epic: lint cleanup and gate hardening #578

New issue

Open

opened 2026-09-22 17:04:58 +00:00 by hexajon · 0 comments

hexajon commented

2026-09-22 17:04:58 +00:00

Owner

Goal

Bring the tree to zero lint findings and widen the verification gate so the same checks run every time. I want the lint debt cleared, gofumpt adopted, and vulnerability scanning across both the Go module graph and the committed npm harness lockfile. I then record the resulting policy in an ADR.

Scope

Resolve every finding from the four linters: errcheck, gocritic, ineffassign, revive.
Run all four through golangci-lint in one type-checked pass, wired into the gate's heavy block.
Adopt gofumpt and enforce it beside gofmt.
Add osv-scanner for ecosystem-wide vulnerability scanning across Go and npm.
Add a credential-gated nancy scan.
Bump the vulnerable npm dependencies in the conformance harness lockfile.
Replace stale tracker-number citations in shipped strings with the reason or a public ADR link.
Verify the gate runs clean inside a linked git worktree.
Record the gate-expansion and citation decisions in ADRs.

Exit criterion

./scripts/gate.sh passes with all of the following true:

golangci-lint reports zero findings for errcheck, gocritic, ineffassign, and revive.
gofumpt is clean and enforced.
osv-scanner reports zero vulnerabilities across the Go module graph and the conformance harness lockfile.
The credential-gated nancy scan is wired: it runs when credentials exist and skips visibly otherwise.
TestNoDanglingRefsInShippedSurfaces is green.
The gate produces identical results inside a linked git worktree.
The decisions are recorded in ADRs, each with its index row.

Tracking

Native dependencies wire this epic to its children, so it cannot close while any child is open.

## Goal Bring the tree to zero lint findings and widen the verification gate so the same checks run every time. I want the lint debt cleared, gofumpt adopted, and vulnerability scanning across both the Go module graph and the committed npm harness lockfile. I then record the resulting policy in an ADR. ## Scope - Resolve every finding from the four linters: errcheck, gocritic, ineffassign, revive. - Run all four through golangci-lint in one type-checked pass, wired into the gate's heavy block. - Adopt gofumpt and enforce it beside gofmt. - Add osv-scanner for ecosystem-wide vulnerability scanning across Go and npm. - Add a credential-gated nancy scan. - Bump the vulnerable npm dependencies in the conformance harness lockfile. - Replace stale tracker-number citations in shipped strings with the reason or a public ADR link. - Verify the gate runs clean inside a linked git worktree. - Record the gate-expansion and citation decisions in ADRs. ## Exit criterion `./scripts/gate.sh` passes with all of the following true: - golangci-lint reports zero findings for errcheck, gocritic, ineffassign, and revive. - gofumpt is clean and enforced. - osv-scanner reports zero vulnerabilities across the Go module graph and the conformance harness lockfile. - The credential-gated nancy scan is wired: it runs when credentials exist and skips visibly otherwise. - `TestNoDanglingRefsInShippedSurfaces` is green. - The gate produces identical results inside a linked git worktree. - The decisions are recorded in ADRs, each with its index row. ## Tracking Native dependencies wire this epic to its children, so it cannot close while any child is open.

hexajon added the

epic

testing

labels

2026-09-22 17:04:58 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea#578

No description provided.

Rows
Columns