Fix linter issues

Signed-off-by: Paulo Gomes <paulo@entire.io>
Entire-Checkpoint: abef9edf20cd
Entire-Checkpoint: a70d97c363c8

Author: pjbgf

cmd/entire/cli/checkpoint/committed.go

@@ -1614,6 +1614,7 @@ func GetGitAuthorFromRepo(repo *git.Repository) (name, email string) {
 
 	// If not found in local config, try global config
 	if name == "" || email == "" {
+		//nolint:staticcheck // the v6 is not yet released, revisit once it is.
 		globalCfg, err := config.LoadConfig(config.GlobalScope)
 		if err == nil {
 			if name == "" {
@@ -1676,11 +1677,12 @@ func CreateCommit(ctx context.Context, repo *git.Repository, treeHash, parentHas
 // If no signer is registered, signing is disabled via settings, or signing fails,
 // the commit is left unsigned and the error is logged.
 func SignCommitBestEffort(ctx context.Context, commit *object.Commit) {
-	if !settings.IsSignCheckpointCommitsEnabled(ctx) {
+	// Check plugin availability first (in-memory) before hitting disk for settings.
+	if !plugin.Has(plugin.ObjectSigner()) {
 		return
 	}
 
-	if !plugin.Has(plugin.ObjectSigner()) {
+	if !settings.IsSignCheckpointCommitsEnabled(ctx) {
 		return
 	}
 
@@ -1705,6 +1707,7 @@ func SignCommitBestEffort(ctx context.Context, commit *object.Commit) {
 		logging.Warn(ctx, "failed to read encoded commit", slog.String("error", err.Error()))
 		return
 	}
+	defer r.Close()
 
 	sig, err := signer.Sign(r)
 	if err != nil {

cmd/entire/cli/checkpoint/committed_signing_test.go

@@ -0,0 +1,154 @@
+package checkpoint
+
+import (
+	"context"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/entireio/cli/cmd/entire/cli/paths"
+
+	"github.com/go-git/go-git/v6/plumbing"
+	"github.com/go-git/go-git/v6/plumbing/object"
+	"github.com/go-git/go-git/v6/x/plugin"
+)
+
+type stubSigner struct {
+	sig []byte
+	err error
+}
+
+func (s *stubSigner) Sign(_ io.Reader) ([]byte, error) {
+	return s.sig, s.err
+}
+
+func setupSigningEnv(t *testing.T, disableSigning bool) {
+	t.Helper()
+
+	dir := t.TempDir()
+
+	// Minimal git repo so paths.WorktreeRoot resolves.
+	if err := os.MkdirAll(filepath.Join(dir, ".git"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	entireDir := filepath.Join(dir, ".entire")
+	if err := os.MkdirAll(entireDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	if disableSigning {
+		content := `{"sign_checkpoint_commits": false}`
+		if err := os.WriteFile(filepath.Join(entireDir, "settings.json"), []byte(content), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	paths.ClearWorktreeRootCache()
+	t.Chdir(dir)
+	t.Cleanup(func() {
+		resetPluginEntry("object-signer")
+		paths.ClearWorktreeRootCache()
+	})
+}
+
+func newTestCommit() *object.Commit {
+	sig := object.Signature{
+		Name:  "Test",
+		Email: "test@test.com",
+		When:  time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC),
+	}
+	return &object.Commit{
+		TreeHash:  plumbing.ZeroHash,
+		Author:    sig,
+		Committer: sig,
+		Message:   "test commit",
+	}
+}
+
+func TestSignCommitBestEffort_Signs(t *testing.T) { //nolint:paralleltest // t.Chdir requires non-parallel
+	setupSigningEnv(t, false)
+
+	err := plugin.Register(plugin.ObjectSigner(), func() plugin.Signer {
+		return &stubSigner{sig: []byte("FAKESIG")}
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	commit := newTestCommit()
+	SignCommitBestEffort(context.Background(), commit)
+
+	if commit.Signature != "FAKESIG" {
+		t.Errorf("expected signature %q, got %q", "FAKESIG", commit.Signature)
+	}
+}
+
+func TestSignCommitBestEffort_SkipsWhenDisabled(t *testing.T) { //nolint:paralleltest // t.Chdir requires non-parallel
+	setupSigningEnv(t, true)
+
+	err := plugin.Register(plugin.ObjectSigner(), func() plugin.Signer {
+		t.Fatal("signer should not be called when signing is disabled")
+		return nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	commit := newTestCommit()
+	SignCommitBestEffort(context.Background(), commit)
+
+	if commit.Signature != "" {
+		t.Errorf("expected empty signature, got %q", commit.Signature)
+	}
+}
+
+func TestSignCommitBestEffort_ErrorIsBestEffort(t *testing.T) { //nolint:paralleltest // t.Chdir requires non-parallel
+	setupSigningEnv(t, false)
+
+	err := plugin.Register(plugin.ObjectSigner(), func() plugin.Signer {
+		return &stubSigner{err: errors.New("signing failed")}
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	commit := newTestCommit()
+	SignCommitBestEffort(context.Background(), commit)
+
+	if commit.Signature != "" {
+		t.Errorf("expected empty signature after error, got %q", commit.Signature)
+	}
+}
+
+func TestSignCommitBestEffort_NoSignerRegistered(t *testing.T) { //nolint:paralleltest // t.Chdir requires non-parallel
+	setupSigningEnv(t, false)
+
+	commit := newTestCommit()
+	SignCommitBestEffort(context.Background(), commit)
+
+	if commit.Signature != "" {
+		t.Errorf("expected empty signature without signer, got %q", commit.Signature)
+	}
+}
+
+func TestSignCommitBestEffort_NilSigner(t *testing.T) { //nolint:paralleltest // t.Chdir requires non-parallel
+	setupSigningEnv(t, false)
+
+	err := plugin.Register(plugin.ObjectSigner(), func() plugin.Signer {
+		return nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	commit := newTestCommit()
+	SignCommitBestEffort(context.Background(), commit)
+
+	if commit.Signature != "" {
+		t.Errorf("expected empty signature with nil signer, got %q", commit.Signature)
+	}
+}

cmd/entire/cli/checkpoint/global_test.go

@@ -15,7 +15,9 @@ func TestMain(m *testing.M) {
 	// For tests, ensure that go-git always gets empty Configs for both
 	// system and global scopes. This way the current environment does not
 	// impact the tests.
-	err := plugin.Register(plugin.ConfigLoader(), config.NewEmpty)
+	err := plugin.Register(plugin.ConfigLoader(), func() plugin.ConfigSource {
+		return config.NewEmpty()
+	})
 	if err != nil {
 		panic(fmt.Errorf("failed to register config storers: %w", err))
 	}

cmd/entire/cli/global_test.go

@@ -15,7 +15,9 @@ func TestMain(m *testing.M) {
 	// Register a default ConfigSource so tests that call ConfigScoped
 	// (directly or indirectly via Commit/CreateTag) don't fail with
 	// "no config loader registered".
-	err := plugin.Register(plugin.ConfigLoader(), config.NewEmpty)
+	err := plugin.Register(plugin.ConfigLoader(), func() plugin.ConfigSource {
+		return config.NewEmpty()
+	})
 	if err != nil {
 		panic(fmt.Errorf("failed to register config storers: %w", err))
 	}

cmd/entire/cli/strategy/global_test.go

@@ -15,7 +15,9 @@ func TestMain(m *testing.M) {
 	// Register a default ConfigSource so tests that call ConfigScoped
 	// (directly or indirectly via Commit/CreateTag) don't fail with
 	// "no config loader registered".
-	err := plugin.Register(plugin.ConfigLoader(), config.NewEmpty)
+	err := plugin.Register(plugin.ConfigLoader(), func() plugin.ConfigSource {
+		return config.NewEmpty()
+	})
 	if err != nil {
 		panic(fmt.Errorf("failed to register config storers: %w", err))
 	}

cmd/entire/main.go

@@ -59,6 +59,7 @@ func main() {
 }
 
 func registerObjectSigner() {
+	//nolint:errcheck,gosec // best-effort; if registration fails, commits are left unsigned
 	plugin.Register(plugin.ObjectSigner(), func() plugin.Signer {
 		cfgSource, err := plugin.Get(plugin.ConfigLoader())
 		if err != nil {
@@ -94,13 +95,14 @@ func registerObjectSigner() {
 
 // connectSSHAgent connects to the SSH agent via SSH_AUTH_SOCK.
 // Returns nil if the agent is unavailable.
-func connectSSHAgent() agent.Agent {
+func connectSSHAgent() agent.Agent { //nolint:ireturn // must return the ssh agent interface
 	sock := os.Getenv("SSH_AUTH_SOCK")
 	if sock == "" {
 		return nil
 	}
 
-	conn, err := net.Dial("unix", sock)
+	var d net.Dialer
+	conn, err := d.DialContext(context.Background(), "unix", sock)
 	if err != nil {
 		return nil
 	}