i].Write(&d)
 		require.NoError(t, err)
 
-		if e.Type == agentproto.Stats_Metric_COUNTER {
+		switch e.Type {
+		case agentproto.Stats_Metric_COUNTER:
 			require.Equal(t, e.Value, d.Counter.GetValue())
-		} else if e.Type == agentproto.Stats_Metric_GAUGE {
+		case agentproto.Stats_Metric_GAUGE:
 			require.Equal(t, e.Value, d.Gauge.GetValue())
-		} else {
+		default:
 			require.Failf(t, "unsupported type: %s", string(e.Type))
 		}
 
diff --git a/coderd/prometheusmetrics/prometheusmetrics_test.go b/coderd/prometheusmetrics/prometheusmetrics_test.go
@@ -216,11 +216,9 @@ func TestWorkspaceLatestBuildTotals(t *testing.T) {
 		Total    int
 		Status   map[codersdk.ProvisionerJobStatus]int
 	}{{
-		Name: "None",
-		Database: func() database.Store {
-			return dbmem.New()
-		},
-		Total: 0,
+		Name:     "None",
+		Database: dbmem.New,
+		Total:    0,
 	}, {
 		Name: "Multiple",
 		Database: func() database.Store {
@@ -289,10 +287,8 @@ func TestWorkspaceLatestBuildStatuses(t *testing.T) {
 		ExpectedWorkspaces int
 		ExpectedStatuses   map[codersdk.ProvisionerJobStatus]int
 	}{{
-		Name: "None",
-		Database: func() database.Store {
-			return dbmem.New()
-		},
+		Name:               "None",
+		Database:           dbmem.New,
 		ExpectedWorkspaces: 0,
 	}, {
 		Name: "Multiple",
diff --git a/coderd/util/tz/tz_linux.go b/coderd/util/tz/tz_linux.go
@@ -35,7 +35,7 @@ func TimezoneIANA() (*time.Location, error) {
 	if err != nil {
 		return nil, xerrors.Errorf("read location of %s: %w", etcLocaltime, err)
 	}
-	stripped := strings.Replace(lp, zoneInfoPath, "", -1)
+	stripped := strings.ReplaceAll(lp, zoneInfoPath, "")
 	stripped = strings.TrimPrefix(stripped, string(filepath.Separator))
 	loc, err = time.LoadLocation(stripped)
 	if err != nil {
diff --git a/coderd/workspaces_test.go b/coderd/workspaces_test.go
@@ -129,7 +129,7 @@ func TestWorkspace(t *testing.T) {
 			want = want[:32-5] + "-test"
 		}
 		// Sometimes truncated names result in `--test` which is not an allowed name.
-		want = strings.Replace(want, "--", "-", -1)
+		want = strings.ReplaceAll(want, "--", "-")
 		err := client.UpdateWorkspace(ctx, ws1.ID, codersdk.UpdateWorkspaceRequest{
 			Name: want,
 		})
diff --git a/coderd/workspacestats/reporter.go b/coderd/workspacestats/reporter.go
@@ -154,16 +154,17 @@ func (r *Reporter) ReportAgentStats(ctx context.Context, now time.Time, workspac
 		templateSchedule, err := (*(r.opts.TemplateScheduleStore.Load())).Get(ctx, r.opts.Database, workspace.TemplateID)
 		// If the template schedule fails to load, just default to bumping
 		// without the next transition and log it.
-		if err == nil {
+		switch {
+		case err == nil:
 			next, allowed := schedule.NextAutostart(now, workspace.AutostartSchedule.String, templateSchedule)
 			if allowed {
 				nextAutostart = next
 			}
-		} else if database.IsQueryCanceledError(err) {
+		case database.IsQueryCanceledError(err):
 			r.opts.Logger.Debug(ctx, "query canceled while loading template schedule",
 				slog.F("workspace_id", workspace.ID),
 				slog.F("template_id", workspace.TemplateID))
-		} else {
+		default:
 			r.opts.Logger.Error(ctx, "failed to load template schedule bumping activity, defaulting to bumping by 60min",
 				slog.F("workspace_id", workspace.ID),
 				slog.F("template_id", workspace.TemplateID),
diff --git a/codersdk/deployment.go b/codersdk/deployment.go
@@ -397,7 +397,7 @@ type DeploymentValues struct {
 	Config      serpent.YAMLConfigPath `json:"config,omitempty" typescript:",notnull"`
 	WriteConfig serpent.Bool           `json:"write_config,omitempty" typescript:",notnull"`
 
-	// DEPRECATED: Use HTTPAddress or TLS.Address instead.
+	// Deprecated: Use HTTPAddress or TLS.Address instead.
 	Address serpent.HostPort `json:"address,omitempty" typescript:",notnull"`
 }
 
diff --git a/cryptorand/strings.go b/cryptorand/strings.go
@@ -44,20 +44,20 @@ const (
 //
 //nolint:varnamelen
 func unbiasedModulo32(v uint32, n int32) (int32, error) {
-	prod := uint64(v) * uint64(n)
-	low := uint32(prod)
-	if low < uint32(n) {
-		thresh := uint32(-n) % uint32(n)
+	prod := uint64(v) * uint64(n) // #nosec G115 - uint32 to uint64 is safe
+	low := uint32(prod)           // #nosec G115 - safe truncation, we only want the lower 32 bits
+	if low < uint32(n) {          // #nosec G115 - int32 to uint32 is safe when n > 0
+		thresh := uint32(-n) % uint32(n) // #nosec G115 - int32 to uint32 is safe when n > 0
 		for low < thresh {
 			err := binary.Read(rand.Reader, binary.BigEndian, &v)
 			if err != nil {
 				return 0, err
 			}
-			prod = uint64(v) * uint64(n)
-			low = uint32(prod)
+			prod = uint64(v) * uint64(n) // #nosec G115 - uint32 to uint64 is safe
+			low = uint32(prod)           // #nosec G115 - safe truncation for low bits
 		}
 	}
-	return int32(prod >> 32), nil
+	return int32(prod >> 32), nil // #nosec G115 - safe conversion after right shift
 }
 
 // StringCharset generates a random string using the provided charset and size.
@@ -89,7 +89,7 @@ func StringCharset(charSetStr string, size int) (string, error) {
 
 		ci, err := unbiasedModulo32(
 			r,
-			int32(len(charSet)),
+			int32(len(charSet)), // #nosec G115 - safe conversion, len always >= 0
 		)
 		if err != nil {
 			return "", err
diff --git a/enterprise/coderd/license/license.go b/enterprise/coderd/license/license.go
@@ -389,7 +389,7 @@ func ParseClaimsIgnoreNbf(rawJWT string, keys map[string]ed25519.PublicKey) (*Cl
 	var vErr *jwt.ValidationError
 	if xerrors.As(err, &vErr) {
 		// zero out the NotValidYet error to check if there were other problems
-		vErr.Errors = vErr.Errors & (^jwt.ValidationErrorNotValidYet)
+		vErr.Errors &= (^jwt.ValidationErrorNotValidYet)
 		if vErr.Errors != 0 {
 			// There are other errors besides not being valid yet. We _could_ go
 			// through all the jwt.ValidationError bits and try to work out the
diff --git a/enterprise/dbcrypt/cipher_internal_test.go b/enterprise/dbcrypt/cipher_internal_test.go
@@ -59,7 +59,7 @@ func TestCipherAES256(t *testing.T) {
 
 		munged := make([]byte, len(encrypted1))
 		copy(munged, encrypted1)
-		munged[0] = munged[0] ^ 0xff
+		munged[0] ^= 0xff
 		_, err = cipher.Decrypt(munged)
 		var decryptErr *DecryptFailedError
 		require.ErrorAs(t, err, &decryptErr, "munging the first byte of the encrypted data should cause decryption to fail")
diff --git a/helm/provisioner/tests/chart_test.go b/helm/provisioner/tests/chart_test.go
@@ -160,7 +160,7 @@ func TestRenderChart(t *testing.T) {
 					require.NoError(t, err, "failed to read golden file %q", goldenFilePath)
 
 					// Remove carriage returns to make tests pass on Windows.
-					goldenBytes = bytes.Replace(goldenBytes, []byte("\r"), []byte(""), -1)
+					goldenBytes = bytes.ReplaceAll(goldenBytes, []byte("\r"), []byte(""))
 					expected := string(goldenBytes)
 
 					require.NoError(t, err, "failed to load golden file %q")
diff --git a/provisioner/terraform/resources.go b/provisioner/terraform/resources.go
@@ -42,7 +42,7 @@ type agentAttributes struct {
 	ID              string            `mapstructure:"id"`
 	Token           string            `mapstructure:"token"`
 	Env             map[string]string `mapstructure:"env"`
-	// Deprecated, but remains here for backwards compatibility.
+	// Deprecated: remains here for backwards compatibility.
 	StartupScript                string `mapstructure:"startup_script"`
 	StartupScriptBehavior        string `mapstructure:"startup_script_behavior"`
 	StartupScriptTimeoutSeconds  int32  `mapstructure:"startup_script_timeout"`
diff --git a/pty/pty_linux.go b/pty/pty_linux.go
@@ -1,4 +1,4 @@
-// go:build linux
+//go:build linux
 
 package pty
 
diff --git a/pty/ptytest/ptytest.go b/pty/ptytest/ptytest.go
@@ -164,9 +164,7 @@ func (e *outExpecter) expectMatchContextFunc(str string, fn func(ctx context.Con
 
 // TODO(mafredri): Rename this to ExpectMatch when refactoring.
 func (e *outExpecter) ExpectMatchContext(ctx context.Context, str string) string {
-	return e.expectMatcherFunc(ctx, str, func(src, pattern string) bool {
-		return strings.Contains(src, pattern)
-	})
+	return e.expectMatcherFunc(ctx, str, strings.Contains)
 }
 
 func (e *outExpecter) ExpectRegexMatchContext(ctx context.Context, str string) string {
diff --git a/pty/ssh_other.go b/pty/ssh_other.go
@@ -105,7 +105,7 @@ func applyTerminalModesToFd(logger *log.Logger, fd uintptr, req ssh.Pty) error {
 			continue
 		}
 		if _, ok := tios.CC[k]; ok {
-			tios.CC[k] = uint8(v)
+			tios.CC[k] = uint8(v) // #nosec G115 - terminal control character values are expected to fit in uint8
 			continue
 		}
 		if _, ok := tios.Opts[k]; ok {
diff --git a/tailnet/telemetry.go b/tailnet/telemetry.go
@@ -106,13 +106,14 @@ func (b *TelemetryStore) changedConntype(addr string) bool {
 	b.mu.Lock()
 	defer b.mu.Unlock()
 
-	if b.p2p && addr != "" {
+	switch {
+	case b.p2p && addr != "":
 		return false
-	} else if !b.p2p && addr != "" {
+	case !b.p2p && addr != "":
 		b.p2p = true
 		b.p2pSetupTime = time.Since(b.lastDerpTime)
 		return true
-	} else if b.p2p && addr == "" {
+	case b.p2p && addr == "":
 		b.p2p = false
 		b.lastDerpTime = time.Now()
 		b.p2pSetupTime = 0
diff --git a/testutil/port.go b/testutil/port.go
@@ -41,5 +41,5 @@ func RandomPortNoListen(*testing.T) uint16 {
 	rndMu.Lock()
 	x := rnd.Intn(n)
 	rndMu.Unlock()
-	return uint16(min + x)
+	return uint16(min + x) // #nosec G115 - range is safe, min+x is always <= max (60999)
 }
diff --git a/vpn/router.go b/vpn/router.go
@@ -40,35 +40,38 @@ func convertRouterConfig(cfg router.Config) *NetworkSettingsRequest {
 	v6LocalAddrs := make([]string, 0)
 	v6PrefixLengths := make([]uint32, 0)
 	for _, addrs := range cfg.LocalAddrs {
-		if addrs.Addr().Is4() {
+		switch {
+		case addrs.Addr().Is4():
 			v4LocalAddrs = append(v4LocalAddrs, addrs.Addr().String())
 			v4SubnetMasks = append(v4SubnetMasks, prefixToSubnetMask(addrs))
-		} else if addrs.Addr().Is6() {
+		case addrs.Addr().Is6():
 			v6LocalAddrs = append(v6LocalAddrs, addrs.Addr().String())
 			v6PrefixLengths = append(v6PrefixLengths, uint32(addrs.Bits()))
-		} else {
+		default:
 			continue
 		}
 	}
 	v4Routes := make([]*NetworkSettingsRequest_IPv4Settings_IPv4Route, 0)
 	v6Routes := make([]*NetworkSettingsRequest_IPv6Settings_IPv6Route, 0)
 	for _, route := range cfg.Routes {
-		if route.Addr().Is4() {
+		switch {
+		case route.Addr().Is4():
 			v4Routes = append(v4Routes, convertToIPV4Route(route))
-		} else if route.Addr().Is6() {
+		case route.Addr().Is6():
 			v6Routes = append(v6Routes, convertToIPV6Route(route))
-		} else {
+		default:
 			continue
 		}
 	}
 	v4ExcludedRoutes := make([]*NetworkSettingsRequest_IPv4Settings_IPv4Route, 0)
 	v6ExcludedRoutes := make([]*NetworkSettingsRequest_IPv6Settings_IPv6Route, 0)
 	for _, route := range cfg.LocalRoutes {
-		if route.Addr().Is4() {
+		switch {
+		case route.Addr().Is4():
 			v4ExcludedRoutes = append(v4ExcludedRoutes, convertToIPV4Route(route))
-		} else if route.Addr().Is6() {
+		case route.Addr().Is6():
 			v6ExcludedRoutes = append(v6ExcludedRoutes, convertToIPV6Route(route))
-		} else {
+		default:
 			continue
 		}
 	}

Original file line number	Diff line number	Diff line change
`@@ -19,7 +19,7 @@ func (Statter) Disk(p Prefix, path string) (Result, error) {`
`19`	`19`	`return nil, err`
`20`	`20`	`}`
`21`	`21`	`var r Result`
`22`		`- r.Total = ptr.To(float64(stat.Blocks * uint64(stat.Bsize)))`
	`22`	`+ r.Total = ptr.To(float64(stat.Blocks * uint64(stat.Bsize))) // #nosec G115 - conversion to uint64 is safe`
`23`	`23`	`r.Used = float64(stat.Blocks-stat.Bfree) * float64(stat.Bsize)`
`24`	`24`	`r.Unit = "B"`
`25`	`25`	`r.Prefix = p`
Original file line number	Diff line number	Diff line change
`@@ -32,8 +32,9 @@ func Distance(a, b string, maxDist int) (int, error) {`
`32`	`32`	`if len(b) > 255 {`
`33`	`33`	`return 0, xerrors.Errorf("levenshtein: b must be less than 255 characters long")`
`34`	`34`	`}`
`35`		`- m := uint8(len(a))`
`36`		`- n := uint8(len(b))`
	`35`	`+ // The conversions are safe because we've verified lens are <= 255`
	`36`	`+ m := uint8(len(a)) // #nosec G115 - checked above`
	`37`	`+ n := uint8(len(b)) // #nosec G115 - checked above`
`37`	`38`
`38`	`39`	`// Special cases for empty strings`
`39`	`40`	`if m == 0 {`
`@@ -76,7 +77,7 @@ func Distance(a, b string, maxDist int) (int, error) {`
`76`	`77`	`d[i][j]+subCost, // substitution`
`77`	`78`	`)`
`78`	`79`	`// check maxDist on the diagonal`
`79`		`- if maxDist > -1 && i == j && d[i+1][j+1] > uint8(maxDist) {`
	`80`	`+ if maxDist > -1 && i == j && d[i+1][j+1] > uint8(maxDist) { // #nosec G115 - maxDist checked to be > -1`
`80`	`81`	`return int(d[i+1][j+1]), ErrMaxDist`
`81`	`82`	`}`
`82`	`83`	`}`
Original file line number	Diff line number	Diff line change
`@@ -167,7 +167,7 @@ func parseCLISchedule(parts ...string) (*cron.Schedule, error) {`
`167`	`167`	`func parseDuration(raw string) (time.Duration, error) {`
`168`	`168`	`// If the user input a raw number, assume minutes`
`169`	`169`	`if isDigit(raw) {`
`170`		`- raw = raw + "m"`
	`170`	`+ raw += "m"`
`171`	`171`	`}`
`172`	`172`	`d, err := time.ParseDuration(raw)`
`173`	`173`	`if err != nil {`
Original file line number	Diff line number	Diff line change
`@@ -199,7 +199,7 @@ func (s *tableStats) Add(table string, n int) {`
`199`	`199`	`s.mu.Lock()`
`200`	`200`	`defer s.mu.Unlock()`
`201`	`201`
`202`		`- s.s[table] = s.s[table] + n`
	`202`	`+ s.s[table] += n`
`203`	`203`	`}`
`204`	`204`
`205`	`205`	`func (s *tableStats) Empty() []string {`
Original file line number	Diff line number	Diff line change
`@@ -35,7 +35,7 @@ func TimezoneIANA() (*time.Location, error) {`
`35`	`35`	`if err != nil {`
`36`	`36`	`return nil, xerrors.Errorf("read location of %s: %w", etcLocaltime, err)`
`37`	`37`	`}`
`38`		`- stripped := strings.Replace(lp, zoneInfoPath, "", -1)`
	`38`	`+ stripped := strings.ReplaceAll(lp, zoneInfoPath, "")`
`39`	`39`	`stripped = strings.TrimPrefix(stripped, string(filepath.Separator))`
`40`	`40`	`loc, err = time.LoadLocation(stripped)`
`41`	`41`	`if err != nil {`
Original file line number	Diff line number	Diff line change
`@@ -129,7 +129,7 @@ func TestWorkspace(t *testing.T) {`
`129`	`129`	`want = want[:32-5] + "-test"`
`130`	`130`	`}`
`131`	`131`	// Sometimes truncated names result in `--test` which is not an allowed name.
`132`		`- want = strings.Replace(want, "--", "-", -1)`
	`132`	`+ want = strings.ReplaceAll(want, "--", "-")`
`133`	`133`	`err := client.UpdateWorkspace(ctx, ws1.ID, codersdk.UpdateWorkspaceRequest{`
`134`	`134`	`Name: want,`
`135`	`135`	`})`
Original file line number	Diff line number	Diff line change
`@@ -397,7 +397,7 @@ type DeploymentValues struct {`
`397`	`397`	Config serpent.YAMLConfigPath `json:"config,omitempty" typescript:",notnull"`
`398`	`398`	WriteConfig serpent.Bool `json:"write_config,omitempty" typescript:",notnull"`
`399`	`399`
`400`		`- // DEPRECATED: Use HTTPAddress or TLS.Address instead.`
	`400`	`+ // Deprecated: Use HTTPAddress or TLS.Address instead.`
`401`	`401`	Address serpent.HostPort `json:"address,omitempty" typescript:",notnull"`
`402`	`402`	`}`
`403`	`403`