Fix golangci-lint issues

Signed-off-by: Erik Godding Boye <[email protected]>

Author: erikgb

internal/pki/csr.go

@@ -114,7 +114,7 @@ func EncodeX509(cert *x509.Certificate) ([]byte, error) {
 func signatureAlgorithmFromPublicKey(alg x509.PublicKeyAlgorithm, arg any) (x509.SignatureAlgorithm, error) {
 	var signatureAlgorithm x509.SignatureAlgorithm
 
-	switch alg {
+	switch alg { //nolint:exhaustive // There is a default that appears to be not picked up by the linter
 	case x509.RSA:
 		size, ok := arg.(int)
 		if !ok {

pkg/authority/api/api.go

@@ -24,16 +24,16 @@ const (
 	// `inject-dynamic-ca-from-secret` label.
 	// If an injectable references a Secret that does NOT have this annotation,
 	// the dynamic ca-injector will refuse to inject the secret.
-	DynamicAuthoritySecretLabel = "cert-manager.io/allow-dynamic-ca-injection"
+	DynamicAuthoritySecretLabel = "cert-manager.io/allow-dynamic-ca-injection" //#nosec G101 - This is not credentials
 	// WantInjectFromSecretNamespaceLabel is the label that specifies that a
 	// particular object wants injection of dynamic CAs from secret in
 	// namespace.
 	// Must be used in conjunction with WantInjectFromSecretNameLabel.
-	WantInjectFromSecretNamespaceLabel = "cert-manager.io/inject-dynamic-ca-from-secret-namespace"
+	WantInjectFromSecretNamespaceLabel = "cert-manager.io/inject-dynamic-ca-from-secret-namespace" //#nosec G101 - This is not credentials
 	// WantInjectFromSecretNameLabel is the label that specifies that a
 	// particular object wants injection of dynamic CAs from secret with name.
 	// Must be used in conjunction with WantInjectFromSecretNamespaceLabel.
-	WantInjectFromSecretNameLabel = "cert-manager.io/inject-dynamic-ca-from-secret-name"
+	WantInjectFromSecretNameLabel = "cert-manager.io/inject-dynamic-ca-from-secret-name" //#nosec G101 - This is not credentials
 
 	// TLSCABundleKey is used as a data key in Secret resources to store a CA
 	// certificate bundle.
@@ -42,9 +42,9 @@ const (
 	// RenewCertificateSecretAnnotation is an annotation that can be set to
 	// an arbitrary value on a certificate secret to trigger a renewal of the
 	// certificate managed in the secret.
-	RenewCertificateSecretAnnotation = "renew.cert-manager.io/requestedAt"
+	RenewCertificateSecretAnnotation = "renew.cert-manager.io/requestedAt" //#nosec G101 - This is not credentials
 	// RenewHandledCertificateSecretAnnotation is an annotation that will be set on a
 	// certificate secret whenever a new certificate is renewed using the
 	// RenewCertificateSecretAnnotation annotation.
-	RenewHandledCertificateSecretAnnotation = "renew.cert-manager.io/lastRequestedAt"
+	RenewHandledCertificateSecretAnnotation = "renew.cert-manager.io/lastRequestedAt" //#nosec G101 - This is not credentials
 )

pkg/authority/authority.go

@@ -21,17 +21,18 @@ import (
 	"errors"
 	"time"
 
-	"github.com/cert-manager/webhook-cert-lib/pkg/authority/api"
-	"github.com/cert-manager/webhook-cert-lib/pkg/authority/cert"
-	leadercontrollers "github.com/cert-manager/webhook-cert-lib/pkg/authority/leader_controllers"
-	"github.com/cert-manager/webhook-cert-lib/pkg/authority/leader_controllers/injectable"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/labels"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/cache"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	"github.com/cert-manager/webhook-cert-lib/pkg/authority/api"
+	"github.com/cert-manager/webhook-cert-lib/pkg/authority/cert"
+	leadercontrollers "github.com/cert-manager/webhook-cert-lib/pkg/authority/leader_controllers"
+	"github.com/cert-manager/webhook-cert-lib/pkg/authority/leader_controllers/injectable"
 )
 
 type LeafOptions struct {

pkg/authority/leader_controllers/ca_secret_controller.go

@@ -21,6 +21,7 @@ import (
 	"crypto"
 	"crypto/x509"
 
+	"github.com/go-logr/logr"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -35,7 +36,6 @@ import (
 	"github.com/cert-manager/webhook-cert-lib/internal/pki"
 	"github.com/cert-manager/webhook-cert-lib/pkg/authority/api"
 	"github.com/cert-manager/webhook-cert-lib/pkg/authority/cert"
-	"github.com/go-logr/logr"
 )
 
 // CASecretReconciler reconciles a CA Secret object

pkg/authority/leader_controllers/injectable_controller.go

@@ -20,8 +20,6 @@ import (
 	"context"
 	"strings"
 
-	"github.com/cert-manager/webhook-cert-lib/pkg/authority/api"
-	"github.com/cert-manager/webhook-cert-lib/pkg/authority/leader_controllers/injectable"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
@@ -33,6 +31,9 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/controller-runtime/pkg/source"
+
+	"github.com/cert-manager/webhook-cert-lib/pkg/authority/api"
+	"github.com/cert-manager/webhook-cert-lib/pkg/authority/leader_controllers/injectable"
 )
 
 // InjectableReconciler injects CA bundle into resources
@@ -69,11 +70,11 @@ func (r *InjectableReconciler) SetupWithManager(mgr ctrl.Manager) error {
 					}
 
 					requests := make([]reconcile.Request, len(objList.Items))
-					for _, obj := range objList.Items {
+					for i, obj := range objList.Items {
 						req := reconcile.Request{}
 						req.Namespace = obj.GetNamespace()
 						req.Name = obj.GetName()
-						requests = append(requests, req)
+						requests[i] = req
 					}
 					return requests
 				}),

pkg/authority/leader_controllers/ssa_client.go

@@ -17,10 +17,11 @@ limitations under the License.
 package leadercontrollers
 
 import (
-	"github.com/cert-manager/webhook-cert-lib/pkg/authority/leader_controllers/injectable"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/json"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	"github.com/cert-manager/webhook-cert-lib/pkg/authority/leader_controllers/injectable"
 )
 
 const (

test/ca_secret_controller_test.go

@@ -19,9 +19,6 @@ package test
 import (
 	"time"
 
-	. "github.com/onsi/ginkgo/v2"
-	. "github.com/onsi/gomega"
-
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/kubernetes/scheme"
@@ -32,6 +29,9 @@ import (
 	"github.com/cert-manager/webhook-cert-lib/internal/pki"
 	"github.com/cert-manager/webhook-cert-lib/pkg/authority/api"
 	leadercontrollers "github.com/cert-manager/webhook-cert-lib/pkg/authority/leader_controllers"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
 )
 
 var _ = Describe("CA Secret Controller", Ordered, func() {

test/injectable_controller_test.go

@@ -17,12 +17,6 @@ limitations under the License.
 package test
 
 import (
-	"github.com/cert-manager/webhook-cert-lib/pkg/authority/api"
-	"github.com/cert-manager/webhook-cert-lib/pkg/authority/leader_controllers/injectable"
-	. "github.com/onsi/ginkgo/v2"
-	. "github.com/onsi/gomega"
-
-	leadercontrollers "github.com/cert-manager/webhook-cert-lib/pkg/authority/leader_controllers"
 	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -31,6 +25,13 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/envtest/komega"
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
+
+	"github.com/cert-manager/webhook-cert-lib/pkg/authority/api"
+	leadercontrollers "github.com/cert-manager/webhook-cert-lib/pkg/authority/leader_controllers"
+	"github.com/cert-manager/webhook-cert-lib/pkg/authority/leader_controllers/injectable"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
 )
 
 var _ = Describe("Injectable Controller", Ordered, func() {

test/leaf_cert_controller_test.go

@@ -20,9 +20,6 @@ import (
 	"crypto/tls"
 	"time"
 
-	. "github.com/onsi/ginkgo/v2"
-	. "github.com/onsi/gomega"
-
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/kubernetes/scheme"
@@ -35,6 +32,9 @@ import (
 	"github.com/cert-manager/webhook-cert-lib/pkg/authority/api"
 	"github.com/cert-manager/webhook-cert-lib/pkg/authority/cert"
 	leadercontrollers "github.com/cert-manager/webhook-cert-lib/pkg/authority/leader_controllers"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
 )
 
 var _ = Describe("Leaf Certificate Controller", Ordered, func() {

test/suite_test.go

@@ -20,16 +20,16 @@ import (
 	"context"
 	"testing"
 
-	. "github.com/onsi/ginkgo/v2"
-	. "github.com/onsi/gomega"
-
 	"k8s.io/client-go/kubernetes/scheme"
 	"k8s.io/client-go/rest"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/envtest"
 	"sigs.k8s.io/controller-runtime/pkg/envtest/komega"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
 )
 
 // These tests use Ginkgo (BDD-style Go testing framework). Refer to