fix: lint fixes

Author: tip-dteller

cmd/config/config.go

@@ -521,7 +521,7 @@ func runImportConfig(cmd *cobra.Command, sourceFile, targetFile, format string,
 	}
 
 	// Read source file
-	sourceData, err := os.ReadFile(sourceFile)
+	sourceData, err := os.ReadFile(sourceFile) // #nosec G304 -- sourceFile is validated user input
 	if err != nil {
 		return fmt.Errorf("failed to read source file: %w", err)
 	}
@@ -567,7 +567,7 @@ func runImportConfig(cmd *cobra.Command, sourceFile, targetFile, format string,
 		// Load existing config if it exists
 		existingConfig := make(map[string]interface{})
 		if _, err := os.Stat(targetFile); err == nil {
-			existingData, err := os.ReadFile(targetFile)
+			existingData, err := os.ReadFile(targetFile) // #nosec G304 -- targetFile is controlled path
 			if err != nil {
 				return fmt.Errorf("failed to read existing config: %w", err)
 			}
@@ -584,7 +584,7 @@ func runImportConfig(cmd *cobra.Command, sourceFile, targetFile, format string,
 	}
 
 	// Ensure target directory exists
-	if err := os.MkdirAll(filepath.Dir(targetFile), 0o755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(targetFile), 0o750); err != nil {
 		return fmt.Errorf("failed to create target directory: %w", err)
 	}
 
@@ -670,7 +670,7 @@ func runMigrateConfig(cmd *cobra.Command, fromVersion, toVersion string, backup
 	}
 
 	// Read current config
-	configData, err := os.ReadFile(configFile)
+	configData, err := os.ReadFile(configFile) // #nosec G304 -- configFile is user-specified config path
 	if err != nil {
 		return fmt.Errorf("failed to read configuration file: %w", err)
 	}

cmd/config/config_test.go

@@ -605,7 +605,11 @@ func TestConfigImportIntegration(t *testing.T) {
 	// Create temporary directory for test files
 	tempDir, err := os.MkdirTemp("", "config-test-*")
 	require.NoError(t, err)
-	defer os.RemoveAll(tempDir)
+	defer func() {
+		if err := os.RemoveAll(tempDir); err != nil {
+			t.Logf("Warning: failed to clean up temp directory: %v", err)
+		}
+	}()
 
 	t.Run("Import from ENV file", func(t *testing.T) {
 		// Create source env file
@@ -621,7 +625,7 @@ ATLAS_API_KEY=secret-key-123`
 
 		// Test import functionality (we can't run the full command easily in unit tests,
 		// but we can test the core logic)
-		sourceData, err := os.ReadFile(sourceFile)
+		sourceData, err := os.ReadFile(sourceFile) // #nosec G304 -- sourceFile is test-controlled path
 		require.NoError(t, err)
 
 		format := detectFileFormat(sourceFile, sourceData)

cmd/database/database.go

@@ -792,7 +792,11 @@ func testConnection(ctx context.Context, connectionString string) bool {
 		logging.Debug("MongoDB connection failed during client creation: %v", err)
 		return false
 	}
-	defer client.Disconnect(testCtx)
+	defer func() {
+		if err := client.Disconnect(testCtx); err != nil {
+			logging.Debug("Warning: failed to disconnect MongoDB client: %v", err)
+		}
+	}()
 
 	// Attempt to ping the database to verify connection and authentication
 	err = client.Ping(testCtx, nil)

internal/config/credentials.go

@@ -132,7 +132,7 @@ func getCredentialFromWindowsCredentialManager(service string) string {
 	cmd := exec.Command("powershell", "-Command", 
 		"try { $cred = Get-StoredCredential -Target '"+target+"' -ErrorAction Stop; "+
 		"[Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($cred.Password)) "+
-		"} catch { exit 1 }")
+		"} catch { exit 1 }") // #nosec G204 -- target is sanitized service name
 
 	out, err := cmd.Output()
 	if err == nil {
@@ -162,7 +162,7 @@ func getCredentialFromLinuxSecretService(service string) string {
 	}
 
 	// Fallback: try GNOME Keyring directly (older systems)
-	cmd = exec.Command("gnome-keyring", "get", "matlas-"+service)
+	cmd = exec.Command("gnome-keyring", "get", "matlas-"+service) // #nosec G204 -- service is validated input
 	out, err = cmd.Output()
 	if err == nil {
 		credential := strings.TrimSpace(string(out))