Fix gosec and nilaway findings, enforce both in CI

Triages all 61 gosec findings and all 3 nilaway findings, then removes
continue-on-error from the existing gosec/nilaway CI jobs so new
findings block merges going forward. Also fixes two other pre-existing
CI failures (govulncheck, lint) uncovered while getting this branch
fully green end to end, and the lint job's own full pre-existing
findings backlog once fixing its version-pin bug let it actually run.

gosec:
- G104 (unhandled Close errors): replaced with plain `_ =`
  assignments matching the codebase's existing convention, needing no
  suppression at all.
- G301/G306/G302 (permissions): tightened directories to 0o750 and
  app-owned files to 0o600; .gitignore intentionally kept at the
  conventional 0o644 (world-readable, shared in the repo).
- G304 (dynamic path), G202 (SQL concat), G115 (int narrowing),
  G401/G505 (SHA-1), G103 (unsafe.Pointer): verified genuine false
  positives by inspection and suppressed with an inline
  `// #nosec Gxxx -- reason` comment (gosec's own directive, since
  golangci-lint's `//nolint` is not understood when gosec runs
  standalone as it does in CI). This includes six findings in the
  Linux-only inotify backend that a local macOS run can't see, since
  it's gated by a linux build tag.
- watcher/backend_inotify.go also hoists an int->uint32 conversion out
  of a for-loop header: gosec's own nosec-comment scanner fails to
  suppress a finding on the very next line when the loop header
  carries its own nosec comment, so the conversion moves to its own
  statement before the loop.

nilaway: restructured indexer's batch-embedding path so the `origins`
accumulator is a non-nil `make([]T, 0, n)` instead of a nil `var`, and
merged two loops into one straight-line block, giving nilaway's flow
analysis a provably non-nil path. Behavior-preserving; covered by
existing indexer_test.go fakes.

govulncheck: bumps golang.org/x/text to v0.39.0, fixing GO-2026-5970
(infinite loop on invalid input), reached transitively through the
tokenizer's Unicode normalization.

lint: golangci-lint-action@v6's `version: latest` resolves within the
v1.x line, which refuses to run against this module's go 1.26.5
directive. Moves to golangci-lint-action@v9 pinned to golangci-lint
v2.12.2, which supports it. That version-pin fix let the job actually
lint for the first time (it was crashing before reaching any file),
surfacing a 223-issue backlog (218 errcheck + 5 staticcheck) across 21
files hidden behind both the crash and golangci-lint's own default
max-issues-per-linter/max-same-issues caps. Fixed all of them:
unchecked errors become `_ =` (or the package's existing closeQuietly
helper for io.Closer values in store/sqlite.go and store/graph.go),
and the 5 staticcheck simplifications (3x WriteString(Sprintf(...)) ->
Fprintf, one De Morgan's law rewrite, one redundant embedded-field
selector) are applied as suggested.

Author: eshanclio

.github/workflows/ci.yml

@@ -39,10 +39,17 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends libsqlite3-dev
 
+      # golangci-lint-action@v6's "latest" resolves within the v1.x line
+      # (v1.64.8 at time of writing), which refuses to run against this
+      # module's go 1.26.5 directive ("the Go language version used to
+      # build golangci-lint is lower than the targeted Go version"). v9
+      # supports golangci-lint v2, and pinning a v2 release keeps the
+      # Go-version check satisfied without depending on how "latest"
+      # happens to resolve.
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v9
         with:
-          version: latest
+          version: v2.12.2
           args: --build-tags=sqlite_fts5
 
   test:
@@ -225,14 +232,15 @@ jobs:
   # set up — gives gosec's type-checking source loader what it needs to
   # actually analyze cgo-dependent packages instead of skipping them.
   #
-  # continue-on-error: a first run against this codebase turned up 61
-  # pre-existing findings (mostly G104 unhandled-error-on-Close, plus a
-  # handful of G301/G304/G306/G115/G202/G401/G505). None of that is this
-  # job's fault to gate on — report-only until it's triaged, then remove
-  # continue-on-error so new findings start blocking merges.
+  # The 61 pre-existing findings from the first run against this codebase
+  # (mostly G104 unhandled-error-on-Close, plus a handful of
+  # G301/G304/G306/G115/G202/G401/G505) have all been triaged: fixed where
+  # real, suppressed with an inline `// #nosec Gxxx -- reason` comment
+  # (gosec's own directive — it does not understand golangci-lint's
+  # `//nolint` comments when run standalone like this) where the flagged
+  # pattern is safe by inspection. New findings now block merges.
   gosec:
     runs-on: ubuntu-latest
-    continue-on-error: true
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -260,12 +268,15 @@ jobs:
   # see, which is the flag NilAway's own docs call out as the standard way to
   # keep a first run's signal-to-noise ratio sane on an existing codebase.
   #
-  # continue-on-error: a first run against this codebase found 3 potential
-  # nil panics in indexer/indexer.go, pre-existing and unrelated to this
-  # workflow. Report-only until triaged, then remove continue-on-error.
+  # The 3 potential nil panics found by the first run against this codebase
+  # (all in indexer/indexer.go, one structural root cause) have been fixed:
+  # a nilable `var x []T` accumulator became a non-nil `make([]T, 0, n)`,
+  # and the two consuming loops were merged into the same block that
+  # assigns and validates the embedder's result slices, giving NilAway's
+  # flow analysis a straight-line path to see them as non-nil. New findings
+  # now block merges.
   nilaway:
     runs-on: ubuntu-latest
-    continue-on-error: true
     steps:
       - name: Checkout
         uses: actions/checkout@v4

cmd/codamigo/doctor_cmd.go

@@ -119,7 +119,7 @@ func doctorCmd() *cli.Command {
 				if err != nil {
 					fmt.Printf("[FAIL] Store open error: %v\n", err)
 				} else {
-					defer s.Close()
+					defer func() { _ = s.Close() }() // best-effort cleanup; the process is exiting either way
 					stats, err := s.Stats(ctx)
 					if err != nil {
 						fmt.Printf("[FAIL] Stats error: %v\n", err)
@@ -157,7 +157,7 @@ func doctorCmd() *cli.Command {
 				if err != nil {
 					fmt.Printf("[FAIL] Walker error: %v\n", err)
 				} else {
-					defer w.Close()
+					defer func() { _ = w.Close() }() // best-effort cleanup; the process is exiting either way
 					count := 0
 					errCount := 0
 					for _, err := range w.Walk(ctx) {

cmd/codamigo/graph_cmd.go

@@ -106,7 +106,7 @@ func runGraphQuery(
 	if err != nil {
 		return err
 	}
-	defer s.Close()
+	defer func() { _ = s.Close() }() // best-effort cleanup; the process is exiting either way
 
 	refs, err := run(query.New(emb, s), symbol)
 	if err != nil {

cmd/codamigo/init_cmd.go

@@ -77,7 +77,7 @@ func initCmd() *cli.Command {
 				}
 
 				// Write global config.
-				if err := os.MkdirAll(filepath.Dir(globalPath), 0o755); err != nil {
+				if err := os.MkdirAll(filepath.Dir(globalPath), 0o750); err != nil {
 					return fmt.Errorf("creating config directory: %w", err)
 				}
 				// 0o600 below matters: this file may hold an API key or a
@@ -111,11 +111,11 @@ func initCmd() *cli.Command {
 			// Always create project config if missing — runs regardless of global config state.
 			projectPath := config.ProjectConfigPath()
 			if _, err := os.Stat(projectPath); errors.Is(err, fs.ErrNotExist) {
-				if err := os.MkdirAll(filepath.Dir(projectPath), 0o755); err != nil {
+				if err := os.MkdirAll(filepath.Dir(projectPath), 0o750); err != nil {
 					return fmt.Errorf("creating project config directory: %w", err)
 				}
 				projectContent := "# codamigo project settings\n# include_patterns: []\n# exclude_patterns: []\n"
-				if err := os.WriteFile(projectPath, []byte(projectContent), 0o644); err != nil {
+				if err := os.WriteFile(projectPath, []byte(projectContent), 0o600); err != nil {
 					return fmt.Errorf("writing project config: %w", err)
 				}
 				fmt.Printf("Created project config: %s\n", projectPath)
@@ -134,11 +134,11 @@ func initCmd() *cli.Command {
 				dataDir, err := config.ProjectDataDir(wd)
 				if err != nil {
 					fmt.Fprintf(os.Stderr, "Warning: could not resolve data directory: %v\n", err)
-				} else if err := os.MkdirAll(dataDir, 0o755); err != nil {
+				} else if err := os.MkdirAll(dataDir, 0o750); err != nil {
 					fmt.Fprintf(os.Stderr, "Warning: could not create data directory: %v\n", err)
 				} else {
 					pathFile := filepath.Join(dataDir, "project_path")
-					if err := os.WriteFile(pathFile, []byte(wd), 0o644); err != nil {
+					if err := os.WriteFile(pathFile, []byte(wd), 0o600); err != nil {
 						fmt.Fprintf(os.Stderr, "Warning: could not write project_path: %v\n", err)
 					}
 				}
@@ -201,9 +201,9 @@ func initCmd() *cli.Command {
 // buffered input from piped stdin is not lost between calls.
 func readPrompt(scanner *bufio.Scanner, w io.Writer, prompt, defaultVal string) string {
 	if defaultVal != "" {
-		fmt.Fprintf(w, "%s [%s]: ", prompt, defaultVal)
+		_, _ = fmt.Fprintf(w, "%s [%s]: ", prompt, defaultVal)
 	} else {
-		fmt.Fprintf(w, "%s: ", prompt)
+		_, _ = fmt.Fprintf(w, "%s: ", prompt)
 	}
 	if scanner.Scan() {
 		line := strings.TrimSpace(scanner.Text())
@@ -227,6 +227,7 @@ func appendToGitignore(projectRoot string) error {
 	const entry = ".codamigo/"
 	gitignorePath := filepath.Join(projectRoot, ".gitignore")
 
+	// #nosec G304 -- gitignorePath is derived from the CLI's own project root, not external input
 	content, err := os.ReadFile(gitignorePath)
 	if err != nil && !errors.Is(err, fs.ErrNotExist) {
 		return fmt.Errorf("reading .gitignore: %w", err)
@@ -238,6 +239,9 @@ func appendToGitignore(projectRoot string) error {
 		}
 	}
 
+	// #nosec G304,G302 -- 0o644 matches .gitignore's conventional world-readable
+	// permissions; gitignorePath is derived from the CLI's own project root,
+	// not external input.
 	f, err := os.OpenFile(gitignorePath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o644)
 	if err != nil {
 		return fmt.Errorf("opening .gitignore: %w", err)

cmd/codamigo/main.go

@@ -130,8 +130,8 @@ func indexCmd() *cli.Command {
 			if err != nil {
 				return err
 			}
-			defer s.Close()
-			defer w.Close() //nolint:errcheck
+			defer func() { _ = s.Close() }() // best-effort cleanup; the process is exiting either way
+			defer func() { _ = w.Close() }() // best-effort cleanup; the process is exiting either way
 
 			// Wrap ctx so the TUI can cancel the indexer directly via ctrl+c.
 			// In TTY mode the terminal is in raw mode (ISIG cleared), so ctrl+c
@@ -233,8 +233,8 @@ func serveCmd() *cli.Command {
 			if err != nil {
 				return err
 			}
-			defer s.Close()
-			defer w.Close()
+			defer func() { _ = s.Close() }() // best-effort cleanup; the process is exiting either way
+			defer func() { _ = w.Close() }() // best-effort cleanup; the process is exiting either way
 			queryEmb, err := queryEmbedderFor(cfg, indexEmb)
 			if err != nil {
 				return fmt.Errorf("creating embedder: %w", err)
@@ -251,7 +251,7 @@ func serveCmd() *cli.Command {
 			if err != nil {
 				return fmt.Errorf("creating watcher: %w", err)
 			}
-			defer wch.Close()
+			defer func() { _ = wch.Close() }() // best-effort cleanup; the process is exiting either way
 			srv := mcp.NewServer(q, idx, wch,
 				mcp.WithNonCodeLanguages(cfg.NonCodeLanguages),
 				mcp.WithGraph(cfg.GraphEnabled()),
@@ -422,7 +422,7 @@ func buildComponents(cfg *config.Config, storePath string, dim int) (*chunker.Ch
 	filter := buildExtensionFilter(allLangs)
 	w, err := walker.New(cfg.ProjectRoot, cfg, walker.WithFileFilter(filter))
 	if err != nil {
-		s.Close()
+		_ = s.Close() // best-effort cleanup; the walker error below is the one worth reporting
 		return nil, nil, nil, fmt.Errorf("creating walker: %w", err)
 	}
 	return c, s, w, nil

cmd/codamigo/map_cmd.go

@@ -52,7 +52,7 @@ func mapCmd() *cli.Command {
 			if err != nil {
 				return err
 			}
-			defer s.Close()
+			defer func() { _ = s.Close() }() // best-effort cleanup; the process is exiting either way
 
 			q := query.New(emb, s)
 

cmd/codamigo/reset_cmd.go

@@ -44,19 +44,19 @@ func resetCmd() *cli.Command {
 // is testable without touching os.Stdin/os.Stdout.
 func runReset(storePath string, force bool, in io.Reader, out io.Writer) error {
 	if _, err := os.Stat(storePath); errors.Is(err, fs.ErrNotExist) {
-		fmt.Fprintln(out, "Nothing to reset.")
+		_, _ = fmt.Fprintln(out, "Nothing to reset.")
 		return nil
 	}
 
 	if !force {
-		fmt.Fprintf(out, "The following file will be deleted:\n  %s\nDelete store file? [y/N]: ", storePath)
+		_, _ = fmt.Fprintf(out, "The following file will be deleted:\n  %s\nDelete store file? [y/N]: ", storePath)
 		scanner := bufio.NewScanner(in)
 		answer := ""
 		if scanner.Scan() {
 			answer = strings.TrimSpace(scanner.Text())
 		}
 		if !strings.EqualFold(answer, "y") {
-			fmt.Fprintln(out, "Aborted.")
+			_, _ = fmt.Fprintln(out, "Aborted.")
 			return nil
 		}
 	}
@@ -66,6 +66,6 @@ func runReset(storePath string, force bool, in io.Reader, out io.Writer) error {
 			return fmt.Errorf("deleting store%s: %w", suffix, err)
 		}
 	}
-	fmt.Fprintf(out, "Store deleted: %s\n", storePath)
+	_, _ = fmt.Fprintf(out, "Store deleted: %s\n", storePath)
 	return nil
 }

cmd/codamigo/search_cmd.go

@@ -109,7 +109,7 @@ func searchCmd() *cli.Command {
 			if err != nil {
 				return err
 			}
-			defer s.Close()
+			defer func() { _ = s.Close() }() // best-effort cleanup; the process is exiting either way
 
 			maxTokens := cmd.Int("max-tokens")
 			if maxTokens < 0 {

config/config.go

@@ -11,7 +11,7 @@
 package config
 
 import (
-	"crypto/sha1"
+	"crypto/sha1" // #nosec G505 -- non-cryptographic use, see ProjectHash
 	"encoding/hex"
 	"errors"
 	"fmt"
@@ -307,6 +307,9 @@ func ProjectConfigPath() string {
 // that "/home/user/project/" and "/home/user/project" produce the same hash.
 func ProjectHash(projectRoot string) string {
 	trimmed := strings.Trim(projectRoot, "/")
+	// #nosec G401 -- non-cryptographic use: stable directory-name hash, not a
+	// security boundary; switching algorithms would relocate existing users'
+	// data dirs.
 	sum := sha1.Sum([]byte(trimmed))
 	return hex.EncodeToString(sum[:])
 }
@@ -365,11 +368,12 @@ func HomeProjectConfigPath(projectRoot string) (string, error) {
 // Returns an error if the file does not exist, contains unknown keys, or has
 // malformed duration strings.
 func Load(path string) (*Config, error) {
+	// #nosec G304 -- path is the CLI's own config path (flag/default), not external input
 	f, err := os.Open(path)
 	if err != nil {
 		return nil, fmt.Errorf("opening config %q: %w", path, err)
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }() // best-effort cleanup; the file is only being read
 
 	dec := yaml.NewDecoder(f)
 	dec.KnownFields(true)

config/config_test.go

@@ -288,7 +288,9 @@ func writeTempConfig(t *testing.T, content string) string {
 	if _, err := f.WriteString(content); err != nil {
 		t.Fatalf("writing temp config: %v", err)
 	}
-	f.Close()
+	if err := f.Close(); err != nil {
+		t.Fatalf("closing temp config: %v", err)
+	}
 	return f.Name()
 }
 
@@ -326,9 +328,13 @@ func ExampleLoad() {
 	if err != nil {
 		panic(err)
 	}
-	defer os.Remove(f.Name())
-	f.WriteString("embedding_model: my-model\npoll_interval: 10s\n")
-	f.Close()
+	defer func() { _ = os.Remove(f.Name()) }()
+	if _, err := f.WriteString("embedding_model: my-model\npoll_interval: 10s\n"); err != nil {
+		panic(err)
+	}
+	if err := f.Close(); err != nil {
+		panic(err)
+	}
 
 	cfg, err := config.Load(f.Name())
 	if err != nil {
@@ -591,7 +597,7 @@ func TestProjectHash(t *testing.T) {
 				t.Errorf("hash length = %d, want 40", len(h))
 			}
 			for _, c := range h {
-				if !(c >= '0' && c <= '9' || c >= 'a' && c <= 'f') {
+				if (c < '0' || c > '9') && (c < 'a' || c > 'f') {
 					t.Errorf("hash contains non-hex char %q in %q", c, h)
 				}
 			}