chore: upgrade to go 1.24 (#391)

PeterSchafer · web-flow · commit 08863bf2d6a0 · 2025-08-01T12:35:25.000+03:00
diff --git a/.golangci.yaml b/.golangci.yaml
@@ -101,7 +101,6 @@ linters:
     - errname
     - errorlint
     - exhaustive
-    - exportloopref
     # TODO(forbidigo): revisit
     #- forbidigo
     - forcetypeassert
@@ -145,7 +144,7 @@ linters:
     # TODO(stylecheck): revisit in a followup; some breaking API changes
     #- stylecheck
     # NOTE: removed tagliatelle as it conflicts too much with existing API wireformats
-    - tenv
+    # - TODO(usetesting)
     # TODO(testpackage): improve open vs closed-box testing in a followup
     #- testpackage
     - thelper
diff --git a/Makefile b/Makefile
@@ -3,7 +3,7 @@ GOOS = $(shell go env GOOS)
 GOARCH = $(shell go env GOARCH)
 
 GO_BIN := $(shell pwd)/.bin
-OVERRIDE_GOCI_LINT_V := v1.60.1
+OVERRIDE_GOCI_LINT_V := v1.64.8
 SHELL := env PATH=$(GO_BIN):$(shell go env GOROOT)/bin:$(PATH) $(SHELL)
 
 .PHONY: format
diff --git a/go.mod b/go.mod
@@ -1,6 +1,6 @@
 module github.com/snyk/go-application-framework
 
-go 1.23.6
+go 1.24
 
 require (
 	github.com/charmbracelet/lipgloss v0.10.0
diff --git a/internal/utils/temp-dir_test.go b/internal/utils/temp-dir_test.go
@@ -65,8 +65,8 @@ func Test_systemTempDirectory_handlesWhenTempDirNotExists(t *testing.T) {
 	tempDir, err := systemTempDirectory(logger, osutil)
 	assert.Nil(t, err)
 	assert.Equal(t, expectedDir, tempDir)
-	assert.Equal(t, expectedDir, osutil.(*mockTempDirOSUtil).dirPath)
-	assert.Equal(t, FILEPERM_755, osutil.(*mockTempDirOSUtil).dirPerm)
+	assert.Equal(t, expectedDir, osutil.(*mockTempDirOSUtil).dirPath)  //nolint:errcheck //in this test, the type is fix
+	assert.Equal(t, FILEPERM_755, osutil.(*mockTempDirOSUtil).dirPerm) //nolint:errcheck //in this test, the type is fix
 }
 
 func Test_systemTempDirectory_handlesTempDirFailure(t *testing.T) {
@@ -106,8 +106,8 @@ func Test_snykTempDirectoryImpl_handlesWhenSnykTempDirNotExists(t *testing.T) {
 	tempDir, err := snykTempDirectoryImpl(logger, osutil)
 	assert.Nil(t, err)
 	assert.Equal(t, expectedResult, tempDir)
-	assert.Equal(t, expectedResult, osutil.(*mockTempDirOSUtil).dirPath)
-	assert.Equal(t, FILEPERM_755, osutil.(*mockTempDirOSUtil).dirPerm)
+	assert.Equal(t, expectedResult, osutil.(*mockTempDirOSUtil).dirPath) //nolint:errcheck //in this test, the type is fix
+	assert.Equal(t, FILEPERM_755, osutil.(*mockTempDirOSUtil).dirPerm)   //nolint:errcheck //in this test, the type is fix
 }
 
 func Test_snykTempDirectoryImpl_handlesSnykTempDirFailure(t *testing.T) {
diff --git a/pkg/analytics/analytics_test.go b/pkg/analytics/analytics_test.go
@@ -3,13 +3,14 @@ package analytics
 import (
 	"encoding/json"
 	"fmt"
-	"github.com/snyk/go-application-framework/pkg/logging"
 	"io"
 	"net/http"
 	"os/user"
 	"strings"
 	"testing"
 
+	"github.com/snyk/go-application-framework/pkg/logging"
+
 	"github.com/stretchr/testify/assert"
 )
 
@@ -237,7 +238,7 @@ func Test_SanitizeUsername(t *testing.T) {
 func newTestAnalytics(t *testing.T) Analytics {
 	t.Helper()
 	a := New()
-	a.(*AnalyticsImpl).userCurrent = testUserCurrent(t)
+	a.(*AnalyticsImpl).userCurrent = testUserCurrent(t) //nolint:errcheck //in this test, the type is clear
 	return a
 }
 
diff --git a/pkg/app/app.go b/pkg/app/app.go
@@ -1,6 +1,7 @@
 package app
 
 import (
+	"crypto/fips140"
 	"io"
 	"log"
 	"net/http"
@@ -251,6 +252,7 @@ func initConfiguration(engine workflow.Engine, config configuration.Configuratio
 	config.AddDefaultValue(configuration.PREVIEW_FEATURES_ENABLED, defaultPreviewFeaturesEnabled(engine))
 	config.AddDefaultValue(configuration.CUSTOM_CONFIG_FILES, customConfigFiles(config))
 	config.AddDefaultValue(middleware.ConfigurationKeyRetryAttempts, defaultMaxNetworkRetryAttempts(engine))
+	config.AddDefaultValue(configuration.FIPS_ENABLED, configuration.StandardDefaultValueFunction(fips140.Enabled()))
 }
 
 func customConfigFiles(config configuration.Configuration) configuration.DefaultValueFunction {
diff --git a/pkg/auth/oauth2authenticator_test.go b/pkg/auth/oauth2authenticator_test.go
@@ -173,9 +173,9 @@ func Test_AddAuthenticationHeader_validToken(t *testing.T) {
 
 	config := configuration.NewWithOpts()
 	authenticator := NewOAuth2AuthenticatorWithOpts(config)
-	err := authenticator.(*oAuth2Authenticator).persistToken(newToken)
+	err := authenticator.(*oAuth2Authenticator).persistToken(newToken) //nolint:errcheck //in this test, the type is clear
 	assert.NoError(t, err)
-	authenticator.(*oAuth2Authenticator).tokenRefresherFunc = func(_ context.Context, _ *oauth2.Config, token *oauth2.Token) (*oauth2.Token, error) {
+	authenticator.(*oAuth2Authenticator).tokenRefresherFunc = func(_ context.Context, _ *oauth2.Config, token *oauth2.Token) (*oauth2.Token, error) { //nolint:errcheck //in this test, the type is clear
 		assert.False(t, true, "The token is valid and no refresh is required!")
 		return newToken, nil
 	}
@@ -197,7 +197,7 @@ func Test_AddAuthenticationHeader_validToken(t *testing.T) {
 	actualToken, err := GetOAuthToken(config)
 	assert.NoError(t, err)
 	assert.Equal(t, *newToken, *actualToken)
-	assert.Equal(t, *newToken, *authenticator.(*oAuth2Authenticator).token)
+	assert.Equal(t, *newToken, *authenticator.(*oAuth2Authenticator).token) //nolint:errcheck //in this test, the type is clear
 }
 
 func Test_AddAuthenticationHeader_expiredToken(t *testing.T) {
@@ -218,9 +218,9 @@ func Test_AddAuthenticationHeader_expiredToken(t *testing.T) {
 
 	config := configuration.NewWithOpts()
 	authenticator := NewOAuth2AuthenticatorWithOpts(config)
-	err := authenticator.(*oAuth2Authenticator).persistToken(expiredToken)
+	err := authenticator.(*oAuth2Authenticator).persistToken(expiredToken) //nolint:errcheck //in this test, the type is clear
 	assert.NoError(t, err)
-	authenticator.(*oAuth2Authenticator).tokenRefresherFunc = func(_ context.Context, _ *oauth2.Config, token *oauth2.Token) (*oauth2.Token, error) {
+	authenticator.(*oAuth2Authenticator).tokenRefresherFunc = func(_ context.Context, _ *oauth2.Config, token *oauth2.Token) (*oauth2.Token, error) { //nolint:errcheck //in this test, the type is clear
 		return newToken, nil
 	}
 
@@ -241,7 +241,7 @@ func Test_AddAuthenticationHeader_expiredToken(t *testing.T) {
 	actualToken, err := GetOAuthToken(config)
 	assert.NoError(t, err)
 	assert.Equal(t, *newToken, *actualToken)
-	assert.Equal(t, *newToken, *authenticator.(*oAuth2Authenticator).token)
+	assert.Equal(t, *newToken, *authenticator.(*oAuth2Authenticator).token) //nolint:errcheck //in this test, the type is clear
 }
 
 func Test_AddAuthenticationHeader_expiredToken_somebodyUpdated(t *testing.T) {
@@ -262,9 +262,9 @@ func Test_AddAuthenticationHeader_expiredToken_somebodyUpdated(t *testing.T) {
 
 	config := configuration.NewWithOpts()
 	authenticator := NewOAuth2AuthenticatorWithOpts(config)
-	err := authenticator.(*oAuth2Authenticator).persistToken(expiredToken)
+	err := authenticator.(*oAuth2Authenticator).persistToken(expiredToken) //nolint:errcheck //in this test, the type is clear
 	assert.NoError(t, err)
-	authenticator.(*oAuth2Authenticator).tokenRefresherFunc = func(_ context.Context, _ *oauth2.Config, token *oauth2.Token) (*oauth2.Token, error) {
+	authenticator.(*oAuth2Authenticator).tokenRefresherFunc = func(_ context.Context, _ *oauth2.Config, token *oauth2.Token) (*oauth2.Token, error) { //nolint:errcheck //in this test, the type is clear
 		assert.False(t, true, "The token is valid and no refresh is required!")
 		return newToken, nil
 	}
@@ -275,7 +275,7 @@ func Test_AddAuthenticationHeader_expiredToken_somebodyUpdated(t *testing.T) {
 
 	// have authenticator2 update the token "in parallel"
 	authenticator2 := NewOAuth2AuthenticatorWithOpts(config)
-	err = authenticator2.(*oAuth2Authenticator).persistToken(newToken)
+	err = authenticator2.(*oAuth2Authenticator).persistToken(newToken) //nolint:errcheck //in this test, the type is clear
 	assert.NoError(t, err)
 
 	// run method under test
@@ -291,7 +291,7 @@ func Test_AddAuthenticationHeader_expiredToken_somebodyUpdated(t *testing.T) {
 	actualToken, err := GetOAuthToken(config)
 	assert.NoError(t, err)
 	assert.Equal(t, *newToken, *actualToken)
-	assert.Equal(t, *newToken, *authenticator.(*oAuth2Authenticator).token)
+	assert.Equal(t, *newToken, *authenticator.(*oAuth2Authenticator).token) //nolint:errcheck //in this test, the type is clear
 }
 
 func Test_determineGrantType_empty(t *testing.T) {
diff --git a/pkg/auth/oauth_test.go b/pkg/auth/oauth_test.go
@@ -17,7 +17,7 @@ func getAccessTokenWithSingleAudienceClaim(t *testing.T, audience string) string
 	claims := &jws.ClaimSet{
 		Aud: audience,
 	}
-	pk, err := rsa.GenerateKey(rand.Reader, 1023)
+	pk, err := rsa.GenerateKey(rand.Reader, 2048)
 	assert.NoError(t, err)
 
 	accessToken, err := jws.Encode(header, claims, pk)
diff --git a/pkg/configuration/configuration_test.go b/pkg/configuration/configuration_test.go
@@ -351,8 +351,8 @@ func Test_ConfigurationClone(t *testing.T) {
 	assert.Equal(t, expectedAlternateValue, actualAlternateValue)
 
 	// we assume that a cloned configuration uses the same storage object. Just the pointer is cloned.
-	assert.Equal(t, config.(*extendedViper).storage, clonedConfig.(*extendedViper).storage)
-	assert.Equal(t, config.(*extendedViper).automaticEnvEnabled, clonedConfig.(*extendedViper).automaticEnvEnabled)
+	assert.Equal(t, config.(*extendedViper).storage, clonedConfig.(*extendedViper).storage)                         //nolint:errcheck //in this test, the type is clear
+	assert.Equal(t, config.(*extendedViper).automaticEnvEnabled, clonedConfig.(*extendedViper).automaticEnvEnabled) //nolint:errcheck //in this test, the type is clear
 
 	cleanupConfigstore(t)
 }
@@ -377,7 +377,7 @@ func TestNewFromFiles(t *testing.T) {
 func TestNewInMemory_shouldNotBreakWhenTryingToPersist(t *testing.T) {
 	config := NewInMemory()
 
-	assert.Nil(t, config.(*extendedViper).storage)
+	assert.Nil(t, config.(*extendedViper).storage) //nolint:errcheck //in this test, the type is clear
 	assert.NotNil(t, config)
 
 	const key = "test"
diff --git a/pkg/local_workflows/code_workflow_test.go b/pkg/local_workflows/code_workflow_test.go
@@ -98,7 +98,7 @@ func Test_Code_entrypoint(t *testing.T) {
 	rs, err := engine.InvokeWithConfig(WORKFLOWID_CODE, config)
 	assert.NoError(t, err)
 	assert.NotNil(t, rs)
-	assert.Equal(t, expectedData, rs[0].GetPayload().(string))
+	assert.Equal(t, expectedData, rs[0].GetPayload().(string)) //nolint:errcheck //in this test, the type is clear
 	assert.Equal(t, 2, sastSettingsCalled)
 }
 
@@ -141,7 +141,7 @@ func Test_Code_legacyImplementation_happyPath(t *testing.T) {
 	rs, err := engine.InvokeWithConfig(WORKFLOWID_CODE, config)
 	assert.NoError(t, err)
 	assert.NotNil(t, rs)
-	assert.Equal(t, expectedData, rs[0].GetPayload().(string))
+	assert.Equal(t, expectedData, rs[0].GetPayload().(string)) //nolint:errcheck //in this test, the type is clear
 }
 
 func Test_Code_nativeImplementation_happyPath(t *testing.T) {
@@ -226,7 +226,7 @@ func Test_Code_nativeImplementation_happyPath(t *testing.T) {
 	for _, v := range rs {
 		if v.GetContentType() == content_type.TEST_SUMMARY {
 			actualSummary := &json_schemas.TestSummary{}
-			err = json.Unmarshal(v.GetPayload().([]byte), actualSummary)
+			err = json.Unmarshal(v.GetPayload().([]byte), actualSummary) //nolint:errcheck //in this test, the type is clear
 			assert.NoError(t, err)
 
 			count := 0
diff --git a/pkg/local_workflows/config_utils/sanitycheck_test.go b/pkg/local_workflows/config_utils/sanitycheck_test.go
@@ -21,7 +21,7 @@ func Test_CheckSanity_ApiUrl(t *testing.T) {
 	claims := &jws.ClaimSet{
 		Aud: expectedAudience,
 	}
-	pk, err := rsa.GenerateKey(rand.Reader, 1023)
+	pk, err := rsa.GenerateKey(rand.Reader, 2048)
 	assert.NoError(t, err)
 
 	accessToken, err := jws.Encode(header, claims, pk)
diff --git a/pkg/local_workflows/filter_workflow_test.go b/pkg/local_workflows/filter_workflow_test.go
@@ -121,7 +121,7 @@ func TestFilterFindingsEntryPoint(t *testing.T) {
 		assert.NoError(t, err)
 		assert.Equal(t, len(input), len(output))
 		var filteredFindings local_models.LocalFinding
-		err = json.Unmarshal(output[0].GetPayload().([]byte), &filteredFindings)
+		err = json.Unmarshal(output[0].GetPayload().([]byte), &filteredFindings) //nolint:errcheck //in this test, the type is clear
 		assert.NoError(t, err)
 		for _, finding := range filteredFindings.Findings {
 			severity := string(finding.Attributes.Rating.Severity.Value)
@@ -157,7 +157,7 @@ func TestFilterFindingsEntryPoint(t *testing.T) {
 		assert.NoError(t, err)
 		assert.Equal(t, 1, len(output))
 		var filteredFindings local_models.LocalFinding
-		err = json.Unmarshal(output[0].GetPayload().([]byte), &filteredFindings)
+		err = json.Unmarshal(output[0].GetPayload().([]byte), &filteredFindings) //nolint:errcheck //in this test, the type is clear
 		assert.NoError(t, err)
 
 		expectedCounts := local_models.NewFindingsCounts()
diff --git a/pkg/local_workflows/report_analytics_workflow.go b/pkg/local_workflows/report_analytics_workflow.go
@@ -146,7 +146,12 @@ func reportAnalyticsEntrypoint(invocationCtx workflow.InvocationContext, inputDa
 
 func callEndpoint(invocationCtx workflow.InvocationContext, input workflow.Data, url string) error {
 	// Create a request
-	req, err := http.NewRequest(http.MethodPost, url, bytes.NewBuffer(input.GetPayload().([]byte)))
+	byteData, ok := input.GetPayload().([]byte)
+	if !ok {
+		return fmt.Errorf("invalid payload type: %T", input.GetPayload())
+	}
+
+	req, err := http.NewRequest(http.MethodPost, url, bytes.NewBuffer(byteData))
 	if err != nil {
 		return fmt.Errorf("error creating request: %w", err)
 	}
diff --git a/pkg/local_workflows/whoami_workflow_test.go b/pkg/local_workflows/whoami_workflow_test.go
@@ -167,7 +167,7 @@ func Test_WhoAmI_whoAmIWorkflowEntryPoint_happyPathRegularUser(t *testing.T) {
 		assert.Nil(t, err)
 
 		var actual interface{}
-		err = json.Unmarshal(output[0].GetPayload().([]byte), &actual)
+		err = json.Unmarshal(output[0].GetPayload().([]byte), &actual) //nolint:errcheck //in this test, the type is clear
 		assert.Nil(t, err)
 
 		// The output should be a dump of the data from the API in json format
@@ -216,7 +216,7 @@ func Test_WhoAmI_whoAmIWorkflowEntryPoint_happyPathServiceUser(t *testing.T) {
 		assert.Nil(t, err)
 
 		var actual interface{}
-		err = json.Unmarshal(output[0].GetPayload().([]byte), &actual)
+		err = json.Unmarshal(output[0].GetPayload().([]byte), &actual) //nolint:errcheck //in this test, the type is clear
 		assert.Nil(t, err)
 
 		// The output should be a dump of the data from the API in json format
diff --git a/pkg/logging/scrubbingLogWriter_test.go b/pkg/logging/scrubbingLogWriter_test.go
@@ -113,8 +113,8 @@ func TestScrubbingIoWriter(t *testing.T) {
 		bufioWriter = bytes.NewBufferString("")
 		writer = NewScrubbingIoWriter(bufioWriter, scrubDict)
 
-		writer.(ScrubbingLogWriter).RemoveTerm("token")
-		writer.(ScrubbingLogWriter).RemoveTerm("secret")
+		writer.(ScrubbingLogWriter).RemoveTerm("token")  //nolint:errcheck //in this test, the type is clear
+		writer.(ScrubbingLogWriter).RemoveTerm("secret") //nolint:errcheck //in this test, the type is clear
 
 		n, err = writer.Write([]byte(patternWithSecret))
 		require.NoError(t, err)
@@ -126,8 +126,8 @@ func TestScrubbingIoWriter(t *testing.T) {
 	t.Run("now re-add", func(t *testing.T) {
 		bufioWriter = bytes.NewBufferString("")
 		writer = NewScrubbingIoWriter(bufioWriter, scrubDict)
-		writer.(ScrubbingLogWriter).AddTerm("token", 0)
-		writer.(ScrubbingLogWriter).AddTerm("secret", 0)
+		writer.(ScrubbingLogWriter).AddTerm("token", 0)  //nolint:errcheck //in this test, the type is clear
+		writer.(ScrubbingLogWriter).AddTerm("secret", 0) //nolint:errcheck //in this test, the type is clear
 
 		n, err = writer.Write([]byte(patternWithSecret))
 		require.NoError(t, err)
diff --git a/pkg/networking/fips_enable/fips_init.go b/pkg/networking/fips_enable/fips_init.go
@@ -8,5 +8,7 @@ package fips_enable
 import "os"
 
 func init() {
-	os.Setenv("GOFIPS", "1")
+	existingValue := os.Getenv(godebugEnvVarName)
+	existingValue = setFipState(existingValue, true)
+	os.Setenv(godebugEnvVarName, existingValue)
 }
diff --git a/pkg/networking/fips_enable/fips_init_helper.go b/pkg/networking/fips_enable/fips_init_helper.go
@@ -0,0 +1,22 @@
+package fips_enable
+
+// Don't import anything
+
+const godebugEnvVarName = "GODEBUG"
+const envVarValueEnable = "fips140="
+const envVarOnValue = "on"
+const envVarOffValue = "off"
+
+func setFipState(existingValue string, enabled bool) string {
+	if len(existingValue) > 0 {
+		existingValue = "," + existingValue
+	}
+
+	enabledString := envVarOnValue
+	if !enabled {
+		enabledString = envVarOffValue
+	}
+
+	existingValue = envVarValueEnable + enabledString + existingValue
+	return existingValue
+}
diff --git a/pkg/networking/fips_enable/fips_init_test.go b/pkg/networking/fips_enable/fips_init_test.go
diff --git a/pkg/networking/fips_enable/non_fips_init.go b/pkg/networking/fips_enable/non_fips_init.go
diff --git a/pkg/networking/middleware/retry_middleware.go b/pkg/networking/middleware/retry_middleware.go
diff --git a/pkg/networking/networking_test.go b/pkg/networking/networking_test.go
diff --git a/pkg/workflow/analyticsWrapper_test.go b/pkg/workflow/analyticsWrapper_test.go

Original file line number	Diff line number	Diff line change
`@@ -17,7 +17,7 @@ func getAccessTokenWithSingleAudienceClaim(t *testing.T, audience string) string`
`17`	`17`	`claims := &jws.ClaimSet{`
`18`	`18`	`Aud: audience,`
`19`	`19`	`}`
`20`		`- pk, err := rsa.GenerateKey(rand.Reader, 1023)`
	`20`	`+ pk, err := rsa.GenerateKey(rand.Reader, 2048)`
`21`	`21`	`assert.NoError(t, err)`
`22`	`22`
`23`	`23`	`accessToken, err := jws.Encode(header, claims, pk)`