cleanup: lint fixes, tests, and go 1.26.4 bump on top of #276

review-driven follow-ups to PR #276 (CE-1579):

- table-driven tests for the helpers added in #276: TestValueOrDash,
  TestFormatTimestamp (precision tiers + boundary cases),
  TestCreateCmd_FlagValidation, expanded TestBuildTemplateEndpointGQLInput,
  TestModelVersionHash edge cases.
- benchmark + correctness check for cmd/serverless/create.go::randomString
  with two alternative implementations; data confirms keeping the current
  form (call site is one-shot per CLI invocation).
- lint fixes in #276-touched files: 6× 200 -> http.StatusOK in api/model.go,
  sprintfQuotedString in addModelToRepo.go, two PR-introduced err shadows in
  create.go and addModelToRepo.go, removed an unjustified //nolint:gosec.
- math/rand -> math/rand/v2 for randomString with a documented nolint
  explaining why crypto/rand is not warranted (display-only template-name
  uniqueness suffix, not a token).
- range over int in randomString.
- go.mod bump to 1.26.4, drop explicit toolchain directive.
- dep bumps: google/uuid 1.4->1.6, x/crypto 0.50->0.53, x/mod 0.34->0.37,
  and transitive x/net x/sys x/term x/text.
- ci.yml + release.yml setup-go bumped to 1.26.4.

build + go vet + full test suite all pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: 2 people

.github/workflows/ci.yml

@@ -5,10 +5,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Setup Go 1.26.3
+      - name: Setup Go 1.26.4
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.3
+          go-version: 1.26.4
       # You can test your matrix by printing the current Go version
       - name: Display Go version
         run: go version

.github/workflows/release.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.26.3"
+          go-version: "1.26.4"
 
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6

api/model.go

@@ -290,7 +290,7 @@ func AddModelToRepo(input *AddModelToRepoInput) (*Model, error) {
 	if err != nil {
 		return nil, err
 	}
-	if res.StatusCode != 200 {
+	if res.StatusCode != http.StatusOK {
 		return nil, fmt.Errorf("statuscode %d: %s", res.StatusCode, string(rawData))
 	}
 
@@ -374,7 +374,7 @@ query %s {
 	if err != nil {
 		return nil, err
 	}
-	if res.StatusCode != 200 {
+	if res.StatusCode != http.StatusOK {
 		return nil, fmt.Errorf("statuscode %d: %s", res.StatusCode, string(rawData))
 	}
 
@@ -492,7 +492,7 @@ func GetModel(input *GetModelInput) (*Model, error) {
 	if err != nil {
 		return nil, err
 	}
-	if res.StatusCode != 200 {
+	if res.StatusCode != http.StatusOK {
 		return nil, fmt.Errorf("statuscode %d: %s", res.StatusCode, string(rawData))
 	}
 
@@ -580,7 +580,7 @@ func RemoveModel(input *RemoveModelInput) (*ModelRepoMutationResult, error) {
 	if err != nil {
 		return nil, err
 	}
-	if res.StatusCode != 200 {
+	if res.StatusCode != http.StatusOK {
 		return nil, fmt.Errorf("statuscode %d: %s", res.StatusCode, string(rawData))
 	}
 
@@ -714,7 +714,7 @@ func CreateModelRepoUpload(input *CreateModelRepoUploadInput) (*ModelRepoMutatio
 	if err != nil {
 		return nil, err
 	}
-	if res.StatusCode != 200 {
+	if res.StatusCode != http.StatusOK {
 		return nil, fmt.Errorf("statuscode %d: %s", res.StatusCode, string(rawData))
 	}
 
@@ -863,7 +863,7 @@ func UpdateModelVersionStatus(hash, status string) (*ModelVersion, error) {
 	if err != nil {
 		return nil, err
 	}
-	if res.StatusCode != 200 {
+	if res.StatusCode != http.StatusOK {
 		return nil, fmt.Errorf("statuscode %d: %s", res.StatusCode, string(rawData))
 	}
 

cmd/model/addModelToRepo.go

@@ -207,7 +207,7 @@ func runAddModel(cmd *cobra.Command, args []string) {
 	uploadInput.Name = addModelName
 
 	if len(modelFiles) > 0 {
-		err := uploadModelFiles(modelFiles, uploadInput)
+		err = uploadModelFiles(modelFiles, uploadInput)
 		cobra.CheckErr(err)
 		return
 	}
@@ -400,7 +400,7 @@ func completeModelUpload(upload *api.ModelRepoUpload, artifactPath string) error
 				err = fmt.Errorf("upload part %d missing ETag", part.PartNumber)
 				return
 			}
-			completed = append(completed, completedPart{PartNumber: part.PartNumber, ETag: fmt.Sprintf("\"%s\"", etag)})
+			completed = append(completed, completedPart{PartNumber: part.PartNumber, ETag: fmt.Sprintf("%q", etag)})
 		}()
 		if err != nil {
 			return err

cmd/model/getModels_test.go

@@ -1,7 +1,9 @@
 package model
 
 import (
+	"strconv"
 	"testing"
+	"time"
 
 	"github.com/runpod/runpodctl/api"
 )
@@ -22,6 +24,23 @@ func TestModelVersionHash(t *testing.T) {
 			}},
 			want: "hash-1",
 		},
+		{
+			name: "skips nil version entries",
+			model: &api.Model{Versions: []*api.ModelVersion{
+				nil,
+				{Hash: "hash-after-nil"},
+			}},
+			want: "hash-after-nil",
+		},
+		{
+			name: "all hashes blank or whitespace",
+			model: &api.Model{Versions: []*api.ModelVersion{
+				{Hash: ""},
+				{Hash: "   "},
+				{Hash: "\t\n"},
+			}},
+			want: "",
+		},
 		{
 			name:  "no versions",
 			model: &api.Model{},
@@ -42,3 +61,94 @@ func TestModelVersionHash(t *testing.T) {
 		})
 	}
 }
+
+func TestValueOrDash(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{name: "empty -> dash", in: "", want: "-"},
+		{name: "whitespace only -> dash", in: "   ", want: "-"},
+		{name: "tabs and newlines -> dash", in: "\t\n ", want: "-"},
+		{name: "value is preserved", in: "hello", want: "hello"},
+		{name: "value with surrounding whitespace is trimmed", in: "  hi  ", want: "hi"},
+		{name: "internal whitespace preserved", in: "a b c", want: "a b c"},
+		{name: "single char", in: "x", want: "x"},
+		{name: "unicode preserved", in: "café", want: "café"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := valueOrDash(tt.in); got != tt.want {
+				t.Fatalf("valueOrDash(%q) = %q, want %q", tt.in, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestFormatTimestamp(t *testing.T) {
+	// Reference epoch values for 2021-01-01T00:00:00Z (chosen for stable RFC3339
+	// formatting across precision tiers, no fractional seconds).
+	const (
+		secs   = int64(1609459200)          // 10 digits
+		millis = int64(1609459200000)       // 13 digits
+		micros = int64(1609459200000000)    // 16 digits
+		nanos  = int64(1609459200000000000) // 19 digits
+		want   = "2021-01-01T00:00:00Z"
+	)
+
+	tests := []struct {
+		name string
+		in   string
+		want string
+	}{
+		// positive: each precision tier should round to the same RFC3339 second.
+		{name: "seconds (10 digits)", in: "1609459200", want: want},
+		{name: "milliseconds (13 digits)", in: "1609459200000", want: want},
+		{name: "microseconds (16 digits)", in: "1609459200000000", want: want},
+		{name: "nanoseconds (19 digits)", in: "1609459200000000000", want: want},
+
+		// positive: whitespace is trimmed before parsing.
+		{name: "trims surrounding whitespace", in: "  1609459200  ", want: want},
+
+		// negative: empty / blank renders as dash.
+		{name: "empty -> dash", in: "", want: "-"},
+		{name: "whitespace only -> dash", in: "   ", want: "-"},
+
+		// negative: non-numeric is passed through unchanged (ISO strings from
+		// the API should not be mangled).
+		{name: "ISO 8601 passthrough", in: "2024-06-10T12:00:00Z", want: "2024-06-10T12:00:00Z"},
+		{name: "garbage passthrough", in: "not-a-number", want: "not-a-number"},
+
+		// corner: epoch zero across precisions.
+		{name: "epoch zero seconds", in: "0", want: "1970-01-01T00:00:00Z"},
+
+		// corner: negative timestamp (pre-epoch).
+		{name: "negative seconds (pre-epoch)", in: "-1", want: "1969-12-31T23:59:59Z"},
+
+		// boundary: default-branch path. A length-11 millisecond timestamp
+		// (e.g. 99999999999 ms) is < 1e12 so the default branch treats it as
+		// seconds — documenting the current (lossy) behavior so a future change
+		// of the heuristic is intentional.
+		{name: "11-digit value falls through default as seconds", in: "10000000000", want: time.Unix(10000000000, 0).UTC().Format(time.RFC3339)},
+		{name: "12-digit value above default threshold treated as ms", in: "1000000000001", want: time.Unix(1000000000, 1*int64(time.Millisecond)).UTC().Format(time.RFC3339)},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := formatTimestamp(tt.in); got != tt.want {
+				t.Fatalf("formatTimestamp(%q) = %q, want %q", tt.in, got, tt.want)
+			}
+		})
+	}
+
+	// Sanity-check the precision-tier constants stay aligned: every tier must
+	// resolve to the same RFC3339 instant when fed through formatTimestamp.
+	for _, v := range []int64{secs, millis, micros, nanos} {
+		got := formatTimestamp(strconv.FormatInt(v, 10))
+		if got != want {
+			t.Fatalf("precision tier %d produced %q, want %q", v, got, want)
+		}
+	}
+}

cmd/serverless/create.go

@@ -3,7 +3,7 @@ package serverless
 import (
 	"encoding/json"
 	"fmt"
-	"math/rand"
+	"math/rand/v2"
 	"strings"
 
 	"github.com/runpod/runpodctl/internal/api"
@@ -183,7 +183,6 @@ func runCreate(cmd *cobra.Command, args []string) error {
 			endpointName = listing.Title
 		}
 
-		//nolint:gosec
 		templateName := fmt.Sprintf("%s__template__%s", endpointName, randomString(7))
 
 		gqlReq := &api.EndpointCreateGQLInput{
@@ -273,14 +272,14 @@ func runCreate(cmd *cobra.Command, args []string) error {
 
 	if len(createModelReferences) > 0 {
 		gqlReq := buildTemplateEndpointGQLInput(req, gpuTypeID, createDataCenterIDs, createModelReferences)
-		endpoint, err := client.CreateEndpointGQL(gqlReq)
-		if err != nil {
-			output.Error(err)
-			return fmt.Errorf("failed to create endpoint: %w", err)
+		gqlEndpoint, gqlErr := client.CreateEndpointGQL(gqlReq)
+		if gqlErr != nil {
+			output.Error(gqlErr)
+			return fmt.Errorf("failed to create endpoint: %w", gqlErr)
 		}
 
 		format := output.ParseFormat(cmd.Flag("output").Value.String())
-		return output.Print(endpoint, &output.Config{Format: format})
+		return output.Print(gqlEndpoint, &output.Config{Format: format})
 	}
 
 	endpoint, err := client.CreateEndpoint(req)
@@ -319,11 +318,16 @@ func buildTemplateEndpointGQLInput(req *api.EndpointCreateRequest, gpuTypeID, lo
 	}
 }
 
+// randomString returns an n-character lowercase-alphanumeric suffix.
+// The suffix is used only to disambiguate generated template names; it is not
+// a token, secret, or anything an attacker benefits from predicting. gosec
+// G404 flags math/rand/v2 generically, so the directive below is a deliberate
+// suppression rather than a missed crypto/rand call.
 func randomString(n int) string {
 	const letters = "abcdefghijklmnopqrstuvwxyz0123456789"
 	b := make([]byte, n)
-	for i := range b {
-		b[i] = letters[rand.Intn(len(letters))] //nolint:gosec
+	for i := range n {
+		b[i] = letters[rand.IntN(len(letters))] //nolint:gosec // non-crypto: template-name uniqueness suffix, not a token
 	}
 	return string(b)
 }