feat: update go to 1.25, add permissions and envs (#49)

* chore(ci): update go to 1.25, add permissions and envs
* fix(ci): update pr-lint.yml
* chore: update go, fix linting
* fix: tests and linting
* fix(lint): lint fixes, renovate should now pass
* fix: updates, security upgrades
* chore: workflow updates, lint
* fix: more lint, checkmake, and other fixes
* fix: more lint, convert scripts to POSIX compliant
* fix: simplify codeql workflow
* tests: increase test coverage, fix found issues
* fix(lint): editorconfig checking, add to linters
* fix(lint): shellcheck, add to linters
* fix(lint): apply cr comment suggestions
* fix(ci): remove step-security/harden-runner
* fix(lint): remove duplication, apply cr fixes
* fix(ci): tests in CI/CD pipeline
* chore(lint): deduplication of strings
* fix(lint): apply cr comment suggestions
* fix(ci): actionlint
* fix(lint): apply cr comment suggestions
* chore: lint, add deps management

testutil/concurrency_test.go

@@ -83,4 +83,4 @@ func BenchmarkVerifyContentContains(b *testing.B) {
 			_ = strings.Contains(content, exp)
 		}
 	}
-}
+}

testutil/config_test.go

@@ -129,4 +129,4 @@ func TestSetupCLIArgs(t *testing.T) {
 			}
 		})
 	}
-}
+}

testutil/file_creation_test.go

@@ -83,7 +83,7 @@ func TestCreateTestFile(t *testing.T) {
 			}
 
 			// Verify content
-			readContent, err := os.ReadFile(filePath)
+			readContent, err := os.ReadFile(filePath) // #nosec G304 - test file path is controlled
 			if err != nil {
 				t.Fatalf("Failed to read created file: %v", err)
 			}
@@ -272,7 +272,7 @@ func TestCreateTestFiles(t *testing.T) {
 
 			// Verify each file
 			for i, filePath := range createdFiles {
-				content, err := os.ReadFile(filePath)
+				content, err := os.ReadFile(filePath) // #nosec G304 - test file path is controlled
 				if err != nil {
 					t.Errorf("Failed to read file %s: %v", filePath, err)
 					continue
@@ -283,4 +283,4 @@ func TestCreateTestFiles(t *testing.T) {
 			}
 		})
 	}
-}
+}

testutil/verification_test.go

@@ -31,10 +31,10 @@ func TestVerifyContentContains(t *testing.T) {
 			}
 		}()
 
-		// This would normally fail but we're just checking it doesn't panic
+		// This would normally fail, but we're just checking it doesn't panic
 		content := "test"
 		expected := []string{"not found"}
-		// Create a sub-test that we expect to fail
+		// Create a subtest that we expect to fail
 		t.Run("expected_failure", func(t *testing.T) {
 			t.Skip("Skipping actual failure test")
 			VerifyContentContains(t, content, expected)
@@ -59,7 +59,7 @@ func TestMustSucceed(t *testing.T) {
 			}
 		}()
 
-		// Create a sub-test that we expect to fail
+		// Create a subtest that we expect to fail
 		t.Run("expected_failure", func(t *testing.T) {
 			t.Skip("Skipping actual failure test")
 			MustSucceed(t, errors.New("test error"), "failed operation")
@@ -104,4 +104,4 @@ func TestCloseFile(t *testing.T) {
 			t.Error("Expected write to fail on closed file")
 		}
 	})
-}
+}