fix: resolve all 89 golangci-lint errors (#2)

* fix: resolve all 89 golangci-lint errors

- Remove unused code (types, functions, constants, imports) - 22 fixes
- Replace WriteString(fmt.Sprintf(...)) with fmt.Fprintf(...) - 14 staticcheck fixes
- Remove dead variable assignments - 3 ineffassign fixes
- Add _ = for unchecked AddTags/DeleteAllTags/Shutdown/Close calls - 50 errcheck fixes

* refactor: assert errors from HandleRequest in test setup calls

Replace _, _ = p.HandleRequest(...) with proper error capture and
require.NoError(t, err) assertions in s3 and iam provider tests.

* fix: sanitize uploadID in multipartDir to prevent path traversal

Use filepath.Base to strip any path separators from uploadID before
constructing the multipart directory path.

* Potential fix for pull request finding 'CodeQL / Uncontrolled data used in path expression'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Potential fix for pull request finding 'CodeQL / Uncontrolled data used in path expression'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

---------

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: skyoo2003

cmd/devcloud/main.go

@@ -105,7 +105,7 @@ func main() {
 	// 404 handler so the dashboard routes don't leak service internals.
 	bus := eventbus.New()
 	logCollector := dashboard.NewLogCollector(1000)
-	var dashHandler http.Handler = http.NotFoundHandler()
+	dashHandler := http.NotFoundHandler()
 	webDir := ""
 	if cfg.Dashboard.Enabled {
 		dashAPI := dashboard.NewDashboardAPI(registry, logCollector)

internal/codegen/parser.go

@@ -105,7 +105,7 @@ func ParseSmithyJSON(data []byte) (*SmithyModel, error) {
 		}
 		if httpTrait, ok := opShape.Traits["smithy.api#http"]; ok {
 			var ht rawHTTPTrait
-			json.Unmarshal(httpTrait, &ht) //nolint:errcheck
+			_ = json.Unmarshal(httpTrait, &ht) //nolint:errcheck
 			op.HTTPMethod = ht.Method
 			op.HTTPUri = ht.URI
 		}
@@ -146,12 +146,12 @@ func ParseSmithyJSON(data []byte) (*SmithyModel, error) {
 					}
 					if hdr, ok := member.Traits["smithy.api#httpHeader"]; ok {
 						var headerName string
-						json.Unmarshal(hdr, &headerName) //nolint:errcheck
+						_ = json.Unmarshal(hdr, &headerName) //nolint:errcheck
 						m.HTTPHeader = headerName
 					}
 					if q, ok := member.Traits["smithy.api#httpQuery"]; ok {
 						var queryName string
-						json.Unmarshal(q, &queryName) //nolint:errcheck
+						_ = json.Unmarshal(q, &queryName) //nolint:errcheck
 						m.HTTPQuery = queryName
 					}
 				}
@@ -163,11 +163,11 @@ func ParseSmithyJSON(data []byte) (*SmithyModel, error) {
 
 			if errType, ok := rs.Traits["smithy.api#error"]; ok {
 				var et string
-				json.Unmarshal(errType, &et) //nolint:errcheck
+				_ = json.Unmarshal(errType, &et) //nolint:errcheck
 				shape.ErrorTrait = &ErrorTrait{Type: et}
 				if httpErr, ok := rs.Traits["smithy.api#httpError"]; ok {
 					var status int
-					json.Unmarshal(httpErr, &status) //nolint:errcheck
+					_ = json.Unmarshal(httpErr, &status) //nolint:errcheck
 					shape.ErrorTrait.HTTPStatus = status
 				}
 			}

internal/dashboard/api_test.go

@@ -48,7 +48,8 @@ func newTestRegistry(p *mockServicePlugin) *plugin.Registry {
 	reg.Register(p.id, func(cfg plugin.PluginConfig) plugin.ServicePlugin {
 		return captured
 	})
-	reg.Init(p.id, plugin.PluginConfig{}) //nolint:errcheck
+	_, err := reg.Init(p.id, plugin.PluginConfig{})
+	_ = err
 	return reg
 }
 

internal/dashboard/websocket.go

@@ -93,7 +93,7 @@ func (h *Hub) ServeWS(w http.ResponseWriter, r *http.Request) {
 			h.mu.Lock()
 			delete(h.clients, client)
 			h.mu.Unlock()
-			conn.Close()
+			_ = conn.Close()
 		})
 	}
 

internal/dashboard/websocket_test.go

@@ -42,7 +42,7 @@ func TestHub_ClientConnects(t *testing.T) {
 	defer server.Close()
 
 	conn := dialWS(t, wsURL(server.URL))
-	defer conn.Close()
+	defer func() { _ = conn.Close() }()
 
 	// Give the hub a moment to register the client.
 	time.Sleep(50 * time.Millisecond)
@@ -65,7 +65,7 @@ func TestHub_BroadcastEvent(t *testing.T) {
 	defer server.Close()
 
 	conn := dialWS(t, wsURL(server.URL))
-	defer conn.Close()
+	defer func() { _ = conn.Close() }()
 
 	// Allow the hub to register the client before publishing.
 	time.Sleep(50 * time.Millisecond)
@@ -81,7 +81,7 @@ func TestHub_BroadcastEvent(t *testing.T) {
 	require.NoError(t, err)
 
 	// Read message with a deadline to avoid hanging on failure.
-	conn.SetReadDeadline(time.Now().Add(2 * time.Second))
+	_ = conn.SetReadDeadline(time.Now().Add(2 * time.Second))
 	_, raw, err := conn.ReadMessage()
 	require.NoError(t, err)
 

internal/eventbus/eventbus_test.go

@@ -24,12 +24,11 @@ func TestPublishAndSubscribe(t *testing.T) {
 	})
 	defer unsub()
 
-	err := bus.Publish(context.Background(), Event{
+	require.NoError(t, bus.Publish(context.Background(), Event{
 		Source: "s3",
 		Type:   "s3:ObjectCreated",
 		Detail: map[string]any{"bucket": "test", "key": "hello.txt"},
-	})
-	require.NoError(t, err)
+	}))
 
 	time.Sleep(50 * time.Millisecond)
 	mu.Lock()
@@ -51,8 +50,8 @@ func TestSubscribeWildcard(t *testing.T) {
 	})
 	defer unsub()
 
-	bus.Publish(context.Background(), Event{Source: "s3", Type: "s3:ObjectCreated"})
-	bus.Publish(context.Background(), Event{Source: "sqs", Type: "sqs:MessageSent"})
+	require.NoError(t, bus.Publish(context.Background(), Event{Source: "s3", Type: "s3:ObjectCreated"}))
+	require.NoError(t, bus.Publish(context.Background(), Event{Source: "sqs", Type: "sqs:MessageSent"}))
 
 	time.Sleep(50 * time.Millisecond)
 	mu.Lock()
@@ -71,12 +70,12 @@ func TestUnsubscribe(t *testing.T) {
 		mu.Unlock()
 	})
 
-	bus.Publish(context.Background(), Event{Type: "test"})
+	require.NoError(t, bus.Publish(context.Background(), Event{Type: "test"}))
 	time.Sleep(50 * time.Millisecond)
 
 	unsub()
 
-	bus.Publish(context.Background(), Event{Type: "test"})
+	require.NoError(t, bus.Publish(context.Background(), Event{Type: "test"}))
 	time.Sleep(50 * time.Millisecond)
 
 	mu.Lock()

internal/gateway/gateway_test.go

@@ -38,7 +38,7 @@ func TestGateway_Integration(t *testing.T) {
 
 	res, err := http.Get(srv.URL + "/")
 	require.NoError(t, err)
-	defer res.Body.Close()
+	defer func() { _ = res.Body.Close() }()
 
 	assert.Equal(t, http.StatusOK, res.StatusCode)
 	// Middleware headers must be present.

internal/gateway/middleware.go

@@ -78,11 +78,11 @@ func ErrorRecoveryMiddleware(next http.Handler) http.Handler {
 					strings.HasPrefix(r.URL.Path, "/2015-03-31/") {
 					w.Header().Set("Content-Type", "application/json")
 					w.WriteHeader(http.StatusInternalServerError)
-					fmt.Fprintf(w, `{"__type":"InternalError","message":"%v"}`, rec)
+					_, _ = fmt.Fprintf(w, `{"__type":"InternalError","message":"%v"}`, rec)
 				} else {
 					w.Header().Set("Content-Type", "application/xml")
 					w.WriteHeader(http.StatusInternalServerError)
-					fmt.Fprintf(w, `<?xml version="1.0" encoding="UTF-8"?><Error><Code>InternalError</Code><Message>%v</Message></Error>`, rec)
+					_, _ = fmt.Fprintf(w, `<?xml version="1.0" encoding="UTF-8"?><Error><Code>InternalError</Code><Message>%v</Message></Error>`, rec)
 				}
 			}
 		}()

internal/plugin/registry_test.go

@@ -42,6 +42,7 @@ func TestRegistryGetUnknown(t *testing.T) {
 func TestRegistryList(t *testing.T) {
 	reg := NewRegistry()
 	reg.Register("s3", func(cfg PluginConfig) ServicePlugin { return &mockPlugin{} })
-	reg.Init("s3", PluginConfig{})
+	_, err := reg.Init("s3", PluginConfig{})
+	require.NoError(t, err)
 	assert.Equal(t, []string{"s3"}, reg.ActiveServices())
 }

internal/services/account/provider.go

@@ -50,7 +50,7 @@ func (p *AccountProvider) HandleRequest(_ context.Context, op string, req *http.
 	body, _ := io.ReadAll(req.Body)
 	var bodyMap map[string]any
 	if len(body) > 0 {
-		json.Unmarshal(body, &bodyMap)
+		_ = json.Unmarshal(body, &bodyMap)
 	}
 	if bodyMap == nil {
 		bodyMap = map[string]any{}